Analysis
-
max time kernel
109s -
max time network
8s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-11-2020 19:51
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Generic.mg.508d23fb6e75776e.15437.dll
Resource
win7v20201028
General
-
Target
SecuriteInfo.com.Generic.mg.508d23fb6e75776e.15437.dll
-
Size
720KB
-
MD5
508d23fb6e75776e4944233034547ce8
-
SHA1
5dfc4bfa864e502ba0f4ac4db9c2a506ead11627
-
SHA256
ccf1e6416673f50f016cfa1658e9dd29793195b9bc701fedc1218d122faeb6b2
-
SHA512
3cf8ca13fb27002df3535dcc6efaf95770383da0c8ef4dba12a694e205b1e8aa68c620e13d958e2cd91ec7068c891450f752d958a11e4c69abbaa5fd6c062691
Malware Config
Extracted
zloader
miguel
15/05
https://luxiyouyue.club/wp-parser.php
https://aapasifik.com/wp-parser.php
http://zylstudio.com/wp-parser.php
https://caodangyduochanoi1.edu.vn/wp-parser.php
https://butterfly-crm.solusaas.com/wp-parser.php
http://karkas24.site/wp-parser.php
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1344 set thread context of 1724 1344 regsvr32.exe msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 1724 msiexec.exe Token: SeSecurityPrivilege 1724 msiexec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 1740 wrote to memory of 1344 1740 regsvr32.exe regsvr32.exe PID 1740 wrote to memory of 1344 1740 regsvr32.exe regsvr32.exe PID 1740 wrote to memory of 1344 1740 regsvr32.exe regsvr32.exe PID 1740 wrote to memory of 1344 1740 regsvr32.exe regsvr32.exe PID 1740 wrote to memory of 1344 1740 regsvr32.exe regsvr32.exe PID 1740 wrote to memory of 1344 1740 regsvr32.exe regsvr32.exe PID 1740 wrote to memory of 1344 1740 regsvr32.exe regsvr32.exe PID 1344 wrote to memory of 1724 1344 regsvr32.exe msiexec.exe PID 1344 wrote to memory of 1724 1344 regsvr32.exe msiexec.exe PID 1344 wrote to memory of 1724 1344 regsvr32.exe msiexec.exe PID 1344 wrote to memory of 1724 1344 regsvr32.exe msiexec.exe PID 1344 wrote to memory of 1724 1344 regsvr32.exe msiexec.exe PID 1344 wrote to memory of 1724 1344 regsvr32.exe msiexec.exe PID 1344 wrote to memory of 1724 1344 regsvr32.exe msiexec.exe PID 1344 wrote to memory of 1724 1344 regsvr32.exe msiexec.exe PID 1344 wrote to memory of 1724 1344 regsvr32.exe msiexec.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.508d23fb6e75776e.15437.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.508d23fb6e75776e.15437.dll2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1344-0-0x0000000000000000-mapping.dmp
-
memory/1724-2-0x00000000000D0000-0x00000000000D1000-memory.dmpFilesize
4KB
-
memory/1724-1-0x0000000000090000-0x00000000000C5000-memory.dmpFilesize
212KB
-
memory/1724-3-0x0000000000090000-0x00000000000C5000-memory.dmpFilesize
212KB
-
memory/1724-4-0x0000000000000000-mapping.dmp