Analysis
-
max time kernel
106s -
max time network
13s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
04-03-2021 02:03
Behavioral task
behavioral1
Sample
5cb7f1eb5a3bc9d05896b7691f88b58c029580b5f24d2726706c680b710f0b94.dll
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
5cb7f1eb5a3bc9d05896b7691f88b58c029580b5f24d2726706c680b710f0b94.dll
-
Size
187KB
-
MD5
333a0ed230fa3bb26e7a432783b19cb5
-
SHA1
b0ac79853c713283ee34bb31940b2d2954f6f223
-
SHA256
5cb7f1eb5a3bc9d05896b7691f88b58c029580b5f24d2726706c680b710f0b94
-
SHA512
d0c30d67c42b4b610fa882fdff05059857735269b3623fbb92ea57438ccb08b914c6a0de4c5cf343aeb1d02914231a3c097beb02daa03d2d59bc42293305060b
Malware Config
Extracted
Family
zloader
Botnet
miguel
Campaign
20/04
C2
https://dcaiqjgnbt.icu/wp-config.php
https://nmttxggtb.press/wp-config.php
rc4.plain
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1920 set thread context of 1288 1920 regsvr32.exe msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 1288 msiexec.exe Token: SeSecurityPrivilege 1288 msiexec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 792 wrote to memory of 1920 792 regsvr32.exe regsvr32.exe PID 792 wrote to memory of 1920 792 regsvr32.exe regsvr32.exe PID 792 wrote to memory of 1920 792 regsvr32.exe regsvr32.exe PID 792 wrote to memory of 1920 792 regsvr32.exe regsvr32.exe PID 792 wrote to memory of 1920 792 regsvr32.exe regsvr32.exe PID 792 wrote to memory of 1920 792 regsvr32.exe regsvr32.exe PID 792 wrote to memory of 1920 792 regsvr32.exe regsvr32.exe PID 1920 wrote to memory of 1288 1920 regsvr32.exe msiexec.exe PID 1920 wrote to memory of 1288 1920 regsvr32.exe msiexec.exe PID 1920 wrote to memory of 1288 1920 regsvr32.exe msiexec.exe PID 1920 wrote to memory of 1288 1920 regsvr32.exe msiexec.exe PID 1920 wrote to memory of 1288 1920 regsvr32.exe msiexec.exe PID 1920 wrote to memory of 1288 1920 regsvr32.exe msiexec.exe PID 1920 wrote to memory of 1288 1920 regsvr32.exe msiexec.exe PID 1920 wrote to memory of 1288 1920 regsvr32.exe msiexec.exe PID 1920 wrote to memory of 1288 1920 regsvr32.exe msiexec.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\5cb7f1eb5a3bc9d05896b7691f88b58c029580b5f24d2726706c680b710f0b94.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\5cb7f1eb5a3bc9d05896b7691f88b58c029580b5f24d2726706c680b710f0b94.dll2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/792-2-0x000007FEFC5A1000-0x000007FEFC5A3000-memory.dmpFilesize
8KB
-
memory/1288-5-0x0000000000000000-mapping.dmp
-
memory/1288-7-0x0000000000100000-0x0000000000134000-memory.dmpFilesize
208KB
-
memory/1920-3-0x0000000000000000-mapping.dmp
-
memory/1920-4-0x00000000757E1000-0x00000000757E3000-memory.dmpFilesize
8KB