Analysis
-
max time kernel
151s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
25-01-2021 17:11
Static task
static1
Behavioral task
behavioral1
Sample
k.php.dll
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
k.php.dll
-
Size
554KB
-
MD5
48f3bf2aad96b4893e873cf82d170f54
-
SHA1
ef34b6817e4142000cf512ed063fbc2beadf5be8
-
SHA256
c5a07a557082018c4b3526b12e681182d7e489ce22e90c2b4f68feae5f93d4d0
-
SHA512
1f7cf4b33257490cab2510644bb27adfec039df43c51ab9f860ebeaddc1f523d15169deb1dda32d0ce02fe19ac842c9dceabe8833df7f0a98748d18e508ccb81
Malware Config
Extracted
Family
zloader
Botnet
kev
Campaign
25/01
C2
https://sadnan.com/post.php
https://www.isds.com.my/post.php
https://nawirifarm.co.ke/post.php
https://dev01.perdiscoo.com/post.php
https://ingenieriaoasisdebc.com/post.php
https://brinitezcresan.gq/post.php
rc4.plain
rsa_pubkey.plain
Signatures
-
Blocklisted process makes network request 46 IoCs
Processes:
msiexec.exeflow pid process 7 772 msiexec.exe 8 772 msiexec.exe 9 772 msiexec.exe 10 772 msiexec.exe 11 772 msiexec.exe 12 772 msiexec.exe 13 772 msiexec.exe 14 772 msiexec.exe 15 772 msiexec.exe 16 772 msiexec.exe 17 772 msiexec.exe 18 772 msiexec.exe 19 772 msiexec.exe 20 772 msiexec.exe 21 772 msiexec.exe 22 772 msiexec.exe 23 772 msiexec.exe 24 772 msiexec.exe 25 772 msiexec.exe 26 772 msiexec.exe 27 772 msiexec.exe 29 772 msiexec.exe 30 772 msiexec.exe 31 772 msiexec.exe 33 772 msiexec.exe 34 772 msiexec.exe 35 772 msiexec.exe 36 772 msiexec.exe 37 772 msiexec.exe 38 772 msiexec.exe 41 772 msiexec.exe 42 772 msiexec.exe 43 772 msiexec.exe 44 772 msiexec.exe 45 772 msiexec.exe 46 772 msiexec.exe 47 772 msiexec.exe 48 772 msiexec.exe 49 772 msiexec.exe 50 772 msiexec.exe 51 772 msiexec.exe 52 772 msiexec.exe 53 772 msiexec.exe 54 772 msiexec.exe 55 772 msiexec.exe 56 772 msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1544 set thread context of 772 1544 regsvr32.exe msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 772 msiexec.exe Token: SeSecurityPrivilege 772 msiexec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 784 wrote to memory of 1544 784 regsvr32.exe regsvr32.exe PID 784 wrote to memory of 1544 784 regsvr32.exe regsvr32.exe PID 784 wrote to memory of 1544 784 regsvr32.exe regsvr32.exe PID 784 wrote to memory of 1544 784 regsvr32.exe regsvr32.exe PID 784 wrote to memory of 1544 784 regsvr32.exe regsvr32.exe PID 784 wrote to memory of 1544 784 regsvr32.exe regsvr32.exe PID 784 wrote to memory of 1544 784 regsvr32.exe regsvr32.exe PID 1544 wrote to memory of 772 1544 regsvr32.exe msiexec.exe PID 1544 wrote to memory of 772 1544 regsvr32.exe msiexec.exe PID 1544 wrote to memory of 772 1544 regsvr32.exe msiexec.exe PID 1544 wrote to memory of 772 1544 regsvr32.exe msiexec.exe PID 1544 wrote to memory of 772 1544 regsvr32.exe msiexec.exe PID 1544 wrote to memory of 772 1544 regsvr32.exe msiexec.exe PID 1544 wrote to memory of 772 1544 regsvr32.exe msiexec.exe PID 1544 wrote to memory of 772 1544 regsvr32.exe msiexec.exe PID 1544 wrote to memory of 772 1544 regsvr32.exe msiexec.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\k.php.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\k.php.dll2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/772-7-0x0000000000000000-mapping.dmp
-
memory/772-9-0x0000000000090000-0x00000000000B6000-memory.dmpFilesize
152KB
-
memory/784-2-0x000007FEFBA81000-0x000007FEFBA83000-memory.dmpFilesize
8KB
-
memory/1544-3-0x0000000000000000-mapping.dmp
-
memory/1544-4-0x00000000761E1000-0x00000000761E3000-memory.dmpFilesize
8KB
-
memory/1544-5-0x00000000745F0000-0x0000000074616000-memory.dmpFilesize
152KB
-
memory/1544-6-0x0000000000180000-0x0000000000181000-memory.dmpFilesize
4KB
-
memory/1588-10-0x000007FEF81B0000-0x000007FEF842A000-memory.dmpFilesize
2.5MB