Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
01-02-2022 07:01
Static task
static1
Behavioral task
behavioral1
Sample
4ca3ae0f9b573739e66192f15aade1cf3d409ef133a7b6834ad4e387dea498a5.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
4ca3ae0f9b573739e66192f15aade1cf3d409ef133a7b6834ad4e387dea498a5.dll
Resource
win10v2004-en-20220113
General
-
Target
4ca3ae0f9b573739e66192f15aade1cf3d409ef133a7b6834ad4e387dea498a5.dll
-
Size
334KB
-
MD5
500854618bda05096da0a2d244de4e43
-
SHA1
ec5338822efc141c24c54a6718fb73cfe166a61d
-
SHA256
4ca3ae0f9b573739e66192f15aade1cf3d409ef133a7b6834ad4e387dea498a5
-
SHA512
3dbca6e5792c70485b49238329986b7f04d48ea1171b4d57d1305e617c089c838dcba75f7344eab48dffcd06629b6f14523989e504f90e20225839659ab83226
Malware Config
Extracted
zloader
main
27.03.2020
https://hustlertest.com/sound.php
https://dandycodes.com/sound.php
https://sandyfotos.com/sound.php
https://postgringos.com/sound.php
https://tetraslims.com/sound.php
https://greenrumba.com/sound.php
https://starterdatas.com/sound.php
https://nexycombats.com/sound.php
https://peermems.com/sound.php
https://fotonums.com/sound.php
-
build_id
29
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\Wyinl = "rundll32.exe C:\\Users\\Admin\\AppData\\Roaming\\Vipy\\weqy.dll,DllRegisterServer" msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 1480 set thread context of 1032 1480 rundll32.exe msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 1032 msiexec.exe Token: SeSecurityPrivilege 1032 msiexec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1984 wrote to memory of 1480 1984 rundll32.exe rundll32.exe PID 1984 wrote to memory of 1480 1984 rundll32.exe rundll32.exe PID 1984 wrote to memory of 1480 1984 rundll32.exe rundll32.exe PID 1984 wrote to memory of 1480 1984 rundll32.exe rundll32.exe PID 1984 wrote to memory of 1480 1984 rundll32.exe rundll32.exe PID 1984 wrote to memory of 1480 1984 rundll32.exe rundll32.exe PID 1984 wrote to memory of 1480 1984 rundll32.exe rundll32.exe PID 1480 wrote to memory of 1032 1480 rundll32.exe msiexec.exe PID 1480 wrote to memory of 1032 1480 rundll32.exe msiexec.exe PID 1480 wrote to memory of 1032 1480 rundll32.exe msiexec.exe PID 1480 wrote to memory of 1032 1480 rundll32.exe msiexec.exe PID 1480 wrote to memory of 1032 1480 rundll32.exe msiexec.exe PID 1480 wrote to memory of 1032 1480 rundll32.exe msiexec.exe PID 1480 wrote to memory of 1032 1480 rundll32.exe msiexec.exe PID 1480 wrote to memory of 1032 1480 rundll32.exe msiexec.exe PID 1480 wrote to memory of 1032 1480 rundll32.exe msiexec.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ca3ae0f9b573739e66192f15aade1cf3d409ef133a7b6834ad4e387dea498a5.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ca3ae0f9b573739e66192f15aade1cf3d409ef133a7b6834ad4e387dea498a5.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1032-60-0x0000000000090000-0x00000000000C1000-memory.dmpFilesize
196KB
-
memory/1032-59-0x0000000000090000-0x00000000000C0000-memory.dmpFilesize
192KB
-
memory/1032-61-0x0000000000090000-0x00000000000C1000-memory.dmpFilesize
196KB
-
memory/1032-63-0x0000000000090000-0x00000000000C0000-memory.dmpFilesize
192KB
-
memory/1480-55-0x0000000074B21000-0x0000000074B23000-memory.dmpFilesize
8KB
-
memory/1480-57-0x0000000074540000-0x00000000745B1000-memory.dmpFilesize
452KB
-
memory/1480-56-0x0000000074540000-0x0000000074570000-memory.dmpFilesize
192KB
-
memory/1480-58-0x0000000000160000-0x0000000000161000-memory.dmpFilesize
4KB