Analysis
-
max time kernel
111s -
max time network
111s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
10-11-2020 07:44
Behavioral task
behavioral1
Sample
5cb7f1eb5a3bc9d05896b7691f88b58c029580b5f24d2726706c680b710f0b94.dll
Resource
win7v20201028
0 signatures
0 seconds
General
-
Target
5cb7f1eb5a3bc9d05896b7691f88b58c029580b5f24d2726706c680b710f0b94.dll
-
Size
187KB
-
MD5
333a0ed230fa3bb26e7a432783b19cb5
-
SHA1
b0ac79853c713283ee34bb31940b2d2954f6f223
-
SHA256
5cb7f1eb5a3bc9d05896b7691f88b58c029580b5f24d2726706c680b710f0b94
-
SHA512
d0c30d67c42b4b610fa882fdff05059857735269b3623fbb92ea57438ccb08b914c6a0de4c5cf343aeb1d02914231a3c097beb02daa03d2d59bc42293305060b
Malware Config
Extracted
Family
zloader
Botnet
miguel
Campaign
20/04
C2
https://dcaiqjgnbt.icu/wp-config.php
https://nmttxggtb.press/wp-config.php
rc4.plain
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
regsvr32.exedescription pid process target process PID 3716 set thread context of 1292 3716 regsvr32.exe msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 1292 msiexec.exe Token: SeSecurityPrivilege 1292 msiexec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 3984 wrote to memory of 3716 3984 regsvr32.exe regsvr32.exe PID 3984 wrote to memory of 3716 3984 regsvr32.exe regsvr32.exe PID 3984 wrote to memory of 3716 3984 regsvr32.exe regsvr32.exe PID 3716 wrote to memory of 1292 3716 regsvr32.exe msiexec.exe PID 3716 wrote to memory of 1292 3716 regsvr32.exe msiexec.exe PID 3716 wrote to memory of 1292 3716 regsvr32.exe msiexec.exe PID 3716 wrote to memory of 1292 3716 regsvr32.exe msiexec.exe PID 3716 wrote to memory of 1292 3716 regsvr32.exe msiexec.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\5cb7f1eb5a3bc9d05896b7691f88b58c029580b5f24d2726706c680b710f0b94.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\5cb7f1eb5a3bc9d05896b7691f88b58c029580b5f24d2726706c680b710f0b94.dll2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Suspicious use of AdjustPrivilegeToken