Analysis
-
max time kernel
102s -
max time network
12s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-11-2020 19:58
Static task
static1
Behavioral task
behavioral1
Sample
y.dll
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
y.dll
-
Size
943KB
-
MD5
62c04a23f403f3d431198326448ffc24
-
SHA1
dfa20b8e4a4725f37698c15ef5e50b3badffd3d4
-
SHA256
cc32eb0fb5c35376f69a3d6b81fdb339309d06d80a2cffa2604e21012ac33c18
-
SHA512
e26b2b60b2edaa21530f065e0ba06e63371a8c80dbc65e648c0bcfa311d3180d0e93a3278446458b3d44d2260518ba44c8dd8c44ccb1778eda0fc027d65f3cba
Malware Config
Extracted
Family
zloader
Botnet
miguel
Campaign
20/05
C2
https://letssihamra.gq/wp-parser.php
https://puffmenscourtcomenthy.tk/wp-parser.php
https://thurlopetnyi.cf/wp-parser.php
http://blog.menusmile.com/wp-parser.php
http://setindgrp.com/wp-parser.php
rc4.plain
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1956 set thread context of 1148 1956 regsvr32.exe msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 1148 msiexec.exe Token: SeSecurityPrivilege 1148 msiexec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 1668 wrote to memory of 1956 1668 regsvr32.exe regsvr32.exe PID 1668 wrote to memory of 1956 1668 regsvr32.exe regsvr32.exe PID 1668 wrote to memory of 1956 1668 regsvr32.exe regsvr32.exe PID 1668 wrote to memory of 1956 1668 regsvr32.exe regsvr32.exe PID 1668 wrote to memory of 1956 1668 regsvr32.exe regsvr32.exe PID 1668 wrote to memory of 1956 1668 regsvr32.exe regsvr32.exe PID 1668 wrote to memory of 1956 1668 regsvr32.exe regsvr32.exe PID 1956 wrote to memory of 1148 1956 regsvr32.exe msiexec.exe PID 1956 wrote to memory of 1148 1956 regsvr32.exe msiexec.exe PID 1956 wrote to memory of 1148 1956 regsvr32.exe msiexec.exe PID 1956 wrote to memory of 1148 1956 regsvr32.exe msiexec.exe PID 1956 wrote to memory of 1148 1956 regsvr32.exe msiexec.exe PID 1956 wrote to memory of 1148 1956 regsvr32.exe msiexec.exe PID 1956 wrote to memory of 1148 1956 regsvr32.exe msiexec.exe PID 1956 wrote to memory of 1148 1956 regsvr32.exe msiexec.exe PID 1956 wrote to memory of 1148 1956 regsvr32.exe msiexec.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\y.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\y.dll2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1148-1-0x00000000000F0000-0x0000000000125000-memory.dmpFilesize
212KB
-
memory/1148-3-0x00000000000F0000-0x0000000000125000-memory.dmpFilesize
212KB
-
memory/1148-2-0x0000000000090000-0x0000000000091000-memory.dmpFilesize
4KB
-
memory/1148-4-0x0000000000000000-mapping.dmp
-
memory/1956-0-0x0000000000000000-mapping.dmp