Analysis
-
max time kernel
71s -
max time network
113s -
platform
windows10_x64 -
resource
win10 -
submitted
28-10-2020 01:41
Static task
static1
Behavioral task
behavioral1
Sample
m1n.exe
Resource
win7
General
-
Target
m1n.exe
-
Size
283KB
-
MD5
399afac5870b698e7692fb7bb2a500eb
-
SHA1
635e5b168da209d1db751d492be5505aca4b1b2f
-
SHA256
145d0203cf0cdfec44c2a27af39fc89158db68b85b8c0b46f661389283a8284a
-
SHA512
4c6db836b033edcaa14eab22e461d9e509d6b14f0381bdaaaf4df5e1e49771a0619bd175476e8d80a89b62bf66efc77da51acc5a215d596dd4003ab2cce76d81
Malware Config
Extracted
zloader
r2
r2
https://notsweets.net/LKhwojehDgwegSDG/gateJKjdsh.php
https://olpons.com/LKhwojehDgwegSDG/gateJKjdsh.php
https://karamelliar.org/LKhwojehDgwegSDG/gateJKjdsh.php
https://dogrunn.com/LKhwojehDgwegSDG/gateJKjdsh.php
https://azoraz.net/LKhwojehDgwegSDG/gateJKjdsh.php
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
m1n.exedescription pid process target process PID 4008 created 3000 4008 m1n.exe Explorer.EXE -
Blacklisted process makes network request 2 IoCs
Processes:
msiexec.exeflow pid process 15 2144 msiexec.exe 16 2144 msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
m1n.exedescription pid process target process PID 4008 set thread context of 2144 4008 m1n.exe msiexec.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
m1n.exepid process 4008 m1n.exe 4008 m1n.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
m1n.exemsiexec.exedescription pid process Token: SeDebugPrivilege 4008 m1n.exe Token: SeSecurityPrivilege 2144 msiexec.exe Token: SeSecurityPrivilege 2144 msiexec.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
m1n.exedescription pid process target process PID 4008 wrote to memory of 2144 4008 m1n.exe msiexec.exe PID 4008 wrote to memory of 2144 4008 m1n.exe msiexec.exe PID 4008 wrote to memory of 2144 4008 m1n.exe msiexec.exe PID 4008 wrote to memory of 2144 4008 m1n.exe msiexec.exe PID 4008 wrote to memory of 2144 4008 m1n.exe msiexec.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\m1n.exe"C:\Users\Admin\AppData\Local\Temp\m1n.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe2⤵
- Blacklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2144-2-0x0000000000F10000-0x0000000000F36000-memory.dmpFilesize
152KB
-
memory/2144-3-0x0000000000000000-mapping.dmp
-
memory/4008-0-0x0000000000D46000-0x0000000000D47000-memory.dmpFilesize
4KB
-
memory/4008-1-0x0000000002B30000-0x0000000002B31000-memory.dmpFilesize
4KB