Resubmissions
13-12-2021 06:06
211213-gtrr1aedfl 10Analysis
-
max time kernel
48s -
max time network
149s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
13-12-2021 06:06
Static task
static1
Behavioral task
behavioral1
Sample
zoom.dll
Resource
win7-en-20211208
General
-
Target
zoom.dll
-
Size
1.9MB
-
MD5
5c800787795e40e3fff0943da96cae96
-
SHA1
73d6def3ef92f5fc4f009d96e90e74f437516d4c
-
SHA256
ec14675d4244fb42882f9bcff11c7edbf7c7b7c9dd9ba7577d0164c307ab467b
-
SHA512
f1ea34c6677f06f2ceb7787890532cafe66ed0f31413afe8ded1f9abb900f028c9c16c08a083cad863936b133d96d2668d51558ed3f8babed7718d09d6f886d1
Malware Config
Extracted
zloader
9092ti
9092ti
https://asdfghdsajkl.com/gate.php
https://lkjhgfgsdshja.com/gate.php
https://kjdhsasghjds.com/gate.php
https://kdjwhqejqwij.com/gate.php
https://iasudjghnasd.com/gate.php
https://daksjuggdhwa.com/gate.php
https://dkisuaggdjhna.com/gate.php
https://eiqwuggejqw.com/gate.php
https://dquggwjhdmq.com/gate.php
https://djshggadasj.com/gate.php
-
build_id
157
Extracted
zloader
personal
personal
https://iqowijsdakm.com/gate.php
https://wiewjdmkfjn.com/gate.php
https://dksaoidiakjd.com/gate.php
https://iweuiqjdakjd.com/gate.php
https://yuidskadjna.com/gate.php
https://olksmadnbdj.com/gate.php
https://odsakmdfnbs.com/gate.php
https://odsakjmdnhsaj.com/gate.php
https://odjdnhsaj.com/gate.php
https://odoishsaj.com/gate.php
-
build_id
157
Signatures
-
Discovers systems in the same network 1 TTPs 2 IoCs
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 1120 ipconfig.exe -
Runs net.exe
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
regsvr32.exedescription pid process target process PID 2836 wrote to memory of 2588 2836 regsvr32.exe regsvr32.exe PID 2836 wrote to memory of 2588 2836 regsvr32.exe regsvr32.exe PID 2836 wrote to memory of 2588 2836 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\zoom.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\zoom.dll2⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ipconfig /all4⤵
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all5⤵
- Gathers network information
-
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net config workstation4⤵
-
C:\Windows\SysWOW64\net.exenet config workstation5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 config workstation6⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net view /all4⤵
-
C:\Windows\SysWOW64\net.exenet view /all5⤵
- Discovers systems in the same network
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net view /all /domain4⤵
-
C:\Windows\SysWOW64\net.exenet view /all /domain5⤵
- Discovers systems in the same network
-
C:\Users\Admin\AppData\Local\Temp\Duemsy\certutil.exe"C:\Users\Admin\AppData\Local\Temp\Duemsy\certutil.exe" -A -n "ycto" -t "C,C,C" -i "C:\Users\Admin\AppData\Local\Temp\etodigy.crt" -d sql:"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ceywcwgd.default-release"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Duemsy\MSVCR100.dllMD5
0e37fbfa79d349d672456923ec5fbbe3
SHA14e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA2568793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
SHA5122bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
-
C:\Users\Admin\AppData\Local\Temp\Duemsy\certutil.exeMD5
0c6b43c9602f4d5ac9dcf907103447c4
SHA17a77c7ae99d400243845cce0e0931f029a73f79a
SHA2565950722034c8505daa9b359127feb707f16c37d2f69e79d16ee6d9ec37690478
SHA512b21b34a5886a3058ce26a6a5a6ead3b1ebae62354540492fb6508be869e7d292b351c0913461b47c4cc0c6a73333aad33cd9399bcb1f83c7dacfdb7f2ee1f7a9
-
C:\Users\Admin\AppData\Local\Temp\Duemsy\certutil.exeMD5
0c6b43c9602f4d5ac9dcf907103447c4
SHA17a77c7ae99d400243845cce0e0931f029a73f79a
SHA2565950722034c8505daa9b359127feb707f16c37d2f69e79d16ee6d9ec37690478
SHA512b21b34a5886a3058ce26a6a5a6ead3b1ebae62354540492fb6508be869e7d292b351c0913461b47c4cc0c6a73333aad33cd9399bcb1f83c7dacfdb7f2ee1f7a9
-
C:\Users\Admin\AppData\Local\Temp\Duemsy\freebl3.dllMD5
269beb631b580c6d54db45b5573b1de5
SHA164050c1159c2bcfc0e75da407ef0098ad2de17c8
SHA256ffc7558a61a4e6546cf095bdeabea19f05247a0daa02dca20ea3605e7fc62c77
SHA512649cd40f3e02c2f2711f56aa21f39ccbda9108143d4766a9728c9ad98f329d5f64f77090df769c55b66ab48fb9aa4a380944ebe54f2c450f96cf76e5a6add31e
-
C:\Users\Admin\AppData\Local\Temp\Duemsy\libnspr4.dllMD5
6e84af2875700285309dd29294365c6a
SHA1fc3cb3b2a704250fc36010e2ab495cdc5e7378a9
SHA2561c158e680749e642e55f721f60a71314e26e03e785cd92e560bf650b83c4c3c8
SHA5120add9479b2fd631bafc617c787bca331e915edc6a29dd72269b6a24490ec1c85e677698e07944f5ff3bd8d849d3d20ace61a194a044c697fefcf992c6f05e747
-
C:\Users\Admin\AppData\Local\Temp\Duemsy\libplc4.dllMD5
1fae68b740f18290b98b2f9e23313cc2
SHA1fa3545dc8db38b3b27f1009e1d61dc2949df3878
SHA256751c2156dc00525668dd990d99f7f61c257951c3fad01c0ee6359fcdff69f933
SHA5125386aad83c76c625e2d64439b2b25bda8d0f8b1eb9344b58306883b66675d1f1e98e3189c1bc29cd4b2c98a9d4a594761488aae04d3748bba5775a51425b11ec
-
C:\Users\Admin\AppData\Local\Temp\Duemsy\libplds4.dllMD5
9ae76db13972553a5de5bdd07b1b654d
SHA10c4508eb6f13b9b178237ccc4da759bff10af658
SHA25638a906373419501966daf6ec19ca2f8db7b29609128ae5cb424d2aa511652c29
SHA512db6fd98a2b27dd7622f10491bba08793d26ab59016d6862168aad278644f737dddbd312a690ded5091d5e999dc3c3518fd95b200124be8349829e5ce6685cf4b
-
C:\Users\Admin\AppData\Local\Temp\Duemsy\nss3.dllMD5
a1c4628d184b6ab25550b1ce74f44792
SHA1c2c447fd2fda68c0ec44b3529a2550d2e2a8c3bc
SHA2563f997d3f1674de9fd119f275638861bc229352f12c70536d8c83a70fcc370847
SHA51207737ac24c91645d9b4d376327b84cb0b470cecbad60920d7ee0e9b11ef4eeb8ee68fb38bf74b5d1f8817d104cecc65e461950242d940e8ff9ca64ce9d3ffbb7
-
C:\Users\Admin\AppData\Local\Temp\Duemsy\nssutil3.dllMD5
c26e940b474728e728cafe5912ba418a
SHA17256e378a419f8d87de71835e6ad12faadaaaf73
SHA2561af1ac51a92b36de8d85d1f572369815404912908c3a489a6cd7ca2350c2a93d
SHA512bd8673facd416c8f2eb9a45c4deef50e53d0bc41e6b3941fc20cda8e2d88267205526dadb44bd89869bd333bf7d6f8db589c95997e1f3322f7a66a09d562b1df
-
C:\Users\Admin\AppData\Local\Temp\Duemsy\smime3.dllMD5
a5c670edf4411bf7f132f4280026137b
SHA1c0e3cbdde7d3cebf41a193eeca96a11ce2b6da58
SHA256aba2732c7a016730e94e645dd04e8fafcc173fc2e5e2aac01a1c0c66ead1983e
SHA512acfcde89a968d81363ae1cd599a6a362b047ae207722fea8541577ac609bc5fefb2231ed946e13f0b4b3bcd56b947c13837c1b9e360d521ec7d580befcbb0f46
-
C:\Users\Admin\AppData\Local\Temp\Duemsy\softokn3.dllMD5
2ab31c9401870adb4e9d88b5a6837abf
SHA14f0fdd699e63f614d79ed6e47ef61938117d3b7a
SHA25622ecece561510f77b100cff8109e5ed492c34707b7b14e0774aaa9ca813de4ad
SHA512bc58c4da15e902351f1f161e9d8c1ee4d10aceb5eda7def4b4454cadf4cd9f437118ba9d63f25f4f0a5694e9d34a4def33d40ad51efb1cdebb6f02a81c481871
-
C:\Users\Admin\AppData\Local\Temp\Duemsy\sqlite3.dllMD5
b58848a28a1efb85677e344db1fd67e6
SHA1dad48e2b2b3b936efc15ac2c5f9099b7a1749976
SHA25600db98ab4d50e9b26ecd193bfad6569e1dd395db14246f8c233febba93965f7a
SHA512762b3bd7f1f1a5c3accde8c36406b9beadd4270c570eb95a05935c1f7731513938ae5e99950c648b1eacdd2a85f002319b78b7e4ea9577c72335a2fa54796b13
-
C:\Users\Admin\AppData\Local\Temp\etodigy.crtMD5
fbc5d785b18bf17d6a055cfd2876a337
SHA17c6856d9a4359b2b17c69f7b44f7630a752cd1d9
SHA256a31067ce3a01914815a9713dc5124b6e603294428bc58abfaaa20ebf0cf21a6c
SHA512fedba666648b57bc395bb474537cb11a64e28d8eac7e9c569bd708c96c9a2a2be84ae6b2a5ab567225cd8e9a198210d8fdd7ef2d6f927fe90d738956eec02754
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ceywcwgd.default-release\cert9.dbMD5
952e033d1eb09599b3cd93d34c387c95
SHA185a316bd3036b9089c3f4d7a7a6b0c85ddd6ea81
SHA2562685ab8f1637a88cf1473c9381a52d2c3f337be62946d55bf175d2a876ee66e0
SHA512d227d2fb0ec7f26cb5f27fb869fb850564e19da03e4d79dc1744cfc322b7fb8e753549c61b70c5e5d57ec82a75aa925b88f3b83ad8c80cca03d7c01f64e7dad9
-
\Users\Admin\AppData\Local\Temp\Duemsy\freebl3.dllMD5
269beb631b580c6d54db45b5573b1de5
SHA164050c1159c2bcfc0e75da407ef0098ad2de17c8
SHA256ffc7558a61a4e6546cf095bdeabea19f05247a0daa02dca20ea3605e7fc62c77
SHA512649cd40f3e02c2f2711f56aa21f39ccbda9108143d4766a9728c9ad98f329d5f64f77090df769c55b66ab48fb9aa4a380944ebe54f2c450f96cf76e5a6add31e
-
\Users\Admin\AppData\Local\Temp\Duemsy\libnspr4.dllMD5
6e84af2875700285309dd29294365c6a
SHA1fc3cb3b2a704250fc36010e2ab495cdc5e7378a9
SHA2561c158e680749e642e55f721f60a71314e26e03e785cd92e560bf650b83c4c3c8
SHA5120add9479b2fd631bafc617c787bca331e915edc6a29dd72269b6a24490ec1c85e677698e07944f5ff3bd8d849d3d20ace61a194a044c697fefcf992c6f05e747
-
\Users\Admin\AppData\Local\Temp\Duemsy\libnspr4.dllMD5
6e84af2875700285309dd29294365c6a
SHA1fc3cb3b2a704250fc36010e2ab495cdc5e7378a9
SHA2561c158e680749e642e55f721f60a71314e26e03e785cd92e560bf650b83c4c3c8
SHA5120add9479b2fd631bafc617c787bca331e915edc6a29dd72269b6a24490ec1c85e677698e07944f5ff3bd8d849d3d20ace61a194a044c697fefcf992c6f05e747
-
\Users\Admin\AppData\Local\Temp\Duemsy\libnspr4.dllMD5
6e84af2875700285309dd29294365c6a
SHA1fc3cb3b2a704250fc36010e2ab495cdc5e7378a9
SHA2561c158e680749e642e55f721f60a71314e26e03e785cd92e560bf650b83c4c3c8
SHA5120add9479b2fd631bafc617c787bca331e915edc6a29dd72269b6a24490ec1c85e677698e07944f5ff3bd8d849d3d20ace61a194a044c697fefcf992c6f05e747
-
\Users\Admin\AppData\Local\Temp\Duemsy\libnspr4.dllMD5
6e84af2875700285309dd29294365c6a
SHA1fc3cb3b2a704250fc36010e2ab495cdc5e7378a9
SHA2561c158e680749e642e55f721f60a71314e26e03e785cd92e560bf650b83c4c3c8
SHA5120add9479b2fd631bafc617c787bca331e915edc6a29dd72269b6a24490ec1c85e677698e07944f5ff3bd8d849d3d20ace61a194a044c697fefcf992c6f05e747
-
\Users\Admin\AppData\Local\Temp\Duemsy\libnspr4.dllMD5
6e84af2875700285309dd29294365c6a
SHA1fc3cb3b2a704250fc36010e2ab495cdc5e7378a9
SHA2561c158e680749e642e55f721f60a71314e26e03e785cd92e560bf650b83c4c3c8
SHA5120add9479b2fd631bafc617c787bca331e915edc6a29dd72269b6a24490ec1c85e677698e07944f5ff3bd8d849d3d20ace61a194a044c697fefcf992c6f05e747
-
\Users\Admin\AppData\Local\Temp\Duemsy\libnspr4.dllMD5
6e84af2875700285309dd29294365c6a
SHA1fc3cb3b2a704250fc36010e2ab495cdc5e7378a9
SHA2561c158e680749e642e55f721f60a71314e26e03e785cd92e560bf650b83c4c3c8
SHA5120add9479b2fd631bafc617c787bca331e915edc6a29dd72269b6a24490ec1c85e677698e07944f5ff3bd8d849d3d20ace61a194a044c697fefcf992c6f05e747
-
\Users\Admin\AppData\Local\Temp\Duemsy\libplc4.dllMD5
1fae68b740f18290b98b2f9e23313cc2
SHA1fa3545dc8db38b3b27f1009e1d61dc2949df3878
SHA256751c2156dc00525668dd990d99f7f61c257951c3fad01c0ee6359fcdff69f933
SHA5125386aad83c76c625e2d64439b2b25bda8d0f8b1eb9344b58306883b66675d1f1e98e3189c1bc29cd4b2c98a9d4a594761488aae04d3748bba5775a51425b11ec
-
\Users\Admin\AppData\Local\Temp\Duemsy\libplds4.dllMD5
9ae76db13972553a5de5bdd07b1b654d
SHA10c4508eb6f13b9b178237ccc4da759bff10af658
SHA25638a906373419501966daf6ec19ca2f8db7b29609128ae5cb424d2aa511652c29
SHA512db6fd98a2b27dd7622f10491bba08793d26ab59016d6862168aad278644f737dddbd312a690ded5091d5e999dc3c3518fd95b200124be8349829e5ce6685cf4b
-
\Users\Admin\AppData\Local\Temp\Duemsy\libplds4.dllMD5
9ae76db13972553a5de5bdd07b1b654d
SHA10c4508eb6f13b9b178237ccc4da759bff10af658
SHA25638a906373419501966daf6ec19ca2f8db7b29609128ae5cb424d2aa511652c29
SHA512db6fd98a2b27dd7622f10491bba08793d26ab59016d6862168aad278644f737dddbd312a690ded5091d5e999dc3c3518fd95b200124be8349829e5ce6685cf4b
-
\Users\Admin\AppData\Local\Temp\Duemsy\msvcr100.dllMD5
0e37fbfa79d349d672456923ec5fbbe3
SHA14e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA2568793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
SHA5122bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
-
\Users\Admin\AppData\Local\Temp\Duemsy\nss3.dllMD5
a1c4628d184b6ab25550b1ce74f44792
SHA1c2c447fd2fda68c0ec44b3529a2550d2e2a8c3bc
SHA2563f997d3f1674de9fd119f275638861bc229352f12c70536d8c83a70fcc370847
SHA51207737ac24c91645d9b4d376327b84cb0b470cecbad60920d7ee0e9b11ef4eeb8ee68fb38bf74b5d1f8817d104cecc65e461950242d940e8ff9ca64ce9d3ffbb7
-
\Users\Admin\AppData\Local\Temp\Duemsy\nssutil3.dllMD5
c26e940b474728e728cafe5912ba418a
SHA17256e378a419f8d87de71835e6ad12faadaaaf73
SHA2561af1ac51a92b36de8d85d1f572369815404912908c3a489a6cd7ca2350c2a93d
SHA512bd8673facd416c8f2eb9a45c4deef50e53d0bc41e6b3941fc20cda8e2d88267205526dadb44bd89869bd333bf7d6f8db589c95997e1f3322f7a66a09d562b1df
-
\Users\Admin\AppData\Local\Temp\Duemsy\smime3.dllMD5
a5c670edf4411bf7f132f4280026137b
SHA1c0e3cbdde7d3cebf41a193eeca96a11ce2b6da58
SHA256aba2732c7a016730e94e645dd04e8fafcc173fc2e5e2aac01a1c0c66ead1983e
SHA512acfcde89a968d81363ae1cd599a6a362b047ae207722fea8541577ac609bc5fefb2231ed946e13f0b4b3bcd56b947c13837c1b9e360d521ec7d580befcbb0f46
-
\Users\Admin\AppData\Local\Temp\Duemsy\softokn3.dllMD5
2ab31c9401870adb4e9d88b5a6837abf
SHA14f0fdd699e63f614d79ed6e47ef61938117d3b7a
SHA25622ecece561510f77b100cff8109e5ed492c34707b7b14e0774aaa9ca813de4ad
SHA512bc58c4da15e902351f1f161e9d8c1ee4d10aceb5eda7def4b4454cadf4cd9f437118ba9d63f25f4f0a5694e9d34a4def33d40ad51efb1cdebb6f02a81c481871
-
\Users\Admin\AppData\Local\Temp\Duemsy\sqlite3.dllMD5
b58848a28a1efb85677e344db1fd67e6
SHA1dad48e2b2b3b936efc15ac2c5f9099b7a1749976
SHA25600db98ab4d50e9b26ecd193bfad6569e1dd395db14246f8c233febba93965f7a
SHA512762b3bd7f1f1a5c3accde8c36406b9beadd4270c570eb95a05935c1f7731513938ae5e99950c648b1eacdd2a85f002319b78b7e4ea9577c72335a2fa54796b13
-
memory/756-136-0x0000000000000000-mapping.dmp
-
memory/1120-125-0x0000000000000000-mapping.dmp
-
memory/1412-127-0x0000000000000000-mapping.dmp
-
memory/1824-129-0x0000000000000000-mapping.dmp
-
memory/2448-123-0x0000000000000000-mapping.dmp
-
memory/2516-128-0x0000000000000000-mapping.dmp
-
memory/2588-115-0x0000000000E00000-0x0000000000EAE000-memory.dmpFilesize
696KB
-
memory/2588-116-0x0000000010000000-0x00000000101FA000-memory.dmpFilesize
2.0MB
-
memory/2588-114-0x0000000000000000-mapping.dmp
-
memory/2716-124-0x0000000000000000-mapping.dmp
-
memory/2960-140-0x0000000000000000-mapping.dmp
-
memory/3024-130-0x0000000000000000-mapping.dmp
-
memory/3212-137-0x0000000000000000-mapping.dmp
-
memory/3864-126-0x0000000000000000-mapping.dmp
-
memory/4036-139-0x0000000006EE0000-0x00000000070BB000-memory.dmpFilesize
1.9MB
-
memory/4036-134-0x0000000004BB0000-0x0000000004BF1000-memory.dmpFilesize
260KB
-
memory/4036-122-0x0000000004810000-0x000000000485F000-memory.dmpFilesize
316KB
-
memory/4036-121-0x0000000000110000-0x0000000000136000-memory.dmpFilesize
152KB
-
memory/4036-120-0x0000000000020000-0x0000000000021000-memory.dmpFilesize
4KB
-
memory/4036-119-0x0000000000020000-0x0000000000021000-memory.dmpFilesize
4KB
-
memory/4036-138-0x0000000004C10000-0x0000000004C11000-memory.dmpFilesize
4KB
-
memory/4036-118-0x0000000000000000-mapping.dmp
-
memory/4036-117-0x0000000000110000-0x0000000000136000-memory.dmpFilesize
152KB
-
memory/4036-133-0x0000000005C20000-0x0000000005CEE000-memory.dmpFilesize
824KB
-
memory/4036-131-0x0000000005210000-0x0000000005228000-memory.dmpFilesize
96KB
-
memory/4036-132-0x0000000005100000-0x0000000005103000-memory.dmpFilesize
12KB