Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
30-04-2021 19:26
Static task
static1
Behavioral task
behavioral1
Sample
5e0362037ebe9276b9a253a66c233be67bb6ceedec997e9bd0faa294091eb52c.dll
Resource
win7v20210410
General
-
Target
5e0362037ebe9276b9a253a66c233be67bb6ceedec997e9bd0faa294091eb52c.dll
-
Size
619KB
-
MD5
e54803695352cd8a46fb303f6d83c4f5
-
SHA1
246416a97b5d712495a17081456a3ceb4f6d2d2e
-
SHA256
5e0362037ebe9276b9a253a66c233be67bb6ceedec997e9bd0faa294091eb52c
-
SHA512
739de9da9b8755c34577801c4fa0b88a347012fc579a4ac4a4a2e6d4b1213e1ac585b1f1a9db59549693436eac6700ab57af4598ae0b3f2f8c32a86701f923fa
Malware Config
Extracted
zloader
nut
30/03
https://holacast.com/post.php
https://homeloansadvisor.in/post.php
https://hoteldonalala.com.mx/post.php
https://hotimobiliaria.com.br/post.php
https://hrdgschool.com/post.php
https://huloolcreations.com/post.php
https://hyundainhatrang.vn/post.php
https://iaikotasemarang.id/post.php
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
msiexec.exeflow pid process 7 316 msiexec.exe 8 316 msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1156 set thread context of 316 1156 regsvr32.exe msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 316 msiexec.exe Token: SeSecurityPrivilege 316 msiexec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 1756 wrote to memory of 1156 1756 regsvr32.exe regsvr32.exe PID 1756 wrote to memory of 1156 1756 regsvr32.exe regsvr32.exe PID 1756 wrote to memory of 1156 1756 regsvr32.exe regsvr32.exe PID 1756 wrote to memory of 1156 1756 regsvr32.exe regsvr32.exe PID 1756 wrote to memory of 1156 1756 regsvr32.exe regsvr32.exe PID 1756 wrote to memory of 1156 1756 regsvr32.exe regsvr32.exe PID 1756 wrote to memory of 1156 1756 regsvr32.exe regsvr32.exe PID 1156 wrote to memory of 316 1156 regsvr32.exe msiexec.exe PID 1156 wrote to memory of 316 1156 regsvr32.exe msiexec.exe PID 1156 wrote to memory of 316 1156 regsvr32.exe msiexec.exe PID 1156 wrote to memory of 316 1156 regsvr32.exe msiexec.exe PID 1156 wrote to memory of 316 1156 regsvr32.exe msiexec.exe PID 1156 wrote to memory of 316 1156 regsvr32.exe msiexec.exe PID 1156 wrote to memory of 316 1156 regsvr32.exe msiexec.exe PID 1156 wrote to memory of 316 1156 regsvr32.exe msiexec.exe PID 1156 wrote to memory of 316 1156 regsvr32.exe msiexec.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\5e0362037ebe9276b9a253a66c233be67bb6ceedec997e9bd0faa294091eb52c.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\5e0362037ebe9276b9a253a66c233be67bb6ceedec997e9bd0faa294091eb52c.dll2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/316-66-0x0000000000000000-mapping.dmp
-
memory/316-68-0x0000000000090000-0x00000000000BB000-memory.dmpFilesize
172KB
-
memory/1156-61-0x0000000000000000-mapping.dmp
-
memory/1156-62-0x0000000075FE1000-0x0000000075FE3000-memory.dmpFilesize
8KB
-
memory/1156-63-0x0000000074210000-0x000000007423B000-memory.dmpFilesize
172KB
-
memory/1156-64-0x0000000074210000-0x00000000747B4000-memory.dmpFilesize
5.6MB
-
memory/1156-65-0x0000000000180000-0x0000000000181000-memory.dmpFilesize
4KB
-
memory/1756-60-0x000007FEFBD21000-0x000007FEFBD23000-memory.dmpFilesize
8KB