Analysis
-
max time kernel
66s -
max time network
162s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
15-06-2021 06:21
Static task
static1
Behavioral task
behavioral1
Sample
c68e80990502dc9b86fe4196af4a62985eb0a5ef56e06b9fa8bdf4ade2b9b668.dll
Resource
win7v20210408
Behavioral task
behavioral2
Sample
c68e80990502dc9b86fe4196af4a62985eb0a5ef56e06b9fa8bdf4ade2b9b668.dll
Resource
win10v20210410
General
-
Target
c68e80990502dc9b86fe4196af4a62985eb0a5ef56e06b9fa8bdf4ade2b9b668.dll
-
Size
306KB
-
MD5
402cd29f7429abc1b4690c0c71770825
-
SHA1
e826394c54c5827f1142b11adc5d550e335ec82e
-
SHA256
c68e80990502dc9b86fe4196af4a62985eb0a5ef56e06b9fa8bdf4ade2b9b668
-
SHA512
a726eb34ec1bf0d97697adc7cf0db8ad38a53cefcf1aa7d6ddb938b0924ae11822ba7713be4d9b0de186541e37a0517e40003056aec0208304b2e5b7f3fa0012
Malware Config
Extracted
zloader
googleaktualizacija
googleaktualizacija2
https://iqowijsdakm.com/gate.php
https://wiewjdmkfjn.com/gate.php
https://dksaoidiakjd.com/gate.php
https://iweuiqjdakjd.com/gate.php
https://yuidskadjna.com/gate.php
https://olksmadnbdj.com/gate.php
https://odsakmdfnbs.com/gate.php
https://odsakjmdnhsaj.com/gate.php
https://odjdnhsaj.com/gate.php
https://odoishsaj.com/gate.php
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3968 wrote to memory of 4076 3968 rundll32.exe rundll32.exe PID 3968 wrote to memory of 4076 3968 rundll32.exe rundll32.exe PID 3968 wrote to memory of 4076 3968 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c68e80990502dc9b86fe4196af4a62985eb0a5ef56e06b9fa8bdf4ade2b9b668.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c68e80990502dc9b86fe4196af4a62985eb0a5ef56e06b9fa8bdf4ade2b9b668.dll,#12⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/764-117-0x0000000000000000-mapping.dmp
-
memory/764-120-0x0000000000990000-0x00000000009B6000-memory.dmpFilesize
152KB
-
memory/4076-114-0x0000000000000000-mapping.dmp
-
memory/4076-115-0x0000000000E90000-0x0000000000EB2000-memory.dmpFilesize
136KB
-
memory/4076-116-0x0000000010000000-0x0000000010050000-memory.dmpFilesize
320KB