Analysis

  • max time kernel
    47s
  • max time network
    37s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    02-03-2021 09:30

General

  • Target

    5c0f9c9babc640a2578b1d3e8cacb60df32a0437ef3f9383d00ed88a7cef3a62.dll

  • Size

    272KB

  • MD5

    7cff1113d30b8e4cd51ba13f40b9d2d5

  • SHA1

    6a0b90e9b0861cb42fecd217651d25c2e9eabf7d

  • SHA256

    5c0f9c9babc640a2578b1d3e8cacb60df32a0437ef3f9383d00ed88a7cef3a62

  • SHA512

    2a9420971587e2234db54a5008c9a861c337dfcbeb94698fd04a5e0481794f5cc510d81a6548bbb9f0b2a024a31d46a954768a0e8f6b0dd19cf7602a284d4862

Malware Config

Extracted

Family

zloader

Botnet

vek

Campaign

22/01

C2

https://groceryasian.com/post.php

https://forteanhub.com/post.php

https://conssapratigdevi.tk/post.php

rc4.plain
rsa_pubkey.plain

Signatures

  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

  • Blocklisted process makes network request 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5c0f9c9babc640a2578b1d3e8cacb60df32a0437ef3f9383d00ed88a7cef3a62.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1724
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\5c0f9c9babc640a2578b1d3e8cacb60df32a0437ef3f9383d00ed88a7cef3a62.dll
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1952
      • C:\Windows\SysWOW64\msiexec.exe
        msiexec.exe
        3⤵
        • Blocklisted process makes network request
        • Suspicious use of AdjustPrivilegeToken
        PID:1144

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1144-7-0x0000000000000000-mapping.dmp
  • memory/1144-9-0x0000000000090000-0x00000000000B6000-memory.dmp
    Filesize

    152KB

  • memory/1324-10-0x000007FEF7D90000-0x000007FEF800A000-memory.dmp
    Filesize

    2.5MB

  • memory/1724-2-0x000007FEFC601000-0x000007FEFC603000-memory.dmp
    Filesize

    8KB

  • memory/1952-3-0x0000000000000000-mapping.dmp
  • memory/1952-4-0x00000000761E1000-0x00000000761E3000-memory.dmp
    Filesize

    8KB

  • memory/1952-5-0x0000000074F00000-0x0000000074F26000-memory.dmp
    Filesize

    152KB

  • memory/1952-6-0x00000000002D0000-0x00000000002D1000-memory.dmp
    Filesize

    4KB