Analysis
-
max time kernel
117s -
max time network
8s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
10-11-2020 07:44
Behavioral task
behavioral1
Sample
5cb7f1eb5a3bc9d05896b7691f88b58c029580b5f24d2726706c680b710f0b94.dll
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
5cb7f1eb5a3bc9d05896b7691f88b58c029580b5f24d2726706c680b710f0b94.dll
-
Size
187KB
-
MD5
333a0ed230fa3bb26e7a432783b19cb5
-
SHA1
b0ac79853c713283ee34bb31940b2d2954f6f223
-
SHA256
5cb7f1eb5a3bc9d05896b7691f88b58c029580b5f24d2726706c680b710f0b94
-
SHA512
d0c30d67c42b4b610fa882fdff05059857735269b3623fbb92ea57438ccb08b914c6a0de4c5cf343aeb1d02914231a3c097beb02daa03d2d59bc42293305060b
Malware Config
Extracted
Family
zloader
Botnet
miguel
Campaign
20/04
C2
https://dcaiqjgnbt.icu/wp-config.php
https://nmttxggtb.press/wp-config.php
rc4.plain
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1624 set thread context of 1636 1624 regsvr32.exe msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 1636 msiexec.exe Token: SeSecurityPrivilege 1636 msiexec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 1068 wrote to memory of 1624 1068 regsvr32.exe regsvr32.exe PID 1068 wrote to memory of 1624 1068 regsvr32.exe regsvr32.exe PID 1068 wrote to memory of 1624 1068 regsvr32.exe regsvr32.exe PID 1068 wrote to memory of 1624 1068 regsvr32.exe regsvr32.exe PID 1068 wrote to memory of 1624 1068 regsvr32.exe regsvr32.exe PID 1068 wrote to memory of 1624 1068 regsvr32.exe regsvr32.exe PID 1068 wrote to memory of 1624 1068 regsvr32.exe regsvr32.exe PID 1624 wrote to memory of 1636 1624 regsvr32.exe msiexec.exe PID 1624 wrote to memory of 1636 1624 regsvr32.exe msiexec.exe PID 1624 wrote to memory of 1636 1624 regsvr32.exe msiexec.exe PID 1624 wrote to memory of 1636 1624 regsvr32.exe msiexec.exe PID 1624 wrote to memory of 1636 1624 regsvr32.exe msiexec.exe PID 1624 wrote to memory of 1636 1624 regsvr32.exe msiexec.exe PID 1624 wrote to memory of 1636 1624 regsvr32.exe msiexec.exe PID 1624 wrote to memory of 1636 1624 regsvr32.exe msiexec.exe PID 1624 wrote to memory of 1636 1624 regsvr32.exe msiexec.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\5cb7f1eb5a3bc9d05896b7691f88b58c029580b5f24d2726706c680b710f0b94.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\5cb7f1eb5a3bc9d05896b7691f88b58c029580b5f24d2726706c680b710f0b94.dll2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1624-0-0x0000000000000000-mapping.dmp
-
memory/1636-1-0x00000000000F0000-0x0000000000124000-memory.dmpFilesize
208KB
-
memory/1636-2-0x0000000000090000-0x0000000000091000-memory.dmpFilesize
4KB
-
memory/1636-3-0x00000000000F0000-0x0000000000124000-memory.dmpFilesize
208KB
-
memory/1636-4-0x0000000000000000-mapping.dmp