Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
04-03-2021 02:18
Behavioral task
behavioral1
Sample
4722359f79b6a7f7738b8444b8bf6f61f0ac171bd50243ffccdfbc0a1ebcddcd.dll
Resource
win7v20201028
General
-
Target
4722359f79b6a7f7738b8444b8bf6f61f0ac171bd50243ffccdfbc0a1ebcddcd.dll
-
Size
176KB
-
MD5
096a438e0e5d01b9646c19d45c0c063f
-
SHA1
8c6cd17823e9aa7a266cbbb89a7a5dee99b9cbad
-
SHA256
4722359f79b6a7f7738b8444b8bf6f61f0ac171bd50243ffccdfbc0a1ebcddcd
-
SHA512
8fbfc073cb2e5285e4eb6a4b19822e77233af1c9f621374a2029e7e540ab430262164506227e82058df8c364d300d6d9c059416301de7a77e585756b98fb4be3
Malware Config
Extracted
zloader
banking
banking
https://iloveyoubaby1.pro/gate.php
https://idsakjfsanfaskj.com/gate.php
https://fslakdasjdnsasjsj.com/gate.php
https://dksadjsahnfaskmsa.com/gate.php
https://dskdsajdsahda.info/gate.php
https://dskdsajdsadasda.info/gate.php
https://dskjdsadhsahjsas.info/gate.php
https://dsjadjsadjsadjafsa.info/gate.php
https://fsakjdsafasifkajfaf.pro/gate.php
https://djsadhsadsadjashs.pro/gate.php
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Liqy = "rundll32.exe C:\\Users\\Admin\\AppData\\Roaming\\Udfu\\gudu.dll,DllRegisterServer" msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1428 set thread context of 1924 1428 regsvr32.exe msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 1924 msiexec.exe Token: SeSecurityPrivilege 1924 msiexec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 412 wrote to memory of 1428 412 regsvr32.exe regsvr32.exe PID 412 wrote to memory of 1428 412 regsvr32.exe regsvr32.exe PID 412 wrote to memory of 1428 412 regsvr32.exe regsvr32.exe PID 1428 wrote to memory of 1924 1428 regsvr32.exe msiexec.exe PID 1428 wrote to memory of 1924 1428 regsvr32.exe msiexec.exe PID 1428 wrote to memory of 1924 1428 regsvr32.exe msiexec.exe PID 1428 wrote to memory of 1924 1428 regsvr32.exe msiexec.exe PID 1428 wrote to memory of 1924 1428 regsvr32.exe msiexec.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\4722359f79b6a7f7738b8444b8bf6f61f0ac171bd50243ffccdfbc0a1ebcddcd.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\4722359f79b6a7f7738b8444b8bf6f61f0ac171bd50243ffccdfbc0a1ebcddcd.dll2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken