Analysis
-
max time kernel
42s -
max time network
147s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
06-01-2022 14:17
Static task
static1
Behavioral task
behavioral1
Sample
us.dll
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
-
Target
us.dll
-
Size
3.0MB
-
MD5
840e7d7e597e033a04f9c281f76d7869
-
SHA1
ce0c0304bf25cdcbf8998a1ee1ed3c29396fab19
-
SHA256
b4263deb8ede514bf90b1ffeda7087223e11c80c1494b0662230a0cf9d34aa88
-
SHA512
a6f6894defefb7487d7f125cf6ff77f418d59a0c831890f25d987c790a42df1f021e2694123865bb5b58243929ac5b62220fada7bc23f154c8fa5c0deb32d4ed
Malware Config
Extracted
Family
zloader
Botnet
9092us
Campaign
9092us
C2
https://asdfghdsajkl.com/gate.php
https://lkjhgfgsdshja.com/gate.php
https://kjdhsasghjds.com/gate.php
https://kdjwhqejqwij.com/gate.php
https://iasudjghnasd.com/gate.php
https://daksjuggdhwa.com/gate.php
https://dkisuaggdjhna.com/gate.php
https://eiqwuggejqw.com/gate.php
https://dquggwjhdmq.com/gate.php
https://djshggadasj.com/gate.php
Attributes
-
build_id
157
rc4.plain
rsa_pubkey.plain
Signatures
-
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe 2032 regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1904 wrote to memory of 2032 1904 regsvr32.exe 27 PID 1904 wrote to memory of 2032 1904 regsvr32.exe 27 PID 1904 wrote to memory of 2032 1904 regsvr32.exe 27 PID 1904 wrote to memory of 2032 1904 regsvr32.exe 27 PID 1904 wrote to memory of 2032 1904 regsvr32.exe 27 PID 1904 wrote to memory of 2032 1904 regsvr32.exe 27 PID 1904 wrote to memory of 2032 1904 regsvr32.exe 27
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\us.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\us.dll2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2032 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵PID:428
-
-