Analysis
-
max time kernel
95s -
max time network
99s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
30-10-2020 07:57
Static task
static1
Behavioral task
behavioral1
Sample
ssf.dll
Resource
win7v20201028
0 signatures
0 seconds
General
-
Target
ssf.dll
-
Size
438KB
-
MD5
8688f0253256e5c6cfc27a3801e6077b
-
SHA1
9364679fa1142dd15759fc22ed3d15b65ab447b2
-
SHA256
1ea43f2b7589f266a7574e987b3a5c80634060fc2d1fe0eae77410c76dea326c
-
SHA512
e7c6256b57869817dade08cb8ef706fa688e27f1d6cda8894c7bd19e4abf23149d83347d3748f9cee08cb3333282ff295291700484f5b2b3d9834b684b9c7aa9
Malware Config
Extracted
Family
zloader
Botnet
Botnet1
Campaign
new_1
C2
https://representis.xyz/noagate.php
https://representis.icu/noagate.php
rc4.plain
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 1360 set thread context of 2776 1360 rundll32.exe msiexec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1304 wrote to memory of 1360 1304 rundll32.exe rundll32.exe PID 1304 wrote to memory of 1360 1304 rundll32.exe rundll32.exe PID 1304 wrote to memory of 1360 1304 rundll32.exe rundll32.exe PID 1360 wrote to memory of 2776 1360 rundll32.exe msiexec.exe PID 1360 wrote to memory of 2776 1360 rundll32.exe msiexec.exe PID 1360 wrote to memory of 2776 1360 rundll32.exe msiexec.exe PID 1360 wrote to memory of 2776 1360 rundll32.exe msiexec.exe PID 1360 wrote to memory of 2776 1360 rundll32.exe msiexec.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ssf.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ssf.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵