Analysis
-
max time kernel
146s -
max time network
130s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
04-10-2021 11:45
Static task
static1
Behavioral task
behavioral1
Sample
3648fe001994cb9c0a6b510213c268a6bd4761a3a99f3abb2738bf84f06d11cf.dll
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
General
-
Target
3648fe001994cb9c0a6b510213c268a6bd4761a3a99f3abb2738bf84f06d11cf.dll
-
Size
512KB
-
MD5
fa9b3dfdb4b97dfe0db5991472f89399
-
SHA1
5677f26e926c8c8d7f7bf7eb085a9e48549a268b
-
SHA256
3648fe001994cb9c0a6b510213c268a6bd4761a3a99f3abb2738bf84f06d11cf
-
SHA512
e5ac96e3ef6ee9fa110b433c1c49a7f16f4ba6694ec76e10d31848ecd4f284b6845508979758a16121a63d6c4a1af2103268d6e03fbb1c6672005090d560cc74
Malware Config
Extracted
Family
zloader
Botnet
miguel
Campaign
20/04
C2
https://dcaiqjgnbt.icu/wp-config.php
https://nmttxggtb.press/wp-config.php
rc4.plain
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 1056 set thread context of 756 1056 rundll32.exe msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 756 msiexec.exe Token: SeSecurityPrivilege 756 msiexec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1116 wrote to memory of 1056 1116 rundll32.exe rundll32.exe PID 1116 wrote to memory of 1056 1116 rundll32.exe rundll32.exe PID 1116 wrote to memory of 1056 1116 rundll32.exe rundll32.exe PID 1116 wrote to memory of 1056 1116 rundll32.exe rundll32.exe PID 1116 wrote to memory of 1056 1116 rundll32.exe rundll32.exe PID 1116 wrote to memory of 1056 1116 rundll32.exe rundll32.exe PID 1116 wrote to memory of 1056 1116 rundll32.exe rundll32.exe PID 1056 wrote to memory of 756 1056 rundll32.exe msiexec.exe PID 1056 wrote to memory of 756 1056 rundll32.exe msiexec.exe PID 1056 wrote to memory of 756 1056 rundll32.exe msiexec.exe PID 1056 wrote to memory of 756 1056 rundll32.exe msiexec.exe PID 1056 wrote to memory of 756 1056 rundll32.exe msiexec.exe PID 1056 wrote to memory of 756 1056 rundll32.exe msiexec.exe PID 1056 wrote to memory of 756 1056 rundll32.exe msiexec.exe PID 1056 wrote to memory of 756 1056 rundll32.exe msiexec.exe PID 1056 wrote to memory of 756 1056 rundll32.exe msiexec.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3648fe001994cb9c0a6b510213c268a6bd4761a3a99f3abb2738bf84f06d11cf.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3648fe001994cb9c0a6b510213c268a6bd4761a3a99f3abb2738bf84f06d11cf.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/756-58-0x0000000000000000-mapping.dmp
-
memory/756-60-0x0000000000090000-0x00000000000C4000-memory.dmpFilesize
208KB
-
memory/1056-53-0x0000000000000000-mapping.dmp
-
memory/1056-54-0x0000000075951000-0x0000000075953000-memory.dmpFilesize
8KB
-
memory/1056-55-0x0000000000660000-0x00000000006F8000-memory.dmpFilesize
608KB
-
memory/1056-56-0x0000000000660000-0x0000000000694000-memory.dmpFilesize
208KB
-
memory/1056-57-0x0000000000160000-0x0000000000161000-memory.dmpFilesize
4KB