Analysis
- max time kernel
150s - max time network
149s - platform
windows7_x64 - resource
win7v20201028 - submitted
24/03/2021, 15:46
Static task
static1
Behavioral task
behavioral1
Sample
cYg4dkuO.dll
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
cYg4dkuO.dll
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target cYg4dkuO.dll
- Size 688KB
- Sample210324-clw1bf67ln
- SHA256 3787d90c7fa9f7b2803b904476eff287d4f59d1fe550f248250e84ca8885065f
- MD5 1da1b1f1037bacd1fe8e017a5d52e727
- SHA1 b9b6463219a19632299c5e0fb76715753b6ddd0e
- SHA512 9ff5622658a9d5c1f679a4783d2f4a4b340838fc24fbcc5e1856d74ce7e9d5b90280b5cd1b96e7be40c87406d7e0c0d2c2e6a51b786b6c29d069b23f0287a5f4
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
zloader
Botnet
-
nut
Campaign
-
24/03
C2
-
https://electrabeautytools.com/post.php
-
https://elexitodelonatural.com/post.php
-
https://elmaaref.com/post.php
-
https://enrichuae.com/post.php
-
https://www.epsilon-me.com/post.php
-
https://codilmeosoterti.tk/post.php
rc4.plain
rsa_pubkey.plain
Signatures
- Blocklisted process makes network request 50 IoCs
flow pid Process 6 872 msiexec.exe 7 872 msiexec.exe 8 872 msiexec.exe 9 872 msiexec.exe 10 872 msiexec.exe 11 872 msiexec.exe 12 872 msiexec.exe 13 872 msiexec.exe 14 872 msiexec.exe 15 872 msiexec.exe 16 872 msiexec.exe 17 872 msiexec.exe 18 872 msiexec.exe 19 872 msiexec.exe 20 872 msiexec.exe 21 872 msiexec.exe 22 872 msiexec.exe 23 872 msiexec.exe 24 872 msiexec.exe 25 872 msiexec.exe 26 872 msiexec.exe 28 872 msiexec.exe 29 872 msiexec.exe 30 872 msiexec.exe 32 872 msiexec.exe 33 872 msiexec.exe 34 872 msiexec.exe 35 872 msiexec.exe 36 872 msiexec.exe 37 872 msiexec.exe 38 872 msiexec.exe 39 872 msiexec.exe 40 872 msiexec.exe 41 872 msiexec.exe 42 872 msiexec.exe 43 872 msiexec.exe 44 872 msiexec.exe 45 872 msiexec.exe 46 872 msiexec.exe 47 872 msiexec.exe 48 872 msiexec.exe 49 872 msiexec.exe 50 872 msiexec.exe 51 872 msiexec.exe 53 872 msiexec.exe 54 872 msiexec.exe 55 872 msiexec.exe 56 872 msiexec.exe 58 872 msiexec.exe 59 872 msiexec.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1948 set thread context of 872 1948 rundll32.exe 30 - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeSecurityPrivilege 872 msiexec.exe Token: SeSecurityPrivilege 872 msiexec.exe - Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1576 wrote to memory of 1948 1576 rundll32.exe 24 PID 1576 wrote to memory of 1948 1576 rundll32.exe 24 PID 1576 wrote to memory of 1948 1576 rundll32.exe 24 PID 1576 wrote to memory of 1948 1576 rundll32.exe 24 PID 1576 wrote to memory of 1948 1576 rundll32.exe 24 PID 1576 wrote to memory of 1948 1576 rundll32.exe 24 PID 1576 wrote to memory of 1948 1576 rundll32.exe 24 PID 1948 wrote to memory of 872 1948 rundll32.exe 30 PID 1948 wrote to memory of 872 1948 rundll32.exe 30 PID 1948 wrote to memory of 872 1948 rundll32.exe 30 PID 1948 wrote to memory of 872 1948 rundll32.exe 30 PID 1948 wrote to memory of 872 1948 rundll32.exe 30 PID 1948 wrote to memory of 872 1948 rundll32.exe 30 PID 1948 wrote to memory of 872 1948 rundll32.exe 30 PID 1948 wrote to memory of 872 1948 rundll32.exe 30 PID 1948 wrote to memory of 872 1948 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cYg4dkuO.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cYg4dkuO.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:872
-
-