Analysis
-
max time kernel
30s -
max time network
144s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
08-03-2021 22:38
Static task
static1
Behavioral task
behavioral1
Sample
2021-03-08-Spelevo-EK-payload-ZLoader-EXE.bin.dll
Resource
win7v20201028
Behavioral task
behavioral2
Sample
2021-03-08-Spelevo-EK-payload-ZLoader-EXE.bin.dll
Resource
win10v20201028
General
-
Target
2021-03-08-Spelevo-EK-payload-ZLoader-EXE.bin.dll
-
Size
292KB
-
MD5
a552a092b08cd01310b87ee994a21bc2
-
SHA1
8d9b3a09a70914a0a20f42a79474abba34737206
-
SHA256
9ef6c5467fd80274e6a37e2883a5e83a894cf2148ce37bf0adb1e884acbc4c0b
-
SHA512
fd504086bb67b7e9c6d492a3d4efa6ca56f91fd47df5b45c21451164825b6451b1d55392565c7aa47f7ed0c594ecdbc69a1753c595604118d4d9e3943af545d5
Malware Config
Extracted
zloader
googleaktualizacija
googleaktualizacija2
https://iqowijsdakm.com/gate.php
https://wiewjdmkfjn.com/gate.php
https://dksaoidiakjd.com/gate.php
https://iweuiqjdakjd.com/gate.php
https://yuidskadjna.com/gate.php
https://olksmadnbdj.com/gate.php
https://odsakmdfnbs.com/gate.php
https://odsakjmdnhsaj.com/gate.php
https://odjdnhsaj.com/gate.php
https://odoishsaj.com/gate.php
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1676 wrote to memory of 1220 1676 regsvr32.exe regsvr32.exe PID 1676 wrote to memory of 1220 1676 regsvr32.exe regsvr32.exe PID 1676 wrote to memory of 1220 1676 regsvr32.exe regsvr32.exe PID 1676 wrote to memory of 1220 1676 regsvr32.exe regsvr32.exe PID 1676 wrote to memory of 1220 1676 regsvr32.exe regsvr32.exe PID 1676 wrote to memory of 1220 1676 regsvr32.exe regsvr32.exe PID 1676 wrote to memory of 1220 1676 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\2021-03-08-Spelevo-EK-payload-ZLoader-EXE.bin.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\2021-03-08-Spelevo-EK-payload-ZLoader-EXE.bin.dll2⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1072-11-0x000007FEF6460000-0x000007FEF66DA000-memory.dmpFilesize
2.5MB
-
memory/1220-3-0x0000000000000000-mapping.dmp
-
memory/1220-4-0x0000000075F21000-0x0000000075F23000-memory.dmpFilesize
8KB
-
memory/1220-5-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/1220-6-0x0000000001D51000-0x0000000001D62000-memory.dmpFilesize
68KB
-
memory/1220-7-0x0000000001D50000-0x0000000001DA3000-memory.dmpFilesize
332KB
-
memory/1676-2-0x000007FEFBDE1000-0x000007FEFBDE3000-memory.dmpFilesize
8KB
-
memory/1696-8-0x0000000000000000-mapping.dmp
-
memory/1696-10-0x0000000000090000-0x00000000000B6000-memory.dmpFilesize
152KB