Analysis
-
max time kernel
1730s -
max time network
1729s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
22-03-2021 15:36
Static task
static1
General
-
Target
d8U.txt.dll
-
Size
298KB
-
MD5
e32b5a1b18f205db4298a9f18f52457a
-
SHA1
b29e3ea3d4b32e2d21b1f01f2f571d59676506bf
-
SHA256
92b61c6ea3254a25ffe182a1fbf53b4e4dc154bfb955c213a4c554b41d1c43a6
-
SHA512
e6693bee35ea4aa7089bc589a6161560c03eb1a988d90a6ce07ec294fd8c5a8c9a08a3c853b17f1b3043f3ada602a90269761295b1c8e9f907dc32ece03de210
Malware Config
Extracted
Family
zloader
Botnet
nut
Campaign
22/03
C2
https://svilapp.svgipsar.org/post.php
https://nadar-gis.com/post.php
https://crearqarquitectos.com/post.php
https://crown-sign.com/post.php
https://dainikjahan.com/post.php
https://denatureedutech.com/post.php
https://alekllemtilaro.tk/post.php
rc4.plain
rsa_pubkey.plain
Signatures
-
Blocklisted process makes network request 64 IoCs
Processes:
msiexec.exeflow pid process 7 268 msiexec.exe 8 268 msiexec.exe 9 268 msiexec.exe 10 268 msiexec.exe 11 268 msiexec.exe 12 268 msiexec.exe 13 268 msiexec.exe 14 268 msiexec.exe 15 268 msiexec.exe 16 268 msiexec.exe 17 268 msiexec.exe 18 268 msiexec.exe 19 268 msiexec.exe 20 268 msiexec.exe 21 268 msiexec.exe 22 268 msiexec.exe 23 268 msiexec.exe 24 268 msiexec.exe 25 268 msiexec.exe 26 268 msiexec.exe 27 268 msiexec.exe 29 268 msiexec.exe 30 268 msiexec.exe 31 268 msiexec.exe 33 268 msiexec.exe 35 268 msiexec.exe 37 268 msiexec.exe 39 268 msiexec.exe 41 268 msiexec.exe 43 268 msiexec.exe 45 268 msiexec.exe 46 268 msiexec.exe 47 268 msiexec.exe 48 268 msiexec.exe 49 268 msiexec.exe 50 268 msiexec.exe 51 268 msiexec.exe 52 268 msiexec.exe 53 268 msiexec.exe 54 268 msiexec.exe 55 268 msiexec.exe 56 268 msiexec.exe 57 268 msiexec.exe 58 268 msiexec.exe 59 268 msiexec.exe 60 268 msiexec.exe 61 268 msiexec.exe 62 268 msiexec.exe 63 268 msiexec.exe 64 268 msiexec.exe 65 268 msiexec.exe 66 268 msiexec.exe 67 268 msiexec.exe 68 268 msiexec.exe 69 268 msiexec.exe 70 268 msiexec.exe 71 268 msiexec.exe 72 268 msiexec.exe 73 268 msiexec.exe 74 268 msiexec.exe 75 268 msiexec.exe 76 268 msiexec.exe 77 268 msiexec.exe 78 268 msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 1800 set thread context of 268 1800 rundll32.exe msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 268 msiexec.exe Token: SeSecurityPrivilege 268 msiexec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 844 wrote to memory of 1800 844 rundll32.exe rundll32.exe PID 844 wrote to memory of 1800 844 rundll32.exe rundll32.exe PID 844 wrote to memory of 1800 844 rundll32.exe rundll32.exe PID 844 wrote to memory of 1800 844 rundll32.exe rundll32.exe PID 844 wrote to memory of 1800 844 rundll32.exe rundll32.exe PID 844 wrote to memory of 1800 844 rundll32.exe rundll32.exe PID 844 wrote to memory of 1800 844 rundll32.exe rundll32.exe PID 1800 wrote to memory of 268 1800 rundll32.exe msiexec.exe PID 1800 wrote to memory of 268 1800 rundll32.exe msiexec.exe PID 1800 wrote to memory of 268 1800 rundll32.exe msiexec.exe PID 1800 wrote to memory of 268 1800 rundll32.exe msiexec.exe PID 1800 wrote to memory of 268 1800 rundll32.exe msiexec.exe PID 1800 wrote to memory of 268 1800 rundll32.exe msiexec.exe PID 1800 wrote to memory of 268 1800 rundll32.exe msiexec.exe PID 1800 wrote to memory of 268 1800 rundll32.exe msiexec.exe PID 1800 wrote to memory of 268 1800 rundll32.exe msiexec.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d8U.txt.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d8U.txt.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/268-6-0x0000000000000000-mapping.dmp
-
memory/268-8-0x0000000000090000-0x00000000000BB000-memory.dmpFilesize
172KB
-
memory/1656-9-0x000007FEF81B0000-0x000007FEF842A000-memory.dmpFilesize
2.5MB
-
memory/1800-2-0x0000000000000000-mapping.dmp
-
memory/1800-3-0x00000000761E1000-0x00000000761E3000-memory.dmpFilesize
8KB
-
memory/1800-4-0x0000000074930000-0x000000007495B000-memory.dmpFilesize
172KB
-
memory/1800-5-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB