Analysis
-
max time kernel
116s -
max time network
92s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
04-03-2021 12:10
Static task
static1
Behavioral task
behavioral1
Sample
f.dll
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
f.dll
-
Size
512KB
-
MD5
fa9b3dfdb4b97dfe0db5991472f89399
-
SHA1
5677f26e926c8c8d7f7bf7eb085a9e48549a268b
-
SHA256
3648fe001994cb9c0a6b510213c268a6bd4761a3a99f3abb2738bf84f06d11cf
-
SHA512
e5ac96e3ef6ee9fa110b433c1c49a7f16f4ba6694ec76e10d31848ecd4f284b6845508979758a16121a63d6c4a1af2103268d6e03fbb1c6672005090d560cc74
Malware Config
Extracted
Family
zloader
Botnet
miguel
Campaign
20/04
C2
https://dcaiqjgnbt.icu/wp-config.php
https://nmttxggtb.press/wp-config.php
rc4.plain
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 1992 set thread context of 1592 1992 rundll32.exe msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 1592 msiexec.exe Token: SeSecurityPrivilege 1592 msiexec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 800 wrote to memory of 1992 800 rundll32.exe rundll32.exe PID 800 wrote to memory of 1992 800 rundll32.exe rundll32.exe PID 800 wrote to memory of 1992 800 rundll32.exe rundll32.exe PID 800 wrote to memory of 1992 800 rundll32.exe rundll32.exe PID 800 wrote to memory of 1992 800 rundll32.exe rundll32.exe PID 800 wrote to memory of 1992 800 rundll32.exe rundll32.exe PID 800 wrote to memory of 1992 800 rundll32.exe rundll32.exe PID 1992 wrote to memory of 1592 1992 rundll32.exe msiexec.exe PID 1992 wrote to memory of 1592 1992 rundll32.exe msiexec.exe PID 1992 wrote to memory of 1592 1992 rundll32.exe msiexec.exe PID 1992 wrote to memory of 1592 1992 rundll32.exe msiexec.exe PID 1992 wrote to memory of 1592 1992 rundll32.exe msiexec.exe PID 1992 wrote to memory of 1592 1992 rundll32.exe msiexec.exe PID 1992 wrote to memory of 1592 1992 rundll32.exe msiexec.exe PID 1992 wrote to memory of 1592 1992 rundll32.exe msiexec.exe PID 1992 wrote to memory of 1592 1992 rundll32.exe msiexec.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1592-6-0x0000000000000000-mapping.dmp
-
memory/1592-8-0x00000000000F0000-0x0000000000124000-memory.dmpFilesize
208KB
-
memory/1992-2-0x0000000000000000-mapping.dmp
-
memory/1992-3-0x0000000076C21000-0x0000000076C23000-memory.dmpFilesize
8KB
-
memory/1992-4-0x00000000001C0000-0x00000000001F4000-memory.dmpFilesize
208KB
-
memory/1992-5-0x00000000000B0000-0x00000000000B1000-memory.dmpFilesize
4KB