Resubmissions
05-11-2021 10:01
211105-l2l9psgebn 1012-10-2021 18:42
211012-xcg48sdbb9 1012-10-2021 18:06
211012-wpvenachc6 1012-10-2021 17:54
211012-wg5knachb5 1007-10-2021 08:47
211007-kpvvmscchl 10Analysis
-
max time kernel
147s -
max time network
147s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
12-10-2021 18:06
Static task
static1
Behavioral task
behavioral1
Sample
b270e245132cf6624fc96642532a00c0a16681f59542220ad2c389d45865141f.dll
Resource
win7-en-20210920
General
-
Target
b270e245132cf6624fc96642532a00c0a16681f59542220ad2c389d45865141f.dll
-
Size
298KB
-
MD5
a80859c1cd44daad1450948a1276bc0d
-
SHA1
46396892b9cafb2e59b8f667ec7822d0435384bb
-
SHA256
b270e245132cf6624fc96642532a00c0a16681f59542220ad2c389d45865141f
-
SHA512
ce68470318b8472b30aeee8778802ca4c9175f075a9c19c8332a08a6a8518a2f157a9e2ccaedba1d42f83f591d3c5f233ee1b8b8fbb90589aae82c9dea68352c
Malware Config
Extracted
zloader
nut
22/03
https://svilapp.svgipsar.org/post.php
https://nadar-gis.com/post.php
https://crearqarquitectos.com/post.php
https://crown-sign.com/post.php
https://dainikjahan.com/post.php
https://denatureedutech.com/post.php
https://alekllemtilaro.tk/post.php
Signatures
-
Blocklisted process makes network request 42 IoCs
Processes:
msiexec.exeflow pid process 5 532 msiexec.exe 6 532 msiexec.exe 7 532 msiexec.exe 8 532 msiexec.exe 9 532 msiexec.exe 10 532 msiexec.exe 11 532 msiexec.exe 12 532 msiexec.exe 13 532 msiexec.exe 14 532 msiexec.exe 15 532 msiexec.exe 16 532 msiexec.exe 17 532 msiexec.exe 18 532 msiexec.exe 19 532 msiexec.exe 20 532 msiexec.exe 21 532 msiexec.exe 22 532 msiexec.exe 23 532 msiexec.exe 24 532 msiexec.exe 25 532 msiexec.exe 27 532 msiexec.exe 28 532 msiexec.exe 29 532 msiexec.exe 31 532 msiexec.exe 33 532 msiexec.exe 35 532 msiexec.exe 36 532 msiexec.exe 37 532 msiexec.exe 38 532 msiexec.exe 39 532 msiexec.exe 40 532 msiexec.exe 41 532 msiexec.exe 42 532 msiexec.exe 43 532 msiexec.exe 44 532 msiexec.exe 45 532 msiexec.exe 46 532 msiexec.exe 47 532 msiexec.exe 48 532 msiexec.exe 49 532 msiexec.exe 50 532 msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 1480 set thread context of 532 1480 rundll32.exe msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 532 msiexec.exe Token: SeSecurityPrivilege 532 msiexec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1112 wrote to memory of 1480 1112 rundll32.exe rundll32.exe PID 1112 wrote to memory of 1480 1112 rundll32.exe rundll32.exe PID 1112 wrote to memory of 1480 1112 rundll32.exe rundll32.exe PID 1112 wrote to memory of 1480 1112 rundll32.exe rundll32.exe PID 1112 wrote to memory of 1480 1112 rundll32.exe rundll32.exe PID 1112 wrote to memory of 1480 1112 rundll32.exe rundll32.exe PID 1112 wrote to memory of 1480 1112 rundll32.exe rundll32.exe PID 1480 wrote to memory of 532 1480 rundll32.exe msiexec.exe PID 1480 wrote to memory of 532 1480 rundll32.exe msiexec.exe PID 1480 wrote to memory of 532 1480 rundll32.exe msiexec.exe PID 1480 wrote to memory of 532 1480 rundll32.exe msiexec.exe PID 1480 wrote to memory of 532 1480 rundll32.exe msiexec.exe PID 1480 wrote to memory of 532 1480 rundll32.exe msiexec.exe PID 1480 wrote to memory of 532 1480 rundll32.exe msiexec.exe PID 1480 wrote to memory of 532 1480 rundll32.exe msiexec.exe PID 1480 wrote to memory of 532 1480 rundll32.exe msiexec.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b270e245132cf6624fc96642532a00c0a16681f59542220ad2c389d45865141f.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b270e245132cf6624fc96642532a00c0a16681f59542220ad2c389d45865141f.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/532-58-0x00000000000D0000-0x00000000000FB000-memory.dmpFilesize
172KB
-
memory/532-59-0x0000000000100000-0x0000000000101000-memory.dmpFilesize
4KB
-
memory/532-60-0x00000000000D0000-0x00000000000FB000-memory.dmpFilesize
172KB
-
memory/532-61-0x0000000000000000-mapping.dmp
-
memory/532-63-0x00000000000D0000-0x00000000000FB000-memory.dmpFilesize
172KB
-
memory/1480-53-0x0000000000000000-mapping.dmp
-
memory/1480-54-0x0000000075871000-0x0000000075873000-memory.dmpFilesize
8KB
-
memory/1480-55-0x00000000743F0000-0x000000007441B000-memory.dmpFilesize
172KB
-
memory/1480-57-0x00000000001A0000-0x00000000001A1000-memory.dmpFilesize
4KB
-
memory/1480-56-0x00000000743F0000-0x0000000074495000-memory.dmpFilesize
660KB