Overview

overview

10

Static

static

ycof.exe.dll

windows10_x64

10

Resubmissions

10-08-2023 17:03

230810-vktf5ahb8w 8

10-08-2023 16:18

230810-tsd6qseh75 5

12-10-2021 18:50

211012-xg8gzschfq 10

12-10-2021 18:01

211012-wl6zaacffq 10

06-10-2021 20:46

211006-zkl49sbhbq 10

05-10-2021 18:43

211005-xde19sacb2 10

04-10-2021 21:53

211004-1rxd9ahae5 1

Analysis

  • max time kernel
    1200s
  • max time network
    872s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    05-10-2021 18:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ycof.exe.dll

  • Size

    1.1MB

  • MD5

    54a3bcca6b1eb92adb299a46df941826

  • SHA1

    6988e010056d88985b8e8f8de06706327779d3ca

  • SHA256

    c4ab81d7b7d44dd6dfc4f2b69dbe3f22fbf23c1ae49ab8edac2d26f85ae4514d

  • SHA512

    4e4f10abf8a97f649060cb3eaa125a487141a42b87d2dc1449d87531d927031279bd7b48a3859ffa8f5d4400deea77022ecb00c61de8511756dc9c0d27e3f150

Score
10/10
zloader123123botnetpersistencetrojan

Malware Config

Extracted

Family

zloader

Botnet

123

Campaign

123

C2

http://gipc.in/post.php

http://fbhindia.com/post.php

http://ecolenefiber.com/post.php

http://design.ecolenefiber.com/post.php

http://beta.marlics.ir/post.php

http://hari.pk/post.php

http://iaiskjmalang.ac.id/post.php

http://314xd.com/post.php

http://ejournal.iaiskjmalang.ac.id/post.php

http://duanvn.com/post.php
rc4.plain
rsa_pubkey.plain

Signatures

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

    trojanbotnetzloader
  • Blocklisted process makes network request 26 IoCs
  • Modifies Installed Components in the registry 2 TTPs
    persistence
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 5 IoCs
  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Discovers systems in the same network 1 TTPs 2 IoCs
    discovery
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies registry class 29 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 44 IoCs
  • Suspicious use of SendNotifyMessage 23 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3008
      • C:\Windows\system32\rundll32.exe
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\ycof.exe.dll,#1
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2160
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe C:\Users\Admin\AppData\Local\Temp\ycof.exe.dll,#1
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2356
          • C:\Windows\SysWOW64\msiexec.exe
            msiexec.exe
            4⤵
            • Blocklisted process makes network request
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1576
            • C:\Windows\SysWOW64\ipconfig.exe
              ipconfig /all
              5⤵
              • Gathers network information
              PID:1160
            • C:\Windows\SysWOW64\net.exe
              net config workstation
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:1236
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 config workstation
                6⤵
                  PID:752
              • C:\Windows\SysWOW64\net.exe
                net view /all
                5⤵
                • Discovers systems in the same network
                PID:1528
              • C:\Windows\SysWOW64\net.exe
                net view /all /domain
                5⤵
                • Discovers systems in the same network
                PID:3404
              • C:\Windows\SYSTEM32\nltest.exe
                nltest /domain_trusts
                5⤵
                  PID:3672
                • C:\Windows\SYSTEM32\nltest.exe
                  nltest /domain_trusts /all_trusts
                  5⤵
                    PID:2868
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -u -p 3008 -s 2608
              2⤵
              • Suspicious use of NtCreateProcessExOtherParentProcess
              • Program crash
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3796
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Enumerates connected drives
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:3780
          • C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
            "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
            1⤵
            • Drops file in Windows directory
            • Suspicious use of SetWindowsHookEx
            PID:4068
          • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
            1⤵
            • Drops file in Windows directory
            • Enumerates system info in registry
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:968

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Initial Access

          Execution

          Command-Line Interface

          1
          T1059

          Persistence

          Registry Run Keys / Startup Folder

          1
          T1060

          Privilege Escalation

          Defense Evasion

          Modify Registry

          1
          T1112

          Credential Access

          Discovery

          Query Registry

          3
          T1012

          Peripheral Device Discovery

          2
          T1120

          System Information Discovery

          4
          T1082

          Remote System Discovery

          1
          T1018

          Lateral Movement

          Collection

          Exfiltration

          Command and Control

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Roaming\ghjg\pvsu
            MD5

            77f747759afbae759f993909720c5b5d

            SHA1

            99e3e131e551b39f7f7e82bf444bd95ac712978c

            SHA256

            b210b0e728f9f178028e512f3a2f8c816628e002031bb6a5e47d98b7fd0d810c

            SHA512

            f1263628e3b545030a6a2e2c433474744065fc0416c2cbd01aa875fdf13e4672a368fb0affbfbc8dacd67933d25567ebbad106ba690ec16fc03c602ddabfc290

            Download Submit
          • memory/752-127-0x0000000000000000-mapping.dmp
            Download
          • memory/1160-124-0x0000000000000000-mapping.dmp
            Download
          • memory/1236-125-0x0000000000000000-mapping.dmp
            Download
          • memory/1528-128-0x0000000000000000-mapping.dmp
            Download
          • memory/1576-119-0x0000000000000000-mapping.dmp
            Download
          • memory/1576-122-0x0000000000660000-0x000000000068A000-memory.dmp
            Filesize

            168KB

            Download
          • memory/1576-126-0x0000000004F30000-0x0000000004F33000-memory.dmp
            Filesize

            12KB

            Download
          • memory/1576-123-0x0000000001320000-0x0000000001360000-memory.dmp
            Filesize

            256KB

            Download
          • memory/2356-115-0x0000000000000000-mapping.dmp
            Download
          • memory/2356-118-0x0000000000DC0000-0x0000000000DC1000-memory.dmp
            Filesize

            4KB

            Download
          • memory/2356-117-0x00000000739E0000-0x0000000074416000-memory.dmp
            Filesize

            10.2MB

            Download
          • memory/2356-116-0x00000000739E0000-0x0000000073A0A000-memory.dmp
            Filesize

            168KB

            Download
          • memory/2868-131-0x0000000000000000-mapping.dmp
            Download
          • memory/3008-132-0x00000000010D0000-0x0000000001106000-memory.dmp
            Filesize

            216KB

            Download
          • memory/3404-129-0x0000000000000000-mapping.dmp
            Download
          • memory/3672-130-0x0000000000000000-mapping.dmp
            Download
          • memory/3780-133-0x0000000002A80000-0x0000000002A81000-memory.dmp
            Filesize

            4KB

            Download
          • memory/3780-134-0x0000000004520000-0x0000000004556000-memory.dmp
            Filesize

            216KB

            Download