Analysis
-
max time kernel
63s -
max time network
180s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
05-08-2021 07:31
Static task
static1
Behavioral task
behavioral1
Sample
JavaE.dll
Resource
win7v20210408
General
-
Target
JavaE.dll
-
Size
279KB
-
MD5
86cef6c066a05b3f67123fbf638b6b01
-
SHA1
81618f8ecc48541c219aa974e4b16cab8f34203b
-
SHA256
86c37d778f584a2a3090ab170c8cd2fb3ddf952cde689b4c5a1efd74fc113a05
-
SHA512
1132f94eeb8ae5d4556841976789b648f2394a4089db2e6b43c2047cc87004f00e334e14a96c5ab0535aeb13f3bffc8d5e955d7435b9be2aba491bcbe92044d9
Malware Config
Extracted
zloader
vasja
vasja
https://iqowijsdakm.com/gate.php
https://wiewjdmkfjn.com/gate.php
https://dksaoidiakjd.com/gate.php
https://iweuiqjdakjd.com/gate.php
https://yuidskadjna.com/gate.php
https://olksmadnbdj.com/gate.php
https://odsakmdfnbs.com/gate.php
https://odsakjmdnhsaj.com/gate.php
https://odjdnhsaj.com/gate.php
https://odoishsaj.com/gate.php
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 320 wrote to memory of 1848 320 regsvr32.exe regsvr32.exe PID 320 wrote to memory of 1848 320 regsvr32.exe regsvr32.exe PID 320 wrote to memory of 1848 320 regsvr32.exe regsvr32.exe PID 320 wrote to memory of 1848 320 regsvr32.exe regsvr32.exe PID 320 wrote to memory of 1848 320 regsvr32.exe regsvr32.exe PID 320 wrote to memory of 1848 320 regsvr32.exe regsvr32.exe PID 320 wrote to memory of 1848 320 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\JavaE.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\JavaE.dll2⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/320-59-0x000007FEFB531000-0x000007FEFB533000-memory.dmpFilesize
8KB
-
memory/1572-64-0x0000000000000000-mapping.dmp
-
memory/1572-66-0x0000000000090000-0x00000000000B6000-memory.dmpFilesize
152KB
-
memory/1848-60-0x0000000000000000-mapping.dmp
-
memory/1848-61-0x0000000075051000-0x0000000075053000-memory.dmpFilesize
8KB
-
memory/1848-62-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/1848-63-0x0000000010000000-0x0000000010148000-memory.dmpFilesize
1.3MB