Analysis
-
max time kernel
39s -
max time network
150s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
02-03-2021 06:28
Static task
static1
Behavioral task
behavioral1
Sample
907a644328011c9d50c192e06ef14bf5e6be5f4c3f4dddacfba7ebb8d22d0738.dll
Resource
win7v20201028
Behavioral task
behavioral2
Sample
907a644328011c9d50c192e06ef14bf5e6be5f4c3f4dddacfba7ebb8d22d0738.dll
Resource
win10v20201028
General
-
Target
907a644328011c9d50c192e06ef14bf5e6be5f4c3f4dddacfba7ebb8d22d0738.dll
-
Size
776KB
-
MD5
89d2e280a893091f2f60099cbaa616ed
-
SHA1
cca6be054d570ae2b5ebc527b5ceb6e23ac15504
-
SHA256
907a644328011c9d50c192e06ef14bf5e6be5f4c3f4dddacfba7ebb8d22d0738
-
SHA512
6f73c20829b42e6a6064cdd97134af8edd78077f175eabf7ed28ff07eafad0c2fd241ec93a3d11075b716e2606b3f8aba40de6f37b83c39d9de3596c6c07e80f
Malware Config
Extracted
zloader
googleaktualizacija
googleaktualizacija2
https://iqowijsdakm.com/gate.php
https://wiewjdmkfjn.com/gate.php
https://dksaoidiakjd.com/gate.php
https://iweuiqjdakjd.com/gate.php
https://yuidskadjna.com/gate.php
https://olksmadnbdj.com/gate.php
https://odsakmdfnbs.com/gate.php
https://odsakjmdnhsaj.com/gate.php
https://odjdnhsaj.com/gate.php
https://odoishsaj.com/gate.php
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 792 wrote to memory of 1920 792 rundll32.exe rundll32.exe PID 792 wrote to memory of 1920 792 rundll32.exe rundll32.exe PID 792 wrote to memory of 1920 792 rundll32.exe rundll32.exe PID 792 wrote to memory of 1920 792 rundll32.exe rundll32.exe PID 792 wrote to memory of 1920 792 rundll32.exe rundll32.exe PID 792 wrote to memory of 1920 792 rundll32.exe rundll32.exe PID 792 wrote to memory of 1920 792 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\907a644328011c9d50c192e06ef14bf5e6be5f4c3f4dddacfba7ebb8d22d0738.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\907a644328011c9d50c192e06ef14bf5e6be5f4c3f4dddacfba7ebb8d22d0738.dll,#12⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/848-9-0x000007FEF63D0000-0x000007FEF664A000-memory.dmpFilesize
2.5MB
-
memory/1516-6-0x0000000000000000-mapping.dmp
-
memory/1516-8-0x00000000000D0000-0x00000000000F6000-memory.dmpFilesize
152KB
-
memory/1920-2-0x0000000000000000-mapping.dmp
-
memory/1920-3-0x00000000765E1000-0x00000000765E3000-memory.dmpFilesize
8KB
-
memory/1920-4-0x0000000001E10000-0x0000000001EBD000-memory.dmpFilesize
692KB
-
memory/1920-5-0x0000000001C20000-0x0000000001C46000-memory.dmpFilesize
152KB