Resubmissions
04-11-2021 14:56
211104-sa37gaghb3 1026-10-2021 13:37
211026-qwzp3ahfb2 1021-10-2021 22:13
211021-143rssbgdj 10Analysis
-
max time kernel
42s -
max time network
152s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
21-10-2021 22:13
Static task
static1
Behavioral task
behavioral1
Sample
95a8370c36d81ea596d83892115ce6b90717396c8f657b17696c7eeb2dba1d2e.dll
Resource
win7-en-20211014
General
-
Target
95a8370c36d81ea596d83892115ce6b90717396c8f657b17696c7eeb2dba1d2e.dll
-
Size
429KB
-
MD5
75784d297b3d6fb4d434b6890f6334ab
-
SHA1
dc945e57be6bdd3cc4894d6cff7dd90a76f6c416
-
SHA256
95a8370c36d81ea596d83892115ce6b90717396c8f657b17696c7eeb2dba1d2e
-
SHA512
f54baffc5b545aaa4d939505181466d7b78bb583fd32da6cbf8cea058fca8869e8bf7bf3272f43d09a7b24dc6e821c9aa0e3875dd2959173e704d57568915fa1
Malware Config
Extracted
zloader
tim
tim
https://iqowijsdakm.com/gate.php
https://wiewjdmkfjn.com/gate.php
https://dksaoidiakjd.com/gate.php
https://iweuiqjdakjd.com/gate.php
https://yuidskadjna.com/gate.php
https://olksmadnbdj.com/gate.php
https://odsakmdfnbs.com/gate.php
https://odsakjmdnhsaj.com/gate.php
https://odjdnhsaj.com/gate.php
https://odoishsaj.com/gate.php
Signatures
-
suricata: ET MALWARE Observed ZLoader CnC Domain in SNI
suricata: ET MALWARE Observed ZLoader CnC Domain in SNI
-
Drops file in Windows directory 1 IoCs
Processes:
regsvr32.exedescription ioc process File opened for modification C:\Windows\ regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 672 wrote to memory of 1424 672 regsvr32.exe regsvr32.exe PID 672 wrote to memory of 1424 672 regsvr32.exe regsvr32.exe PID 672 wrote to memory of 1424 672 regsvr32.exe regsvr32.exe PID 672 wrote to memory of 1424 672 regsvr32.exe regsvr32.exe PID 672 wrote to memory of 1424 672 regsvr32.exe regsvr32.exe PID 672 wrote to memory of 1424 672 regsvr32.exe regsvr32.exe PID 672 wrote to memory of 1424 672 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\95a8370c36d81ea596d83892115ce6b90717396c8f657b17696c7eeb2dba1d2e.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\95a8370c36d81ea596d83892115ce6b90717396c8f657b17696c7eeb2dba1d2e.dll2⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/672-55-0x000007FEFB7E1000-0x000007FEFB7E3000-memory.dmpFilesize
8KB
-
memory/832-61-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/832-60-0x0000000000090000-0x00000000000B6000-memory.dmpFilesize
152KB
-
memory/832-62-0x0000000000090000-0x00000000000B6000-memory.dmpFilesize
152KB
-
memory/832-63-0x0000000000000000-mapping.dmp
-
memory/832-65-0x0000000000090000-0x00000000000B6000-memory.dmpFilesize
152KB
-
memory/1424-56-0x0000000000000000-mapping.dmp
-
memory/1424-57-0x0000000075AC1000-0x0000000075AC3000-memory.dmpFilesize
8KB
-
memory/1424-58-0x0000000000100000-0x0000000000101000-memory.dmpFilesize
4KB
-
memory/1424-59-0x0000000010000000-0x0000000010072000-memory.dmpFilesize
456KB