Analysis
-
max time kernel
109s -
max time network
110s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
04-03-2021 02:42
Behavioral task
behavioral1
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
-
Size
260KB
-
MD5
9e9719483cc24dc0ab94b31f76981f42
-
SHA1
dad2cbcedfa94a2d2f0fde521d6f57a094d7c85b
-
SHA256
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9
-
SHA512
83cff2d55df7d40aea1357515cc673792b367718e57624a2eedd531fd51c49ff165e5e69065efa09148d550644ea1106f54dea35aaadcebaa9ed911532c44309
Malware Config
Extracted
Family
zloader
Botnet
25/03
C2
https://wgyvjbse.pw/milagrecf.php
https://botiq.xyz/milagrecf.php
rc4.plain
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 728 created 2300 728 WerFault.exe msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
regsvr32.exedescription pid process target process PID 620 set thread context of 2300 620 regsvr32.exe msiexec.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 728 2300 WerFault.exe msiexec.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
WerFault.exepid process 728 WerFault.exe 728 WerFault.exe 728 WerFault.exe 728 WerFault.exe 728 WerFault.exe 728 WerFault.exe 728 WerFault.exe 728 WerFault.exe 728 WerFault.exe 728 WerFault.exe 728 WerFault.exe 728 WerFault.exe 728 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 728 WerFault.exe Token: SeBackupPrivilege 728 WerFault.exe Token: SeDebugPrivilege 728 WerFault.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 3996 wrote to memory of 620 3996 regsvr32.exe regsvr32.exe PID 3996 wrote to memory of 620 3996 regsvr32.exe regsvr32.exe PID 3996 wrote to memory of 620 3996 regsvr32.exe regsvr32.exe PID 620 wrote to memory of 2300 620 regsvr32.exe msiexec.exe PID 620 wrote to memory of 2300 620 regsvr32.exe msiexec.exe PID 620 wrote to memory of 2300 620 regsvr32.exe msiexec.exe PID 620 wrote to memory of 2300 620 regsvr32.exe msiexec.exe PID 620 wrote to memory of 2300 620 regsvr32.exe msiexec.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 5724⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken