Analysis
-
max time kernel
188s -
max time network
188s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
03-11-2021 17:08
Static task
static1
Behavioral task
behavioral1
Sample
SophosAmsiProvider.dll
Resource
win7-en-20210920
General
-
Target
SophosAmsiProvider.dll
-
Size
432KB
-
MD5
2b3251fe929788b34fd4af2b12c0ca09
-
SHA1
c58283831eb0d495b42236ff1ee59b05d6101873
-
SHA256
eecf912bfb121a06499dd43e8f62381d18a8b9efdc9e57aa2ae3d355cb28794e
-
SHA512
dd202ac9207c9e481911f29892c7fab12dc394349c51b318ab436d93c57f3217b3f52ba5bbc5fe0722bb5375fdd379810baaee334cc21cd34e7c09f357bfc386
Malware Config
Extracted
zloader
vasja
vasja
https://iqowijsdakm.com/gate.php
https://wiewjdmkfjn.com/gate.php
https://dksaoidiakjd.com/gate.php
https://iweuiqjdakjd.com/gate.php
https://yuidskadjna.com/gate.php
https://olksmadnbdj.com/gate.php
https://odsakmdfnbs.com/gate.php
https://odsakjmdnhsaj.com/gate.php
https://odjdnhsaj.com/gate.php
https://odoishsaj.com/gate.php
-
build_id
157
Signatures
-
Blocklisted process makes network request 6 IoCs
Processes:
msiexec.exeflow pid process 34 2656 msiexec.exe 36 2656 msiexec.exe 38 2656 msiexec.exe 43 2656 msiexec.exe 45 2656 msiexec.exe 47 2656 msiexec.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\Kosyqiw = "regsvr32.exe /s C:\\Users\\Admin\\AppData\\Roaming\\Ohky\\haokig.dll" msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
regsvr32.exedescription pid process target process PID 2724 set thread context of 2656 2724 regsvr32.exe msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 2656 msiexec.exe Token: SeSecurityPrivilege 2656 msiexec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 2704 wrote to memory of 2724 2704 regsvr32.exe regsvr32.exe PID 2704 wrote to memory of 2724 2704 regsvr32.exe regsvr32.exe PID 2704 wrote to memory of 2724 2704 regsvr32.exe regsvr32.exe PID 2724 wrote to memory of 2656 2724 regsvr32.exe msiexec.exe PID 2724 wrote to memory of 2656 2724 regsvr32.exe msiexec.exe PID 2724 wrote to memory of 2656 2724 regsvr32.exe msiexec.exe PID 2724 wrote to memory of 2656 2724 regsvr32.exe msiexec.exe PID 2724 wrote to memory of 2656 2724 regsvr32.exe msiexec.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\SophosAmsiProvider.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\SophosAmsiProvider.dll2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Blocklisted process makes network request
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2656-118-0x0000000000D50000-0x0000000000D76000-memory.dmpFilesize
152KB
-
memory/2656-119-0x0000000000000000-mapping.dmp
-
memory/2656-120-0x0000000000C60000-0x0000000000C61000-memory.dmpFilesize
4KB
-
memory/2656-121-0x0000000000C60000-0x0000000000C61000-memory.dmpFilesize
4KB
-
memory/2656-122-0x0000000000D50000-0x0000000000D76000-memory.dmpFilesize
152KB
-
memory/2724-115-0x0000000000000000-mapping.dmp
-
memory/2724-116-0x0000000002FD0000-0x0000000002FD1000-memory.dmpFilesize
4KB
-
memory/2724-117-0x0000000010000000-0x0000000010081000-memory.dmpFilesize
516KB