Analysis
-
max time kernel
84s -
max time network
128s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
02-12-2020 17:39
Static task
static1
Behavioral task
behavioral1
Sample
r.php.dll
Resource
win7v20201028
Behavioral task
behavioral2
Sample
r.php.dll
Resource
win10v20201028
General
-
Target
r.php.dll
-
Size
440KB
-
MD5
be211fc134a945398f96e3cfe8ac0acd
-
SHA1
1546aed93ddf813d13635664470454bf40d89056
-
SHA256
5c5c8af2a703aa1842f4ce9f9e83aeeac0e2cc2d3ed1bf9f9ad72b7f77e89a42
-
SHA512
7205a3ac02803fc26b8d895edbad0319d0ce40cfb84250e7fd08bf13bdf6df022784e75e672be2f28621aa94f78de41815d326edfd44599937d15d057dff9902
Malware Config
Extracted
zloader
nut
02/12
https://www.alhasanatbooks.com/reader.php
https://aflim.org.ng/wp-punch.php
https://sardarmohammad.com/reports.php
https://erikarabelo.com.br/server.php
https://thechapelofthehealingcross.org/java.php
https://grebcanualcwilfprofal.ml/wp-smarts.php
Signatures
-
Blacklisted process makes network request 53 IoCs
Processes:
msiexec.exeflow pid process 7 880 msiexec.exe 8 880 msiexec.exe 9 880 msiexec.exe 10 880 msiexec.exe 11 880 msiexec.exe 12 880 msiexec.exe 13 880 msiexec.exe 14 880 msiexec.exe 15 880 msiexec.exe 16 880 msiexec.exe 17 880 msiexec.exe 18 880 msiexec.exe 19 880 msiexec.exe 20 880 msiexec.exe 21 880 msiexec.exe 22 880 msiexec.exe 23 880 msiexec.exe 24 880 msiexec.exe 25 880 msiexec.exe 26 880 msiexec.exe 27 880 msiexec.exe 29 880 msiexec.exe 30 880 msiexec.exe 31 880 msiexec.exe 33 880 msiexec.exe 35 880 msiexec.exe 37 880 msiexec.exe 39 880 msiexec.exe 40 880 msiexec.exe 41 880 msiexec.exe 42 880 msiexec.exe 43 880 msiexec.exe 44 880 msiexec.exe 45 880 msiexec.exe 46 880 msiexec.exe 47 880 msiexec.exe 48 880 msiexec.exe 49 880 msiexec.exe 50 880 msiexec.exe 51 880 msiexec.exe 52 880 msiexec.exe 53 880 msiexec.exe 54 880 msiexec.exe 55 880 msiexec.exe 56 880 msiexec.exe 57 880 msiexec.exe 58 880 msiexec.exe 59 880 msiexec.exe 60 880 msiexec.exe 61 880 msiexec.exe 62 880 msiexec.exe 64 880 msiexec.exe 66 880 msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 1984 set thread context of 880 1984 rundll32.exe msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 880 msiexec.exe Token: SeSecurityPrivilege 880 msiexec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1204 wrote to memory of 1984 1204 rundll32.exe rundll32.exe PID 1204 wrote to memory of 1984 1204 rundll32.exe rundll32.exe PID 1204 wrote to memory of 1984 1204 rundll32.exe rundll32.exe PID 1204 wrote to memory of 1984 1204 rundll32.exe rundll32.exe PID 1204 wrote to memory of 1984 1204 rundll32.exe rundll32.exe PID 1204 wrote to memory of 1984 1204 rundll32.exe rundll32.exe PID 1204 wrote to memory of 1984 1204 rundll32.exe rundll32.exe PID 1984 wrote to memory of 880 1984 rundll32.exe msiexec.exe PID 1984 wrote to memory of 880 1984 rundll32.exe msiexec.exe PID 1984 wrote to memory of 880 1984 rundll32.exe msiexec.exe PID 1984 wrote to memory of 880 1984 rundll32.exe msiexec.exe PID 1984 wrote to memory of 880 1984 rundll32.exe msiexec.exe PID 1984 wrote to memory of 880 1984 rundll32.exe msiexec.exe PID 1984 wrote to memory of 880 1984 rundll32.exe msiexec.exe PID 1984 wrote to memory of 880 1984 rundll32.exe msiexec.exe PID 1984 wrote to memory of 880 1984 rundll32.exe msiexec.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\r.php.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\r.php.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Blacklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/880-4-0x0000000000100000-0x0000000000101000-memory.dmpFilesize
4KB
-
memory/880-3-0x00000000000D0000-0x00000000000F6000-memory.dmpFilesize
152KB
-
memory/880-5-0x00000000000D0000-0x00000000000F6000-memory.dmpFilesize
152KB
-
memory/880-6-0x0000000000000000-mapping.dmp
-
memory/1564-7-0x000007FEF7510000-0x000007FEF778A000-memory.dmpFilesize
2.5MB
-
memory/1984-2-0x0000000000000000-mapping.dmp