Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
14-04-2021 06:55
Static task
static1
Behavioral task
behavioral1
Sample
2SoXN.dll
Resource
win7v20210410
0 signatures
0 seconds
General
-
Target
2SoXN.dll
-
Size
666KB
-
MD5
dac52df1477fe8b567b656c1da2e876f
-
SHA1
4b020a24c3d68b21b586a531e04d558f04de4f52
-
SHA256
314ac0158727ba0bed95d244200e569e5aa9528f4c567c1c2c5cfba542fe545c
-
SHA512
fb36eb6c6327b8e51cb5230ab5206b2fb327ff440d3e9219535b75b39bd6d03871be7069960120238072a2b0c29ba5716ba8868d02a1fc85b0a62445454cc240
Malware Config
Extracted
Family
zloader
Botnet
nut
Campaign
13/04
C2
https://jiaayanu.com/post.php
https://investinszeklerland.eu/post.php
https://iqs-sac.com/post.php
https://jciems.in/post.php
https://jinnahofficersschool.com/post.php
https://kancagh.com/post.php
rc4.plain
rsa_pubkey.plain
Signatures
-
Blocklisted process makes network request 16 IoCs
Processes:
msiexec.exeflow pid process 6 1068 msiexec.exe 7 1068 msiexec.exe 8 1068 msiexec.exe 9 1068 msiexec.exe 10 1068 msiexec.exe 11 1068 msiexec.exe 12 1068 msiexec.exe 13 1068 msiexec.exe 14 1068 msiexec.exe 15 1068 msiexec.exe 16 1068 msiexec.exe 17 1068 msiexec.exe 18 1068 msiexec.exe 19 1068 msiexec.exe 20 1068 msiexec.exe 21 1068 msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 316 set thread context of 1068 316 rundll32.exe msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 1068 msiexec.exe Token: SeSecurityPrivilege 1068 msiexec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2040 wrote to memory of 316 2040 rundll32.exe rundll32.exe PID 2040 wrote to memory of 316 2040 rundll32.exe rundll32.exe PID 2040 wrote to memory of 316 2040 rundll32.exe rundll32.exe PID 2040 wrote to memory of 316 2040 rundll32.exe rundll32.exe PID 2040 wrote to memory of 316 2040 rundll32.exe rundll32.exe PID 2040 wrote to memory of 316 2040 rundll32.exe rundll32.exe PID 2040 wrote to memory of 316 2040 rundll32.exe rundll32.exe PID 316 wrote to memory of 1068 316 rundll32.exe msiexec.exe PID 316 wrote to memory of 1068 316 rundll32.exe msiexec.exe PID 316 wrote to memory of 1068 316 rundll32.exe msiexec.exe PID 316 wrote to memory of 1068 316 rundll32.exe msiexec.exe PID 316 wrote to memory of 1068 316 rundll32.exe msiexec.exe PID 316 wrote to memory of 1068 316 rundll32.exe msiexec.exe PID 316 wrote to memory of 1068 316 rundll32.exe msiexec.exe PID 316 wrote to memory of 1068 316 rundll32.exe msiexec.exe PID 316 wrote to memory of 1068 316 rundll32.exe msiexec.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2SoXN.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2SoXN.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/316-59-0x0000000000000000-mapping.dmp
-
memory/316-60-0x0000000076281000-0x0000000076283000-memory.dmpFilesize
8KB
-
memory/316-62-0x0000000074FB0000-0x0000000075078000-memory.dmpFilesize
800KB
-
memory/316-61-0x0000000074FB0000-0x0000000074FDB000-memory.dmpFilesize
172KB
-
memory/316-63-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB
-
memory/1068-64-0x0000000000000000-mapping.dmp
-
memory/1068-66-0x0000000000090000-0x00000000000BB000-memory.dmpFilesize
172KB