Analysis
-
max time kernel
147s -
max time network
154s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
10-11-2020 06:51
Behavioral task
behavioral1
Sample
cf8e50db2ca682dbc80110f394aa4bbd7b59a60ac6e981dcaab607d09b7f01e8.dll
Resource
win7v20201028
General
-
Target
cf8e50db2ca682dbc80110f394aa4bbd7b59a60ac6e981dcaab607d09b7f01e8.dll
-
Size
183KB
-
MD5
d21ed162fd0252e22f31cf7a9cae5540
-
SHA1
abe719477bf2f69765f401b400759cb71117bff7
-
SHA256
cf8e50db2ca682dbc80110f394aa4bbd7b59a60ac6e981dcaab607d09b7f01e8
-
SHA512
8751aa81aa6d53ae9e2fc0424d957a39a365ccba0680e18f0702eab26e48e317a0ca35d61f49197f59c24cc00893d91e06e34568fb5454f80b9c94dd3bc10a68
Malware Config
Extracted
zloader
07/04
https://xyajbocpggsr.site/wp-config.php
https://ooygvpxrb.pw/wp-config.php
Signatures
-
Suspicious use of SetThreadContext ⋅ 1 IoCs
Processes:
regsvr32.exedescription pid process target process PID 2276 set thread context of 2480 2276 regsvr32.exe msiexec.exe -
Suspicious use of AdjustPrivilegeToken ⋅ 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 2480 msiexec.exe Token: SeSecurityPrivilege 2480 msiexec.exe -
Suspicious use of WriteProcessMemory ⋅ 8 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 1304 wrote to memory of 2276 1304 regsvr32.exe regsvr32.exe PID 1304 wrote to memory of 2276 1304 regsvr32.exe regsvr32.exe PID 1304 wrote to memory of 2276 1304 regsvr32.exe regsvr32.exe PID 2276 wrote to memory of 2480 2276 regsvr32.exe msiexec.exe PID 2276 wrote to memory of 2480 2276 regsvr32.exe msiexec.exe PID 2276 wrote to memory of 2480 2276 regsvr32.exe msiexec.exe PID 2276 wrote to memory of 2480 2276 regsvr32.exe msiexec.exe PID 2276 wrote to memory of 2480 2276 regsvr32.exe msiexec.exe
Processes
-
C:\Windows\system32\regsvr32.exePID:1304regsvr32 /s C:\Users\Admin\AppData\Local\Temp\cf8e50db2ca682dbc80110f394aa4bbd7b59a60ac6e981dcaab607d09b7f01e8.dllSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exePID:2276/s C:\Users\Admin\AppData\Local\Temp\cf8e50db2ca682dbc80110f394aa4bbd7b59a60ac6e981dcaab607d09b7f01e8.dllSuspicious use of SetThreadContextSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exePID:2480msiexec.exeSuspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation