Analysis
-
max time kernel
130s -
max time network
12s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
30-10-2020 07:57
Static task
static1
Behavioral task
behavioral1
Sample
ssf.dll
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
ssf.dll
-
Size
438KB
-
MD5
8688f0253256e5c6cfc27a3801e6077b
-
SHA1
9364679fa1142dd15759fc22ed3d15b65ab447b2
-
SHA256
1ea43f2b7589f266a7574e987b3a5c80634060fc2d1fe0eae77410c76dea326c
-
SHA512
e7c6256b57869817dade08cb8ef706fa688e27f1d6cda8894c7bd19e4abf23149d83347d3748f9cee08cb3333282ff295291700484f5b2b3d9834b684b9c7aa9
Malware Config
Extracted
Family
zloader
Botnet
Botnet1
Campaign
new_1
C2
https://representis.xyz/noagate.php
https://representis.icu/noagate.php
rc4.plain
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 1648 set thread context of 1260 1648 rundll32.exe msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msiexec.exepid process 1260 msiexec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1004 wrote to memory of 1648 1004 rundll32.exe rundll32.exe PID 1004 wrote to memory of 1648 1004 rundll32.exe rundll32.exe PID 1004 wrote to memory of 1648 1004 rundll32.exe rundll32.exe PID 1004 wrote to memory of 1648 1004 rundll32.exe rundll32.exe PID 1004 wrote to memory of 1648 1004 rundll32.exe rundll32.exe PID 1004 wrote to memory of 1648 1004 rundll32.exe rundll32.exe PID 1004 wrote to memory of 1648 1004 rundll32.exe rundll32.exe PID 1648 wrote to memory of 1260 1648 rundll32.exe msiexec.exe PID 1648 wrote to memory of 1260 1648 rundll32.exe msiexec.exe PID 1648 wrote to memory of 1260 1648 rundll32.exe msiexec.exe PID 1648 wrote to memory of 1260 1648 rundll32.exe msiexec.exe PID 1648 wrote to memory of 1260 1648 rundll32.exe msiexec.exe PID 1648 wrote to memory of 1260 1648 rundll32.exe msiexec.exe PID 1648 wrote to memory of 1260 1648 rundll32.exe msiexec.exe PID 1648 wrote to memory of 1260 1648 rundll32.exe msiexec.exe PID 1648 wrote to memory of 1260 1648 rundll32.exe msiexec.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ssf.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ssf.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1260-2-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/1260-1-0x0000000000090000-0x00000000000BD000-memory.dmpFilesize
180KB
-
memory/1260-3-0x0000000000090000-0x00000000000BD000-memory.dmpFilesize
180KB
-
memory/1260-4-0x0000000000000000-mapping.dmp
-
memory/1648-0-0x0000000000000000-mapping.dmp