Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
01-02-2022 03:36
Static task
static1
Behavioral task
behavioral1
Sample
da164dc8c1baf31539335b6a14ca2f14cc0f8a4a39523479290437d0810b82e3.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
da164dc8c1baf31539335b6a14ca2f14cc0f8a4a39523479290437d0810b82e3.dll
Resource
win10v2004-en-20220112
General
-
Target
da164dc8c1baf31539335b6a14ca2f14cc0f8a4a39523479290437d0810b82e3.dll
-
Size
788KB
-
MD5
25c4f6ec3f18c71bf9639746b8fe9567
-
SHA1
9ff48900feed1f2433b3ef1610a5fc2b438152de
-
SHA256
da164dc8c1baf31539335b6a14ca2f14cc0f8a4a39523479290437d0810b82e3
-
SHA512
35120b078971e74f473d19fc5f65bd4fe925ff05a00dac080b6a98ceeb1409ce6e2b6757d282559f21fe24e9ee8c95e90a5289e30602ab88203cd0432827637e
Malware Config
Extracted
zloader
main
27.03.2020
https://hustlertest.com/sound.php
https://dandycodes.com/sound.php
https://sandyfotos.com/sound.php
https://postgringos.com/sound.php
https://tetraslims.com/sound.php
https://greenrumba.com/sound.php
https://starterdatas.com/sound.php
https://nexycombats.com/sound.php
https://peermems.com/sound.php
https://fotonums.com/sound.php
-
build_id
29
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\Meuvigp = "rundll32.exe C:\\Users\\Admin\\AppData\\Roaming\\Ryorur\\olerdo.dll,DllRegisterServer" msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 836 set thread context of 1216 836 rundll32.exe msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 1216 msiexec.exe Token: SeSecurityPrivilege 1216 msiexec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1620 wrote to memory of 836 1620 rundll32.exe rundll32.exe PID 1620 wrote to memory of 836 1620 rundll32.exe rundll32.exe PID 1620 wrote to memory of 836 1620 rundll32.exe rundll32.exe PID 1620 wrote to memory of 836 1620 rundll32.exe rundll32.exe PID 1620 wrote to memory of 836 1620 rundll32.exe rundll32.exe PID 1620 wrote to memory of 836 1620 rundll32.exe rundll32.exe PID 1620 wrote to memory of 836 1620 rundll32.exe rundll32.exe PID 836 wrote to memory of 1216 836 rundll32.exe msiexec.exe PID 836 wrote to memory of 1216 836 rundll32.exe msiexec.exe PID 836 wrote to memory of 1216 836 rundll32.exe msiexec.exe PID 836 wrote to memory of 1216 836 rundll32.exe msiexec.exe PID 836 wrote to memory of 1216 836 rundll32.exe msiexec.exe PID 836 wrote to memory of 1216 836 rundll32.exe msiexec.exe PID 836 wrote to memory of 1216 836 rundll32.exe msiexec.exe PID 836 wrote to memory of 1216 836 rundll32.exe msiexec.exe PID 836 wrote to memory of 1216 836 rundll32.exe msiexec.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\da164dc8c1baf31539335b6a14ca2f14cc0f8a4a39523479290437d0810b82e3.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\da164dc8c1baf31539335b6a14ca2f14cc0f8a4a39523479290437d0810b82e3.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/836-55-0x0000000076641000-0x0000000076643000-memory.dmpFilesize
8KB
-
memory/836-56-0x00000000001C0000-0x000000000020D000-memory.dmpFilesize
308KB
-
memory/836-57-0x0000000010000000-0x00000000100C7000-memory.dmpFilesize
796KB
-
memory/1216-59-0x0000000000090000-0x00000000000C1000-memory.dmpFilesize
196KB
-
memory/1216-58-0x0000000000090000-0x00000000000C0000-memory.dmpFilesize
192KB
-
memory/1216-60-0x0000000000090000-0x00000000000C1000-memory.dmpFilesize
196KB
-
memory/1216-62-0x0000000000090000-0x00000000000C0000-memory.dmpFilesize
192KB