Analysis
-
max time kernel
66s -
max time network
150s -
platform
windows10_x64 -
resource
win10-en -
submitted
16-09-2021 03:49
Static task
static1
Behavioral task
behavioral1
Sample
78c6567201eeeaa1a359ab8929325de30abf18c22993de371a08b7c9bc0af04c.dll
Resource
win7v20210408
General
-
Target
78c6567201eeeaa1a359ab8929325de30abf18c22993de371a08b7c9bc0af04c.dll
-
Size
488KB
-
MD5
273401fff3380e8d51c17474b073460a
-
SHA1
7ad45180f20469040a3dabf8473d6f03e8c55383
-
SHA256
78c6567201eeeaa1a359ab8929325de30abf18c22993de371a08b7c9bc0af04c
-
SHA512
1dd6ea8902a5ec10276509a4c7481ae742e5f3f0a7d655a6af4cd5397b351dbd26de18f43aa5bdceb64bf0ca3a335ed1481222317a07e6711381a50f67642ba7
Malware Config
Extracted
zloader
vasja
vasja
https://iqowijsdakm.com/gate.php
https://wiewjdmkfjn.com/gate.php
https://dksaoidiakjd.com/gate.php
https://iweuiqjdakjd.com/gate.php
https://yuidskadjna.com/gate.php
https://olksmadnbdj.com/gate.php
https://odsakmdfnbs.com/gate.php
https://odsakjmdnhsaj.com/gate.php
https://odjdnhsaj.com/gate.php
https://odoishsaj.com/gate.php
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
regsvr32.exedescription pid process target process PID 4076 wrote to memory of 596 4076 regsvr32.exe regsvr32.exe PID 4076 wrote to memory of 596 4076 regsvr32.exe regsvr32.exe PID 4076 wrote to memory of 596 4076 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\78c6567201eeeaa1a359ab8929325de30abf18c22993de371a08b7c9bc0af04c.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\78c6567201eeeaa1a359ab8929325de30abf18c22993de371a08b7c9bc0af04c.dll2⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/596-115-0x0000000000000000-mapping.dmp
-
memory/596-116-0x0000000003280000-0x0000000003281000-memory.dmpFilesize
4KB
-
memory/596-117-0x0000000010000000-0x000000001016A000-memory.dmpFilesize
1.4MB
-
memory/2372-118-0x0000000000000000-mapping.dmp
-
memory/2372-121-0x00000000004B0000-0x00000000004D6000-memory.dmpFilesize
152KB