Analysis
-
max time kernel
69s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
25-01-2021 17:11
Static task
static1
Behavioral task
behavioral1
Sample
k.php.dll
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
k.php.dll
-
Size
554KB
-
MD5
48f3bf2aad96b4893e873cf82d170f54
-
SHA1
ef34b6817e4142000cf512ed063fbc2beadf5be8
-
SHA256
c5a07a557082018c4b3526b12e681182d7e489ce22e90c2b4f68feae5f93d4d0
-
SHA512
1f7cf4b33257490cab2510644bb27adfec039df43c51ab9f860ebeaddc1f523d15169deb1dda32d0ce02fe19ac842c9dceabe8833df7f0a98748d18e508ccb81
Malware Config
Extracted
Family
zloader
Botnet
kev
Campaign
25/01
C2
https://sadnan.com/post.php
https://www.isds.com.my/post.php
https://nawirifarm.co.ke/post.php
https://dev01.perdiscoo.com/post.php
https://ingenieriaoasisdebc.com/post.php
https://brinitezcresan.gq/post.php
rc4.plain
rsa_pubkey.plain
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
msiexec.exeflow pid process 16 192 msiexec.exe 18 192 msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1512 set thread context of 192 1512 regsvr32.exe msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 192 msiexec.exe Token: SeSecurityPrivilege 192 msiexec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 644 wrote to memory of 1512 644 regsvr32.exe regsvr32.exe PID 644 wrote to memory of 1512 644 regsvr32.exe regsvr32.exe PID 644 wrote to memory of 1512 644 regsvr32.exe regsvr32.exe PID 1512 wrote to memory of 192 1512 regsvr32.exe msiexec.exe PID 1512 wrote to memory of 192 1512 regsvr32.exe msiexec.exe PID 1512 wrote to memory of 192 1512 regsvr32.exe msiexec.exe PID 1512 wrote to memory of 192 1512 regsvr32.exe msiexec.exe PID 1512 wrote to memory of 192 1512 regsvr32.exe msiexec.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\k.php.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\k.php.dll2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/192-5-0x0000000000000000-mapping.dmp
-
memory/192-6-0x0000000000540000-0x0000000000566000-memory.dmpFilesize
152KB
-
memory/1512-2-0x0000000000000000-mapping.dmp
-
memory/1512-3-0x0000000074300000-0x0000000074326000-memory.dmpFilesize
152KB
-
memory/1512-4-0x0000000003320000-0x0000000003321000-memory.dmpFilesize
4KB