Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
03-03-2021 02:04
Static task
static1
Behavioral task
behavioral1
Sample
10ec4e9f67028d2bf9f5e42cb2918663436e21760a5f1e08950b19ac2745e48c.dll
Resource
win7v20201028
Behavioral task
behavioral2
Sample
10ec4e9f67028d2bf9f5e42cb2918663436e21760a5f1e08950b19ac2745e48c.dll
Resource
win10v20201028
General
-
Target
10ec4e9f67028d2bf9f5e42cb2918663436e21760a5f1e08950b19ac2745e48c.dll
-
Size
344KB
-
MD5
0358fcd58c56d6cedec03b80c64ff988
-
SHA1
34816e94bf4cc91c3c8bd6a8c087f6592ab28e96
-
SHA256
10ec4e9f67028d2bf9f5e42cb2918663436e21760a5f1e08950b19ac2745e48c
-
SHA512
677e4d1c61cfb19ca47c11d3fbfbc68f546ee5095e89075b76ba9c4b7b42ebe4f920ce0ff6b4174ce33fc87f97c398a757203c406413423751b8caa1d9d2248a
Malware Config
Extracted
zloader
nut
23/11
https://orangeboxasia.com/wp-smarts.php
https://m3izoglass.ro/wp-smarts.php
https://bayza.ro/up_img_01.php
https://cofetariarodna.ro/errors.php
https://casapintea.ro/logs.php
https://roractaseja.ml/wp-smarts.php
Signatures
-
Blocklisted process makes network request 10 IoCs
Processes:
msiexec.exeflow pid process 6 1464 msiexec.exe 8 1464 msiexec.exe 10 1464 msiexec.exe 11 1464 msiexec.exe 12 1464 msiexec.exe 13 1464 msiexec.exe 14 1464 msiexec.exe 15 1464 msiexec.exe 17 1464 msiexec.exe 18 1464 msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1284 set thread context of 1464 1284 regsvr32.exe msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 1464 msiexec.exe Token: SeSecurityPrivilege 1464 msiexec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 544 wrote to memory of 1284 544 regsvr32.exe regsvr32.exe PID 544 wrote to memory of 1284 544 regsvr32.exe regsvr32.exe PID 544 wrote to memory of 1284 544 regsvr32.exe regsvr32.exe PID 544 wrote to memory of 1284 544 regsvr32.exe regsvr32.exe PID 544 wrote to memory of 1284 544 regsvr32.exe regsvr32.exe PID 544 wrote to memory of 1284 544 regsvr32.exe regsvr32.exe PID 544 wrote to memory of 1284 544 regsvr32.exe regsvr32.exe PID 1284 wrote to memory of 1464 1284 regsvr32.exe msiexec.exe PID 1284 wrote to memory of 1464 1284 regsvr32.exe msiexec.exe PID 1284 wrote to memory of 1464 1284 regsvr32.exe msiexec.exe PID 1284 wrote to memory of 1464 1284 regsvr32.exe msiexec.exe PID 1284 wrote to memory of 1464 1284 regsvr32.exe msiexec.exe PID 1284 wrote to memory of 1464 1284 regsvr32.exe msiexec.exe PID 1284 wrote to memory of 1464 1284 regsvr32.exe msiexec.exe PID 1284 wrote to memory of 1464 1284 regsvr32.exe msiexec.exe PID 1284 wrote to memory of 1464 1284 regsvr32.exe msiexec.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\10ec4e9f67028d2bf9f5e42cb2918663436e21760a5f1e08950b19ac2745e48c.dll1⤵
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\10ec4e9f67028d2bf9f5e42cb2918663436e21760a5f1e08950b19ac2745e48c.dll2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:1464
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/528-10-0x000007FEF6790000-0x000007FEF6A0A000-memory.dmpFilesize
2.5MB
-
memory/544-2-0x000007FEFC2B1000-0x000007FEFC2B3000-memory.dmpFilesize
8KB
-
memory/1284-3-0x0000000000000000-mapping.dmp
-
memory/1284-4-0x0000000076881000-0x0000000076883000-memory.dmpFilesize
8KB
-
memory/1284-5-0x0000000074BA0000-0x0000000074BC5000-memory.dmpFilesize
148KB
-
memory/1284-6-0x00000000000D0000-0x00000000000D1000-memory.dmpFilesize
4KB
-
memory/1464-7-0x0000000000000000-mapping.dmp
-
memory/1464-9-0x0000000000090000-0x00000000000B5000-memory.dmpFilesize
148KB