nloader | 93db19c454405ef70de2ead0a3b2158e0d8cc8c3bb663c3af15a0df1b008fc53 | Triage

Analysis

max time kernel
6s
max time network
11s
platform
windows7_x64
resource
win7v20201028
submitted
23-03-2021 09:55

Sharing

Report Analysis Logs

General

Target

12.0.dll
Size

37KB
MD5

af18cd9e59906e5c56bd5a07502b1f0b
SHA1

3bc5960b69cbd0266e66dfea9e6d9eb6365ae78a
SHA256

93db19c454405ef70de2ead0a3b2158e0d8cc8c3bb663c3af15a0df1b008fc53
SHA512

35e56125884be604b45d11fc318d022bbd021ff83f8cc41fe606d91eb8f6a4770e319ff92fc9ff0119c3bbc34557be0ac41f64d90538186852269efd54144281

Score

10^/10

nloader loader

Malware Config

Signatures

Nloader
Simple loader that includes the keyword 'cambo' in the URL used to download other families.
loader nloader

Nloader Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1196-5-0x0000000010000000-0x000000001000C000-memory.dmp	nloader

Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

2 1196 rundll32.exe
5 1196 rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1888 wrote to memory of 1196	1888	rundll32.exe	rundll32.exe
PID 1888 wrote to memory of 1196	1888	rundll32.exe	rundll32.exe
PID 1888 wrote to memory of 1196	1888	rundll32.exe	rundll32.exe
PID 1888 wrote to memory of 1196	1888	rundll32.exe	rundll32.exe
PID 1888 wrote to memory of 1196	1888	rundll32.exe	rundll32.exe
PID 1888 wrote to memory of 1196	1888	rundll32.exe	rundll32.exe
PID 1888 wrote to memory of 1196	1888	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\12.0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1888

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\12.0.dll,#1
2⤵
- Blocklisted process makes network request
PID:1196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1196-2-0x0000000000000000-mapping.dmp

Download
memory/1196-3-0x0000000075781000-0x0000000075783000-memory.dmp

Filesize
8KB

Download
memory/1196-5-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/1196-4-0x00000000001B0000-0x00000000001BC000-memory.dmp

Filesize
48KB

Download