Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
02-03-2021 05:25
Static task
static1
Behavioral task
behavioral1
Sample
bd40fbd6619e2dff958bd5398b0c615921ffd28fe9410e933fe117bca2ed4f9c.dll
Resource
win7v20201028
General
-
Target
bd40fbd6619e2dff958bd5398b0c615921ffd28fe9410e933fe117bca2ed4f9c.dll
-
Size
368KB
-
MD5
116347dee5de17177b0e19cb2656d94d
-
SHA1
1bc94b97c99c08ffc1f2849a2dfce60569ddbc71
-
SHA256
bd40fbd6619e2dff958bd5398b0c615921ffd28fe9410e933fe117bca2ed4f9c
-
SHA512
a405bbeb5829045817817ff4e993153e5196642d32cdeca5964d1787a2451a7d39624c293e59de8d0c485ee57a964814c167a68abb19d6f23308ffff6f7e2fdb
Malware Config
Extracted
zloader
nut
22/02
https://sanfilippowholesale.ca/post.php
https://veprotech.com/post.php
https://globalgroots.com/post.php
https://silicontradewind.com/post.php
https://dhyanalingagranites.in/post.php
https://onushondhanbarta.com/post.php
https://avcity.in/post.php
https://docapiridelli.ml/post.php
Signatures
-
Blocklisted process makes network request 64 IoCs
Processes:
msiexec.exeflow pid process 6 1724 msiexec.exe 7 1724 msiexec.exe 8 1724 msiexec.exe 9 1724 msiexec.exe 10 1724 msiexec.exe 11 1724 msiexec.exe 12 1724 msiexec.exe 13 1724 msiexec.exe 14 1724 msiexec.exe 15 1724 msiexec.exe 16 1724 msiexec.exe 17 1724 msiexec.exe 18 1724 msiexec.exe 19 1724 msiexec.exe 20 1724 msiexec.exe 21 1724 msiexec.exe 22 1724 msiexec.exe 23 1724 msiexec.exe 24 1724 msiexec.exe 25 1724 msiexec.exe 26 1724 msiexec.exe 28 1724 msiexec.exe 29 1724 msiexec.exe 30 1724 msiexec.exe 32 1724 msiexec.exe 33 1724 msiexec.exe 34 1724 msiexec.exe 35 1724 msiexec.exe 36 1724 msiexec.exe 37 1724 msiexec.exe 38 1724 msiexec.exe 39 1724 msiexec.exe 40 1724 msiexec.exe 41 1724 msiexec.exe 42 1724 msiexec.exe 43 1724 msiexec.exe 44 1724 msiexec.exe 45 1724 msiexec.exe 46 1724 msiexec.exe 47 1724 msiexec.exe 48 1724 msiexec.exe 49 1724 msiexec.exe 50 1724 msiexec.exe 51 1724 msiexec.exe 52 1724 msiexec.exe 54 1724 msiexec.exe 55 1724 msiexec.exe 56 1724 msiexec.exe 58 1724 msiexec.exe 59 1724 msiexec.exe 60 1724 msiexec.exe 61 1724 msiexec.exe 62 1724 msiexec.exe 63 1724 msiexec.exe 64 1724 msiexec.exe 65 1724 msiexec.exe 66 1724 msiexec.exe 67 1724 msiexec.exe 68 1724 msiexec.exe 69 1724 msiexec.exe 70 1724 msiexec.exe 71 1724 msiexec.exe 72 1724 msiexec.exe 73 1724 msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 1256 set thread context of 1724 1256 rundll32.exe msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 1724 msiexec.exe Token: SeSecurityPrivilege 1724 msiexec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1888 wrote to memory of 1256 1888 rundll32.exe rundll32.exe PID 1888 wrote to memory of 1256 1888 rundll32.exe rundll32.exe PID 1888 wrote to memory of 1256 1888 rundll32.exe rundll32.exe PID 1888 wrote to memory of 1256 1888 rundll32.exe rundll32.exe PID 1888 wrote to memory of 1256 1888 rundll32.exe rundll32.exe PID 1888 wrote to memory of 1256 1888 rundll32.exe rundll32.exe PID 1888 wrote to memory of 1256 1888 rundll32.exe rundll32.exe PID 1256 wrote to memory of 1724 1256 rundll32.exe msiexec.exe PID 1256 wrote to memory of 1724 1256 rundll32.exe msiexec.exe PID 1256 wrote to memory of 1724 1256 rundll32.exe msiexec.exe PID 1256 wrote to memory of 1724 1256 rundll32.exe msiexec.exe PID 1256 wrote to memory of 1724 1256 rundll32.exe msiexec.exe PID 1256 wrote to memory of 1724 1256 rundll32.exe msiexec.exe PID 1256 wrote to memory of 1724 1256 rundll32.exe msiexec.exe PID 1256 wrote to memory of 1724 1256 rundll32.exe msiexec.exe PID 1256 wrote to memory of 1724 1256 rundll32.exe msiexec.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bd40fbd6619e2dff958bd5398b0c615921ffd28fe9410e933fe117bca2ed4f9c.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bd40fbd6619e2dff958bd5398b0c615921ffd28fe9410e933fe117bca2ed4f9c.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:1724
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/392-9-0x000007FEF6080000-0x000007FEF62FA000-memory.dmpFilesize
2.5MB
-
memory/1256-2-0x0000000000000000-mapping.dmp
-
memory/1256-3-0x0000000075781000-0x0000000075783000-memory.dmpFilesize
8KB
-
memory/1256-4-0x0000000000210000-0x0000000000239000-memory.dmpFilesize
164KB
-
memory/1256-5-0x0000000000130000-0x0000000000131000-memory.dmpFilesize
4KB
-
memory/1724-6-0x0000000000000000-mapping.dmp
-
memory/1724-8-0x0000000000090000-0x00000000000B9000-memory.dmpFilesize
164KB