Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
01-02-2022 08:12
Static task
static1
Behavioral task
behavioral1
Sample
15e6a048813e1fa7e06751b3cccd6125d7b8efb3ed160931213ac44eafa60807.dll
Resource
win7-en-20211208
General
-
Target
15e6a048813e1fa7e06751b3cccd6125d7b8efb3ed160931213ac44eafa60807.dll
-
Size
529KB
-
MD5
96ede22c743f990a839949fb3edd381b
-
SHA1
2506fb0f8e03108b5e4ee4555e6d9f309f4f8936
-
SHA256
15e6a048813e1fa7e06751b3cccd6125d7b8efb3ed160931213ac44eafa60807
-
SHA512
14922ce98535243e4f6e5c771c02397027b75b3e73ae807335dbcb97b653fc517010d89565ca6e0399a5012d40774455318a120ae5eb3f84693f9f0da1c1ed11
Malware Config
Extracted
zloader
PLSPAM
PLSPAM
http://marchadvertisingnetwork4.com/post.php
http://marchadvertisingnetwork5.com/post.php
http://marchadvertisingnetwork6.com/post.php
http://marchadvertisingnetwork7.com/post.php
http://marchadvertisingnetwork8.com/post.php
http://marchadvertisingnetwork9.com/post.php
http://marchadvertisingnetwork10.com/post.php
-
build_id
27
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\Deirbey = "rundll32.exe C:\\Users\\Admin\\AppData\\Roaming\\Uwost\\syco.dll,DllRegisterServer" msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 1656 set thread context of 288 1656 rundll32.exe msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 288 msiexec.exe Token: SeSecurityPrivilege 288 msiexec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 480 wrote to memory of 1656 480 rundll32.exe rundll32.exe PID 480 wrote to memory of 1656 480 rundll32.exe rundll32.exe PID 480 wrote to memory of 1656 480 rundll32.exe rundll32.exe PID 480 wrote to memory of 1656 480 rundll32.exe rundll32.exe PID 480 wrote to memory of 1656 480 rundll32.exe rundll32.exe PID 480 wrote to memory of 1656 480 rundll32.exe rundll32.exe PID 480 wrote to memory of 1656 480 rundll32.exe rundll32.exe PID 1656 wrote to memory of 288 1656 rundll32.exe msiexec.exe PID 1656 wrote to memory of 288 1656 rundll32.exe msiexec.exe PID 1656 wrote to memory of 288 1656 rundll32.exe msiexec.exe PID 1656 wrote to memory of 288 1656 rundll32.exe msiexec.exe PID 1656 wrote to memory of 288 1656 rundll32.exe msiexec.exe PID 1656 wrote to memory of 288 1656 rundll32.exe msiexec.exe PID 1656 wrote to memory of 288 1656 rundll32.exe msiexec.exe PID 1656 wrote to memory of 288 1656 rundll32.exe msiexec.exe PID 1656 wrote to memory of 288 1656 rundll32.exe msiexec.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\15e6a048813e1fa7e06751b3cccd6125d7b8efb3ed160931213ac44eafa60807.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\15e6a048813e1fa7e06751b3cccd6125d7b8efb3ed160931213ac44eafa60807.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/288-59-0x0000000000090000-0x00000000000C0000-memory.dmpFilesize
192KB
-
memory/288-60-0x0000000000090000-0x00000000000C1000-memory.dmpFilesize
196KB
-
memory/288-61-0x0000000000090000-0x00000000000C1000-memory.dmpFilesize
196KB
-
memory/288-63-0x0000000000090000-0x00000000000C0000-memory.dmpFilesize
192KB
-
memory/1656-55-0x0000000074EC1000-0x0000000074EC3000-memory.dmpFilesize
8KB
-
memory/1656-57-0x0000000074990000-0x0000000074A35000-memory.dmpFilesize
660KB
-
memory/1656-56-0x0000000074990000-0x00000000749C0000-memory.dmpFilesize
192KB
-
memory/1656-58-0x0000000000170000-0x0000000000171000-memory.dmpFilesize
4KB