Analysis
-
max time kernel
151s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
23-03-2021 18:04
Behavioral task
behavioral1
Sample
965e8a6c0b646352406ea5deb665a38606670c9163e12af2684dba436ae9fff3.dll
Resource
win7v20201028
Behavioral task
behavioral2
Sample
965e8a6c0b646352406ea5deb665a38606670c9163e12af2684dba436ae9fff3.dll
Resource
win10v20201028
General
-
Target
965e8a6c0b646352406ea5deb665a38606670c9163e12af2684dba436ae9fff3.dll
-
Size
150KB
-
MD5
b2dc3a104d18f1a899d67fcd69fc0c5b
-
SHA1
b5306f3e9d4a86d518cd4433a1eae65151775384
-
SHA256
965e8a6c0b646352406ea5deb665a38606670c9163e12af2684dba436ae9fff3
-
SHA512
d6d2f900a6095a895894bc50074bc2dde40aafd304f1e3078958d721b373f525201e979162ce64e81dce256779162c1a853dfc6909af47b4304da5daa1cc042b
Malware Config
Extracted
zloader
nut
22/03
https://svilapp.svgipsar.org/post.php
https://nadar-gis.com/post.php
https://crearqarquitectos.com/post.php
https://crown-sign.com/post.php
https://dainikjahan.com/post.php
https://denatureedutech.com/post.php
https://alekllemtilaro.tk/post.php
Signatures
-
Blocklisted process makes network request 5 IoCs
Processes:
msiexec.exeflow pid process 6 1772 msiexec.exe 7 1772 msiexec.exe 8 1772 msiexec.exe 9 1772 msiexec.exe 10 1772 msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 2004 set thread context of 1772 2004 rundll32.exe msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 1772 msiexec.exe Token: SeSecurityPrivilege 1772 msiexec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1656 wrote to memory of 2004 1656 rundll32.exe rundll32.exe PID 1656 wrote to memory of 2004 1656 rundll32.exe rundll32.exe PID 1656 wrote to memory of 2004 1656 rundll32.exe rundll32.exe PID 1656 wrote to memory of 2004 1656 rundll32.exe rundll32.exe PID 1656 wrote to memory of 2004 1656 rundll32.exe rundll32.exe PID 1656 wrote to memory of 2004 1656 rundll32.exe rundll32.exe PID 1656 wrote to memory of 2004 1656 rundll32.exe rundll32.exe PID 2004 wrote to memory of 1772 2004 rundll32.exe msiexec.exe PID 2004 wrote to memory of 1772 2004 rundll32.exe msiexec.exe PID 2004 wrote to memory of 1772 2004 rundll32.exe msiexec.exe PID 2004 wrote to memory of 1772 2004 rundll32.exe msiexec.exe PID 2004 wrote to memory of 1772 2004 rundll32.exe msiexec.exe PID 2004 wrote to memory of 1772 2004 rundll32.exe msiexec.exe PID 2004 wrote to memory of 1772 2004 rundll32.exe msiexec.exe PID 2004 wrote to memory of 1772 2004 rundll32.exe msiexec.exe PID 2004 wrote to memory of 1772 2004 rundll32.exe msiexec.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\965e8a6c0b646352406ea5deb665a38606670c9163e12af2684dba436ae9fff3.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\965e8a6c0b646352406ea5deb665a38606670c9163e12af2684dba436ae9fff3.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:1772
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1152-7-0x000007FEF7BD0000-0x000007FEF7E4A000-memory.dmpFilesize
2.5MB
-
memory/1772-4-0x0000000000000000-mapping.dmp
-
memory/1772-6-0x00000000000F0000-0x000000000011B000-memory.dmpFilesize
172KB
-
memory/2004-2-0x0000000000000000-mapping.dmp
-
memory/2004-3-0x00000000765A1000-0x00000000765A3000-memory.dmpFilesize
8KB