Overview

overview

10

Static

static

phiasko.bat

windows10_x64

10

Analysis

  • max time kernel
    600s
  • max time network
    430s
  • platform
    windows10_x64
  • resource
    win10-ja-20210920
  • submitted
    04-10-2021 22:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    phiasko.bat

  • Size

    58B

  • MD5

    be4bfd95cabbf2a7b68530e629645282

  • SHA1

    e394c4eea18ee4016c1b43111760fe041f0ab14f

  • SHA256

    ab443b30acfb9fe983f631a79d4c6fc481208b98cef934cfc91e6f83bba1c52d

  • SHA512

    c6e7316671e5cd053adca5cd779a90149ed375321e2cab7d63657f308c41a8cbda42c8009da08cea519da72df34400813d5c1a0bd3f923510b632adc09793dcc

Score
10/10
zloader123123botnetpersistencetrojan

Malware Config

Extracted

Family

zloader

Botnet

123

Campaign

123

C2

http://gipc.in/post.php

http://fbhindia.com/post.php

http://ecolenefiber.com/post.php

http://design.ecolenefiber.com/post.php

http://beta.marlics.ir/post.php

http://hari.pk/post.php

http://iaiskjmalang.ac.id/post.php

http://314xd.com/post.php

http://ejournal.iaiskjmalang.ac.id/post.php

http://duanvn.com/post.php
rc4.plain
rsa_pubkey.plain

Signatures

  • Registers COM server for autorun 1 TTPs
    persistence
  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

    trojanbotnetzloader
  • Blocklisted process makes network request 23 IoCs
  • Modifies Installed Components in the registry 2 TTPs
    persistence
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 12 IoCs
  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Discovers systems in the same network 1 TTPs 2 IoCs
    discovery
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 48 IoCs
  • Suspicious use of SendNotifyMessage 31 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:2360
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\phiasko.bat"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3252
        • C:\Windows\system32\rundll32.exe
          rundll32.exe C:\Users\Admin\AppData\Local\Temp\z.dll,asd
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3848
          • C:\Windows\SysWOW64\rundll32.exe
            rundll32.exe C:\Users\Admin\AppData\Local\Temp\z.dll,asd
            4⤵
            • Suspicious use of SetThreadContext
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3108
            • C:\Windows\SysWOW64\msiexec.exe
              msiexec.exe
              5⤵
              • Blocklisted process makes network request
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:4500
              • C:\Windows\SysWOW64\ipconfig.exe
                ipconfig /all
                6⤵
                • Gathers network information
                PID:5024
              • C:\Windows\SysWOW64\net.exe
                net config workstation
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:4988
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 config workstation
                  7⤵
                    PID:3900
                • C:\Windows\SysWOW64\net.exe
                  net view /all
                  6⤵
                  • Discovers systems in the same network
                  PID:5116
                • C:\Windows\SysWOW64\net.exe
                  net view /all /domain
                  6⤵
                  • Discovers systems in the same network
                  PID:4228
                • C:\Windows\SYSTEM32\nltest.exe
                  nltest /domain_trusts
                  6⤵
                    PID:716
                  • C:\Windows\SYSTEM32\nltest.exe
                    nltest /domain_trusts /all_trusts
                    6⤵
                      PID:2896
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -u -p 2360 -s 3232
              2⤵
              • Suspicious use of NtCreateProcessExOtherParentProcess
              • Program crash
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2232
          • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.170.0822.0002\FileSyncConfig.exe
            "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.170.0822.0002\FileSyncConfig.exe"
            1⤵
            • Modifies registry class
            PID:3604
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Enumerates connected drives
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:3420
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /q /c del /q "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe"
              2⤵
                PID:4276
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /q /c del /q "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe"
                2⤵
                  PID:2208
              • C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
                "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
                1⤵
                • Drops file in Windows directory
                • Suspicious use of SetWindowsHookEx
                PID:4736
              • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
                1⤵
                • Drops file in Windows directory
                • Enumerates system info in registry
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:1608
              • C:\Windows\System32\IME\SHARED\imebroker.exe
                C:\Windows\System32\IME\SHARED\imebroker.exe -Embedding
                1⤵
                  PID:4348

                Network

                MITRE ATT&CK Matrix ATT&CK v6

                Initial Access

                Execution

                Command-Line Interface

                1
                T1059

                Persistence

                Registry Run Keys / Startup Folder

                2
                T1060

                Privilege Escalation

                Defense Evasion

                Modify Registry

                1
                T1112

                Credential Access

                Discovery

                Query Registry

                3
                T1012

                Peripheral Device Discovery

                2
                T1120

                System Information Discovery

                4
                T1082

                Remote System Discovery

                1
                T1018

                Lateral Movement

                Collection

                Exfiltration

                Command and Control

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Roaming\ghjg\pvsu
                  MD5

                  df514f2d9728a01bb6bd4d468a626857

                  SHA1

                  f42836fc99f33ced20fc0b8ba45d49e9bb0390e7

                  SHA256

                  cd28eae772073c69a7f532dbc9e8aaa1004ebb9fcfdbce0e9910592b1fac70b6

                  SHA512

                  6c708a277fc3d6f9d36a482505e81d5e0fcd9fe939a3f04a9771fc4ca95243afa4826a7bfa9ae2ff4ac4c3592b2125e29a418d9ac4eb7f0b20c6f61ddf3e92ab

                  Download Submit
                • memory/716-131-0x0000000000000000-mapping.dmp
                  Download
                • memory/2208-136-0x0000000000000000-mapping.dmp
                  Download
                • memory/2360-133-0x0000000001080000-0x00000000010B6000-memory.dmp
                  Filesize

                  216KB

                  Download
                • memory/2896-132-0x0000000000000000-mapping.dmp
                  Download
                • memory/3108-116-0x0000000000000000-mapping.dmp
                  Download
                • memory/3108-117-0x0000000072D90000-0x0000000072DBA000-memory.dmp
                  Filesize

                  168KB

                  Download
                • memory/3108-118-0x0000000072D90000-0x00000000737C6000-memory.dmp
                  Filesize

                  10.2MB

                  Download
                • memory/3108-119-0x0000000003450000-0x0000000003451000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/3420-137-0x00000000047C0000-0x00000000047F6000-memory.dmp
                  Filesize

                  216KB

                  Download
                • memory/3420-134-0x00000000023D0000-0x00000000023D1000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/3848-115-0x0000000000000000-mapping.dmp
                  Download
                • memory/3900-127-0x0000000000000000-mapping.dmp
                  Download
                • memory/4228-130-0x0000000000000000-mapping.dmp
                  Download
                • memory/4276-135-0x0000000000000000-mapping.dmp
                  Download
                • memory/4500-129-0x00000000010F0000-0x00000000010F3000-memory.dmp
                  Filesize

                  12KB

                  Download
                • memory/4500-124-0x0000000004AE0000-0x0000000004B20000-memory.dmp
                  Filesize

                  256KB

                  Download
                • memory/4500-123-0x0000000000410000-0x000000000043A000-memory.dmp
                  Filesize

                  168KB

                  Download
                • memory/4500-120-0x0000000000000000-mapping.dmp
                  Download
                • memory/4988-126-0x0000000000000000-mapping.dmp
                  Download
                • memory/5024-125-0x0000000000000000-mapping.dmp
                  Download
                • memory/5116-128-0x0000000000000000-mapping.dmp
                  Download