Analysis
-
max time kernel
150s -
max time network
9s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
31-03-2021 01:55
Static task
static1
Behavioral task
behavioral1
Sample
287352aca562a84f441ad7794832770ddfe283a8f05bab7a37f2ba66f3dc7edf.dll
Resource
win7v20201028
Behavioral task
behavioral2
Sample
287352aca562a84f441ad7794832770ddfe283a8f05bab7a37f2ba66f3dc7edf.dll
Resource
win10v20201028
General
-
Target
287352aca562a84f441ad7794832770ddfe283a8f05bab7a37f2ba66f3dc7edf.dll
-
Size
619KB
-
MD5
a467c5e63940b8bc9b56f382aa20ea94
-
SHA1
eac1e8911a5fced479130bd8c7382aa6cb3278c9
-
SHA256
287352aca562a84f441ad7794832770ddfe283a8f05bab7a37f2ba66f3dc7edf
-
SHA512
2bf61eb3264e2171cb4dad95018ac5dca826950821f5b8c8a1399bac6fe55dab258fd54f12f3d3c83039ce37b43f292fefc02082010f102a26e86bccc04a1ce9
Malware Config
Extracted
zloader
nut
30/03
https://holacast.com/post.php
https://homeloansadvisor.in/post.php
https://hoteldonalala.com.mx/post.php
https://hotimobiliaria.com.br/post.php
https://hrdgschool.com/post.php
https://huloolcreations.com/post.php
https://hyundainhatrang.vn/post.php
https://iaikotasemarang.id/post.php
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1980 set thread context of 1448 1980 regsvr32.exe msiexec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 1684 wrote to memory of 1980 1684 regsvr32.exe regsvr32.exe PID 1684 wrote to memory of 1980 1684 regsvr32.exe regsvr32.exe PID 1684 wrote to memory of 1980 1684 regsvr32.exe regsvr32.exe PID 1684 wrote to memory of 1980 1684 regsvr32.exe regsvr32.exe PID 1684 wrote to memory of 1980 1684 regsvr32.exe regsvr32.exe PID 1684 wrote to memory of 1980 1684 regsvr32.exe regsvr32.exe PID 1684 wrote to memory of 1980 1684 regsvr32.exe regsvr32.exe PID 1980 wrote to memory of 1448 1980 regsvr32.exe msiexec.exe PID 1980 wrote to memory of 1448 1980 regsvr32.exe msiexec.exe PID 1980 wrote to memory of 1448 1980 regsvr32.exe msiexec.exe PID 1980 wrote to memory of 1448 1980 regsvr32.exe msiexec.exe PID 1980 wrote to memory of 1448 1980 regsvr32.exe msiexec.exe PID 1980 wrote to memory of 1448 1980 regsvr32.exe msiexec.exe PID 1980 wrote to memory of 1448 1980 regsvr32.exe msiexec.exe PID 1980 wrote to memory of 1448 1980 regsvr32.exe msiexec.exe PID 1980 wrote to memory of 1448 1980 regsvr32.exe msiexec.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\287352aca562a84f441ad7794832770ddfe283a8f05bab7a37f2ba66f3dc7edf.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\287352aca562a84f441ad7794832770ddfe283a8f05bab7a37f2ba66f3dc7edf.dll2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1448-7-0x0000000000000000-mapping.dmp
-
memory/1448-9-0x00000000000D0000-0x00000000000FB000-memory.dmpFilesize
172KB
-
memory/1684-2-0x000007FEFC2C1000-0x000007FEFC2C3000-memory.dmpFilesize
8KB
-
memory/1980-4-0x00000000756A1000-0x00000000756A3000-memory.dmpFilesize
8KB
-
memory/1980-3-0x0000000000000000-mapping.dmp
-
memory/1980-5-0x00000000747B0000-0x00000000747DB000-memory.dmpFilesize
172KB
-
memory/1980-6-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB