Analysis
-
max time kernel
200s -
max time network
202s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
02-11-2020 07:54
Static task
static1
General
-
Target
kFQR.dll
-
Size
277KB
-
MD5
fd0a2b6c6203e4b56d8c73f6323d5d68
-
SHA1
e87f8d9f7e768f4169355ffda625a80f0e00decb
-
SHA256
a4711adb921498e7c74af3fd05daaa525f261e7044d457e905dad66767e5b8b4
-
SHA512
85bc1fd3fba441bbb67d6b75c3f058f2acec396299a012bc0c4ba5c1a5a105c712c54f258a58dc5ef2ef7789a58227d4ce99d14f53ceaf5c3cebdd44fe930c3a
Malware Config
Extracted
Family
zloader
Botnet
nut
Campaign
30/10
C2
https://creditoacumuladoicms.com.br/npnegt.php
https://morgadoent.co.za/fp3jsl.php
https://access-one.us/clkgmw.php
https://amazonuniverse.in/dgxcee.php
https://ntandingsundhosmala.tk/wp-smarts.php
rc4.plain
rsa_pubkey.plain
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 1664 created 1248 1664 rundll32.exe Explorer.EXE -
Blacklisted process makes network request 26 IoCs
Processes:
msiexec.exeflow pid process 6 1224 msiexec.exe 7 1224 msiexec.exe 8 1224 msiexec.exe 9 1224 msiexec.exe 10 1224 msiexec.exe 11 1224 msiexec.exe 12 1224 msiexec.exe 13 1224 msiexec.exe 14 1224 msiexec.exe 15 1224 msiexec.exe 16 1224 msiexec.exe 17 1224 msiexec.exe 18 1224 msiexec.exe 19 1224 msiexec.exe 20 1224 msiexec.exe 21 1224 msiexec.exe 22 1224 msiexec.exe 23 1224 msiexec.exe 24 1224 msiexec.exe 25 1224 msiexec.exe 26 1224 msiexec.exe 28 1224 msiexec.exe 29 1224 msiexec.exe 30 1224 msiexec.exe 32 1224 msiexec.exe 33 1224 msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 1664 set thread context of 1224 1664 rundll32.exe msiexec.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
rundll32.exepid process 1664 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
rundll32.exemsiexec.exedescription pid process Token: SeDebugPrivilege 1664 rundll32.exe Token: SeSecurityPrivilege 1224 msiexec.exe Token: SeSecurityPrivilege 1224 msiexec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1700 wrote to memory of 1664 1700 rundll32.exe rundll32.exe PID 1700 wrote to memory of 1664 1700 rundll32.exe rundll32.exe PID 1700 wrote to memory of 1664 1700 rundll32.exe rundll32.exe PID 1700 wrote to memory of 1664 1700 rundll32.exe rundll32.exe PID 1700 wrote to memory of 1664 1700 rundll32.exe rundll32.exe PID 1700 wrote to memory of 1664 1700 rundll32.exe rundll32.exe PID 1700 wrote to memory of 1664 1700 rundll32.exe rundll32.exe PID 1664 wrote to memory of 1224 1664 rundll32.exe msiexec.exe PID 1664 wrote to memory of 1224 1664 rundll32.exe msiexec.exe PID 1664 wrote to memory of 1224 1664 rundll32.exe msiexec.exe PID 1664 wrote to memory of 1224 1664 rundll32.exe msiexec.exe PID 1664 wrote to memory of 1224 1664 rundll32.exe msiexec.exe PID 1664 wrote to memory of 1224 1664 rundll32.exe msiexec.exe PID 1664 wrote to memory of 1224 1664 rundll32.exe msiexec.exe PID 1664 wrote to memory of 1224 1664 rundll32.exe msiexec.exe PID 1664 wrote to memory of 1224 1664 rundll32.exe msiexec.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\kFQR.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\kFQR.dll,#13⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe2⤵
- Blacklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1224-2-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/1224-1-0x0000000000090000-0x00000000000B6000-memory.dmpFilesize
152KB
-
memory/1224-3-0x0000000000090000-0x00000000000B6000-memory.dmpFilesize
152KB
-
memory/1224-4-0x0000000000000000-mapping.dmp
-
memory/1648-5-0x000007FEF7D90000-0x000007FEF800A000-memory.dmpFilesize
2.5MB
-
memory/1664-0-0x0000000000000000-mapping.dmp