Analysis
-
max time kernel
50s -
max time network
150s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
09-08-2021 15:20
Static task
static1
Behavioral task
behavioral1
Sample
c43c3c195e838ef81a36c1434fa7395c.dll
Resource
win7v20210408
General
-
Target
c43c3c195e838ef81a36c1434fa7395c.dll
-
Size
952KB
-
MD5
c43c3c195e838ef81a36c1434fa7395c
-
SHA1
c9accdc1204579d13440df22e4892fcc2082dc7c
-
SHA256
24c57cf9a9fd72827ced5f95796cf333089f076c660bf06b5e7d071a4d5fc102
-
SHA512
5ec2613176ddf8ca9ae331823cb7b62d436ea007850e60a9aeeee0bf23c827a2e3c1eb422594bdd3ec4c86f7688d91f3e8a3c6b2435c46078069c53947a1739f
Malware Config
Extracted
zloader
vasja
vasja
https://iqowijsdakm.com/gate.php
https://wiewjdmkfjn.com/gate.php
https://dksaoidiakjd.com/gate.php
https://iweuiqjdakjd.com/gate.php
https://yuidskadjna.com/gate.php
https://olksmadnbdj.com/gate.php
https://odsakmdfnbs.com/gate.php
https://odsakjmdnhsaj.com/gate.php
https://odjdnhsaj.com/gate.php
https://odoishsaj.com/gate.php
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 684 wrote to memory of 1520 684 regsvr32.exe regsvr32.exe PID 684 wrote to memory of 1520 684 regsvr32.exe regsvr32.exe PID 684 wrote to memory of 1520 684 regsvr32.exe regsvr32.exe PID 684 wrote to memory of 1520 684 regsvr32.exe regsvr32.exe PID 684 wrote to memory of 1520 684 regsvr32.exe regsvr32.exe PID 684 wrote to memory of 1520 684 regsvr32.exe regsvr32.exe PID 684 wrote to memory of 1520 684 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\c43c3c195e838ef81a36c1434fa7395c.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\c43c3c195e838ef81a36c1434fa7395c.dll2⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/684-60-0x000007FEFB9F1000-0x000007FEFB9F3000-memory.dmpFilesize
8KB
-
memory/1368-65-0x0000000000000000-mapping.dmp
-
memory/1368-67-0x00000000000D0000-0x00000000000F6000-memory.dmpFilesize
152KB
-
memory/1520-61-0x0000000000000000-mapping.dmp
-
memory/1520-62-0x0000000075C71000-0x0000000075C73000-memory.dmpFilesize
8KB
-
memory/1520-63-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/1520-64-0x0000000010000000-0x0000000010155000-memory.dmpFilesize
1.3MB