Analysis

  • max time kernel
    50s
  • max time network
    110s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    02-03-2021 09:30

General

  • Target

    5c0f9c9babc640a2578b1d3e8cacb60df32a0437ef3f9383d00ed88a7cef3a62.dll

  • Size

    272KB

  • MD5

    7cff1113d30b8e4cd51ba13f40b9d2d5

  • SHA1

    6a0b90e9b0861cb42fecd217651d25c2e9eabf7d

  • SHA256

    5c0f9c9babc640a2578b1d3e8cacb60df32a0437ef3f9383d00ed88a7cef3a62

  • SHA512

    2a9420971587e2234db54a5008c9a861c337dfcbeb94698fd04a5e0481794f5cc510d81a6548bbb9f0b2a024a31d46a954768a0e8f6b0dd19cf7602a284d4862

Malware Config

Extracted

Family

zloader

Botnet

vek

Campaign

22/01

C2

https://groceryasian.com/post.php

https://forteanhub.com/post.php

https://conssapratigdevi.tk/post.php

rc4.plain
rsa_pubkey.plain

Signatures

  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

  • Blocklisted process makes network request 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5c0f9c9babc640a2578b1d3e8cacb60df32a0437ef3f9383d00ed88a7cef3a62.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:648
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\5c0f9c9babc640a2578b1d3e8cacb60df32a0437ef3f9383d00ed88a7cef3a62.dll
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2528
      • C:\Windows\SysWOW64\msiexec.exe
        msiexec.exe
        3⤵
        • Blocklisted process makes network request
        • Suspicious use of AdjustPrivilegeToken
        PID:2956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2528-2-0x0000000000000000-mapping.dmp
  • memory/2528-3-0x0000000074340000-0x0000000074366000-memory.dmp
    Filesize

    152KB

  • memory/2528-4-0x0000000002F50000-0x0000000002F51000-memory.dmp
    Filesize

    4KB

  • memory/2956-5-0x0000000000000000-mapping.dmp
  • memory/2956-6-0x0000000000C60000-0x0000000000C86000-memory.dmp
    Filesize

    152KB