Analysis
-
max time kernel
64s -
max time network
181s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
16-09-2021 04:42
Static task
static1
Behavioral task
behavioral1
Sample
c75f4e1fd464e21826c37e5abf7fed93b48c721625f700f49aa71cbce377ee8a.exe.dll
Resource
win7v20210408
General
-
Target
c75f4e1fd464e21826c37e5abf7fed93b48c721625f700f49aa71cbce377ee8a.exe.dll
-
Size
409KB
-
MD5
56079ea11cb3fce2a34fdf0a81deecc5
-
SHA1
38475dc6871d88b3c9070f4e55f8c44a07b7dca3
-
SHA256
c75f4e1fd464e21826c37e5abf7fed93b48c721625f700f49aa71cbce377ee8a
-
SHA512
62881541d2f549475cb3a2026c1f53b2704834a5b5b2af154135b328347de690a4e4b23f047db85745a4b106b7ba541a854f91e0a8ff21255cb5df47aeda4e50
Malware Config
Extracted
zloader
hvnc
hvnc
https://iqowijsdakm.com/gate.php
https://wiewjdmkfjn.com/gate.php
https://dksaoidiakjd.com/gate.php
https://iweuiqjdakjd.com/gate.php
https://yuidskadjna.com/gate.php
https://olksmadnbdj.com/gate.php
https://odsakmdfnbs.com/gate.php
https://odsakjmdnhsaj.com/gate.php
https://odjdnhsaj.com/gate.php
https://odoishsaj.com/gate.php
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1860 wrote to memory of 1996 1860 regsvr32.exe regsvr32.exe PID 1860 wrote to memory of 1996 1860 regsvr32.exe regsvr32.exe PID 1860 wrote to memory of 1996 1860 regsvr32.exe regsvr32.exe PID 1860 wrote to memory of 1996 1860 regsvr32.exe regsvr32.exe PID 1860 wrote to memory of 1996 1860 regsvr32.exe regsvr32.exe PID 1860 wrote to memory of 1996 1860 regsvr32.exe regsvr32.exe PID 1860 wrote to memory of 1996 1860 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\c75f4e1fd464e21826c37e5abf7fed93b48c721625f700f49aa71cbce377ee8a.exe.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\c75f4e1fd464e21826c37e5abf7fed93b48c721625f700f49aa71cbce377ee8a.exe.dll2⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/852-65-0x0000000000000000-mapping.dmp
-
memory/852-67-0x0000000000090000-0x00000000000B6000-memory.dmpFilesize
152KB
-
memory/1860-60-0x000007FEFC2E1000-0x000007FEFC2E3000-memory.dmpFilesize
8KB
-
memory/1996-61-0x0000000000000000-mapping.dmp
-
memory/1996-62-0x0000000075B31000-0x0000000075B33000-memory.dmpFilesize
8KB
-
memory/1996-63-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/1996-64-0x0000000010000000-0x00000000100DB000-memory.dmpFilesize
876KB