Analysis
-
max time kernel
50s -
max time network
198s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
08-06-2021 18:49
Static task
static1
Behavioral task
behavioral1
Sample
9c201b6131cd721438f814bd308168b95a3bfbc7785c9ac2ee19209ae50e8232.dll
Resource
win7v20210408
General
-
Target
9c201b6131cd721438f814bd308168b95a3bfbc7785c9ac2ee19209ae50e8232.dll
-
Size
533KB
-
MD5
67fc6cca4761bb4913b49d3257dff8a4
-
SHA1
2c9e8fa1e4f7dd5547880e0b7b56148553fdfdde
-
SHA256
9c201b6131cd721438f814bd308168b95a3bfbc7785c9ac2ee19209ae50e8232
-
SHA512
3f516bd83acddda8abdbce8971451a23ad63bdeffc09979c1b1714371ce71912633ea52215aec28a937356ff08220e3ecce24736c818085352a2a3bfa1ea1796
Malware Config
Extracted
zloader
personal
personal
https://iqowijsdakm.com/gate.php
https://wiewjdmkfjn.com/gate.php
https://dksaoidiakjd.com/gate.php
https://iweuiqjdakjd.com/gate.php
https://yuidskadjna.com/gate.php
https://olksmadnbdj.com/gate.php
https://odsakmdfnbs.com/gate.php
https://odsakjmdnhsaj.com/gate.php
https://odjdnhsaj.com/gate.php
https://odoishsaj.com/gate.php
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1988 wrote to memory of 1532 1988 regsvr32.exe regsvr32.exe PID 1988 wrote to memory of 1532 1988 regsvr32.exe regsvr32.exe PID 1988 wrote to memory of 1532 1988 regsvr32.exe regsvr32.exe PID 1988 wrote to memory of 1532 1988 regsvr32.exe regsvr32.exe PID 1988 wrote to memory of 1532 1988 regsvr32.exe regsvr32.exe PID 1988 wrote to memory of 1532 1988 regsvr32.exe regsvr32.exe PID 1988 wrote to memory of 1532 1988 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\9c201b6131cd721438f814bd308168b95a3bfbc7785c9ac2ee19209ae50e8232.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\9c201b6131cd721438f814bd308168b95a3bfbc7785c9ac2ee19209ae50e8232.dll2⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/676-64-0x0000000000000000-mapping.dmp
-
memory/676-66-0x0000000000090000-0x00000000000B6000-memory.dmpFilesize
152KB
-
memory/1532-60-0x0000000000000000-mapping.dmp
-
memory/1532-61-0x0000000076A01000-0x0000000076A03000-memory.dmpFilesize
8KB
-
memory/1532-62-0x00000000001C0000-0x0000000000240000-memory.dmpFilesize
512KB
-
memory/1532-63-0x0000000010000000-0x000000001008C000-memory.dmpFilesize
560KB
-
memory/1988-59-0x000007FEFC381000-0x000007FEFC383000-memory.dmpFilesize
8KB