Analysis
- max time kernel
84s - max time network
128s - platform
windows7_x64 - resource
win7v20201028 - submitted
02/12/2020, 17:39
Static task
static1
Behavioral task
behavioral1
Sample
r.php.dll
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
r.php.dll
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target r.php.dll
- Size 440KB
- Sample201202-ff2b8wv312
- SHA256 5c5c8af2a703aa1842f4ce9f9e83aeeac0e2cc2d3ed1bf9f9ad72b7f77e89a42
- MD5 be211fc134a945398f96e3cfe8ac0acd
- SHA1 1546aed93ddf813d13635664470454bf40d89056
- SHA512 7205a3ac02803fc26b8d895edbad0319d0ce40cfb84250e7fd08bf13bdf6df022784e75e672be2f28621aa94f78de41815d326edfd44599937d15d057dff9902
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
zloader
Botnet
-
nut
Campaign
-
02/12
C2
-
https://www.alhasanatbooks.com/reader.php
-
https://aflim.org.ng/wp-punch.php
-
https://sardarmohammad.com/reports.php
-
https://erikarabelo.com.br/server.php
-
https://thechapelofthehealingcross.org/java.php
-
https://grebcanualcwilfprofal.ml/wp-smarts.php
rc4.plain
rsa_pubkey.plain
Signatures
- Blacklisted process makes network request 53 IoCs
flow pid Process 7 880 msiexec.exe 8 880 msiexec.exe 9 880 msiexec.exe 10 880 msiexec.exe 11 880 msiexec.exe 12 880 msiexec.exe 13 880 msiexec.exe 14 880 msiexec.exe 15 880 msiexec.exe 16 880 msiexec.exe 17 880 msiexec.exe 18 880 msiexec.exe 19 880 msiexec.exe 20 880 msiexec.exe 21 880 msiexec.exe 22 880 msiexec.exe 23 880 msiexec.exe 24 880 msiexec.exe 25 880 msiexec.exe 26 880 msiexec.exe 27 880 msiexec.exe 29 880 msiexec.exe 30 880 msiexec.exe 31 880 msiexec.exe 33 880 msiexec.exe 35 880 msiexec.exe 37 880 msiexec.exe 39 880 msiexec.exe 40 880 msiexec.exe 41 880 msiexec.exe 42 880 msiexec.exe 43 880 msiexec.exe 44 880 msiexec.exe 45 880 msiexec.exe 46 880 msiexec.exe 47 880 msiexec.exe 48 880 msiexec.exe 49 880 msiexec.exe 50 880 msiexec.exe 51 880 msiexec.exe 52 880 msiexec.exe 53 880 msiexec.exe 54 880 msiexec.exe 55 880 msiexec.exe 56 880 msiexec.exe 57 880 msiexec.exe 58 880 msiexec.exe 59 880 msiexec.exe 60 880 msiexec.exe 61 880 msiexec.exe 62 880 msiexec.exe 64 880 msiexec.exe 66 880 msiexec.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1984 set thread context of 880 1984 rundll32.exe 30 - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeSecurityPrivilege 880 msiexec.exe Token: SeSecurityPrivilege 880 msiexec.exe - Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1204 wrote to memory of 1984 1204 rundll32.exe 22 PID 1204 wrote to memory of 1984 1204 rundll32.exe 22 PID 1204 wrote to memory of 1984 1204 rundll32.exe 22 PID 1204 wrote to memory of 1984 1204 rundll32.exe 22 PID 1204 wrote to memory of 1984 1204 rundll32.exe 22 PID 1204 wrote to memory of 1984 1204 rundll32.exe 22 PID 1204 wrote to memory of 1984 1204 rundll32.exe 22 PID 1984 wrote to memory of 880 1984 rundll32.exe 30 PID 1984 wrote to memory of 880 1984 rundll32.exe 30 PID 1984 wrote to memory of 880 1984 rundll32.exe 30 PID 1984 wrote to memory of 880 1984 rundll32.exe 30 PID 1984 wrote to memory of 880 1984 rundll32.exe 30 PID 1984 wrote to memory of 880 1984 rundll32.exe 30 PID 1984 wrote to memory of 880 1984 rundll32.exe 30 PID 1984 wrote to memory of 880 1984 rundll32.exe 30 PID 1984 wrote to memory of 880 1984 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\r.php.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\r.php.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Blacklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:880
-
-