Analysis
-
max time kernel
51s -
max time network
186s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
01-08-2021 14:22
Static task
static1
Behavioral task
behavioral1
Sample
JavaN.dll
Resource
win7v20210410
General
-
Target
JavaN.dll
-
Size
242KB
-
MD5
348d6fd40a9e79a681048999873af548
-
SHA1
069f292e298dabc97a7946c25b8833abf0783dc1
-
SHA256
6819b89e1dba92ee4c6eaa7e35880a6d8e1b51047ec4fed392d29a9aeb8e36b7
-
SHA512
7d75ff10763fbf72f0b6a13dbb8f429b6820379f118afd303dad2e2e9c358ea1d220a3afe05d5d949608ee39135f86b27dede86c9062b0ee5b98d0b1591b001e
Malware Config
Extracted
zloader
ivan
ivan
https://iqowijsdakm.com/gate.php
https://wiewjdmkfjn.com/gate.php
https://dksaoidiakjd.com/gate.php
https://iweuiqjdakjd.com/gate.php
https://yuidskadjna.com/gate.php
https://olksmadnbdj.com/gate.php
https://odsakmdfnbs.com/gate.php
https://odsakjmdnhsaj.com/gate.php
https://odjdnhsaj.com/gate.php
https://odoishsaj.com/gate.php
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1116 wrote to memory of 2008 1116 regsvr32.exe regsvr32.exe PID 1116 wrote to memory of 2008 1116 regsvr32.exe regsvr32.exe PID 1116 wrote to memory of 2008 1116 regsvr32.exe regsvr32.exe PID 1116 wrote to memory of 2008 1116 regsvr32.exe regsvr32.exe PID 1116 wrote to memory of 2008 1116 regsvr32.exe regsvr32.exe PID 1116 wrote to memory of 2008 1116 regsvr32.exe regsvr32.exe PID 1116 wrote to memory of 2008 1116 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\JavaN.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\JavaN.dll2⤵PID:2008
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵PID:1412