Analysis
-
max time kernel
34s -
max time network
121s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
11-01-2022 15:22
Static task
static1
Behavioral task
behavioral1
Sample
us.dll
Resource
win7-en-20211208
General
-
Target
us.dll
-
Size
961KB
-
MD5
5d9f2380da3a12c2d16dc2dd5ad4d63d
-
SHA1
c76d2f11c160b78a353c6e54f7cff0c6e0413dff
-
SHA256
fedcab6903489dca264c60d5fe04df3946248818f74f7c802b119832e715a6a8
-
SHA512
81649d960f5f785d57876cbf98e45bbe9b6cee649c92868e56d883f89e19af41154b2587e7ebfccafbb10821065215315818da8947ca13d9cc622e77d823708f
Malware Config
Extracted
zloader
9092us
9092us
https://asdfghdsajkl.com/gate.php
https://lkjhgfgsdshja.com/gate.php
https://kjdhsasghjds.com/gate.php
https://kdjwhqejqwij.com/gate.php
https://iasudjghnasd.com/gate.php
https://daksjuggdhwa.com/gate.php
https://dkisuaggdjhna.com/gate.php
https://eiqwuggejqw.com/gate.php
https://dquggwjhdmq.com/gate.php
https://djshggadasj.com/gate.php
-
build_id
157
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
regsvr32.exedescription pid process target process PID 2636 wrote to memory of 2880 2636 regsvr32.exe regsvr32.exe PID 2636 wrote to memory of 2880 2636 regsvr32.exe regsvr32.exe PID 2636 wrote to memory of 2880 2636 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\us.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\us.dll2⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2880-114-0x0000000000000000-mapping.dmp
-
memory/2880-115-0x00000000033D0000-0x00000000033D1000-memory.dmpFilesize
4KB
-
memory/2880-116-0x0000000010000000-0x0000000010112000-memory.dmpFilesize
1.1MB
-
memory/3624-118-0x0000000000000000-mapping.dmp
-
memory/3624-117-0x0000000002B40000-0x0000000002B66000-memory.dmpFilesize
152KB
-
memory/3624-119-0x0000000000A10000-0x0000000000A11000-memory.dmpFilesize
4KB
-
memory/3624-120-0x0000000000A10000-0x0000000000A11000-memory.dmpFilesize
4KB
-
memory/3624-121-0x0000000002B40000-0x0000000002B66000-memory.dmpFilesize
152KB