Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
02-03-2021 09:16
Static task
static1
Behavioral task
behavioral1
Sample
c5a07a557082018c4b3526b12e681182d7e489ce22e90c2b4f68feae5f93d4d0.dll
Resource
win7v20201028
General
-
Target
c5a07a557082018c4b3526b12e681182d7e489ce22e90c2b4f68feae5f93d4d0.dll
-
Size
554KB
-
MD5
48f3bf2aad96b4893e873cf82d170f54
-
SHA1
ef34b6817e4142000cf512ed063fbc2beadf5be8
-
SHA256
c5a07a557082018c4b3526b12e681182d7e489ce22e90c2b4f68feae5f93d4d0
-
SHA512
1f7cf4b33257490cab2510644bb27adfec039df43c51ab9f860ebeaddc1f523d15169deb1dda32d0ce02fe19ac842c9dceabe8833df7f0a98748d18e508ccb81
Malware Config
Extracted
zloader
kev
25/01
https://sadnan.com/post.php
https://www.isds.com.my/post.php
https://nawirifarm.co.ke/post.php
https://dev01.perdiscoo.com/post.php
https://ingenieriaoasisdebc.com/post.php
https://brinitezcresan.gq/post.php
Signatures
-
Blocklisted process makes network request 30 IoCs
Processes:
msiexec.exeflow pid process 6 1664 msiexec.exe 7 1664 msiexec.exe 8 1664 msiexec.exe 9 1664 msiexec.exe 10 1664 msiexec.exe 11 1664 msiexec.exe 12 1664 msiexec.exe 13 1664 msiexec.exe 14 1664 msiexec.exe 15 1664 msiexec.exe 16 1664 msiexec.exe 17 1664 msiexec.exe 18 1664 msiexec.exe 19 1664 msiexec.exe 20 1664 msiexec.exe 21 1664 msiexec.exe 22 1664 msiexec.exe 23 1664 msiexec.exe 24 1664 msiexec.exe 25 1664 msiexec.exe 26 1664 msiexec.exe 28 1664 msiexec.exe 29 1664 msiexec.exe 30 1664 msiexec.exe 32 1664 msiexec.exe 34 1664 msiexec.exe 35 1664 msiexec.exe 38 1664 msiexec.exe 39 1664 msiexec.exe 40 1664 msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1716 set thread context of 1664 1716 regsvr32.exe msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 1664 msiexec.exe Token: SeSecurityPrivilege 1664 msiexec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 2028 wrote to memory of 1716 2028 regsvr32.exe regsvr32.exe PID 2028 wrote to memory of 1716 2028 regsvr32.exe regsvr32.exe PID 2028 wrote to memory of 1716 2028 regsvr32.exe regsvr32.exe PID 2028 wrote to memory of 1716 2028 regsvr32.exe regsvr32.exe PID 2028 wrote to memory of 1716 2028 regsvr32.exe regsvr32.exe PID 2028 wrote to memory of 1716 2028 regsvr32.exe regsvr32.exe PID 2028 wrote to memory of 1716 2028 regsvr32.exe regsvr32.exe PID 1716 wrote to memory of 1664 1716 regsvr32.exe msiexec.exe PID 1716 wrote to memory of 1664 1716 regsvr32.exe msiexec.exe PID 1716 wrote to memory of 1664 1716 regsvr32.exe msiexec.exe PID 1716 wrote to memory of 1664 1716 regsvr32.exe msiexec.exe PID 1716 wrote to memory of 1664 1716 regsvr32.exe msiexec.exe PID 1716 wrote to memory of 1664 1716 regsvr32.exe msiexec.exe PID 1716 wrote to memory of 1664 1716 regsvr32.exe msiexec.exe PID 1716 wrote to memory of 1664 1716 regsvr32.exe msiexec.exe PID 1716 wrote to memory of 1664 1716 regsvr32.exe msiexec.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\c5a07a557082018c4b3526b12e681182d7e489ce22e90c2b4f68feae5f93d4d0.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\c5a07a557082018c4b3526b12e681182d7e489ce22e90c2b4f68feae5f93d4d0.dll2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1664-7-0x0000000000000000-mapping.dmp
-
memory/1664-9-0x0000000000090000-0x00000000000B6000-memory.dmpFilesize
152KB
-
memory/1716-3-0x0000000000000000-mapping.dmp
-
memory/1716-4-0x0000000075C31000-0x0000000075C33000-memory.dmpFilesize
8KB
-
memory/1716-5-0x0000000075080000-0x00000000750A6000-memory.dmpFilesize
152KB
-
memory/1716-6-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2000-10-0x000007FEF6B90000-0x000007FEF6E0A000-memory.dmpFilesize
2.5MB
-
memory/2028-2-0x000007FEFC511000-0x000007FEFC513000-memory.dmpFilesize
8KB