Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
01-02-2022 10:57
Static task
static1
Behavioral task
behavioral1
Sample
0b61ae1202d964bea67cea9d663c8530b11c1268bcea9439b949e669b3b3be7c.dll
Resource
win7-en-20211208
General
-
Target
0b61ae1202d964bea67cea9d663c8530b11c1268bcea9439b949e669b3b3be7c.dll
-
Size
251KB
-
MD5
3e68a003922b9c94a660a2e696869d17
-
SHA1
a1ed31293acf35e8b9854393b9329b9874fda09c
-
SHA256
0b61ae1202d964bea67cea9d663c8530b11c1268bcea9439b949e669b3b3be7c
-
SHA512
d686028dad79b9514a7547ffaa2f8b7cc6cd8aeba413721b2ab0571997d59eaf01e4397657c228ac6152bd8be567cf929692b7e5f7d4bdfd0960e01c28e63b20
Malware Config
Extracted
zloader
DLLobnova
alisa
https://dsdjfhdsufudhjas.pro/gate.php
https://dsdjfhd9ddksaas.pro/gate.php
https://dsdjfhdsufudhjas.name/gate.php
https://dsdjfhd9ddksaas.com/gate.php
https://dsdjfhdsufudhjas.pw/gate.php
https://dsdjfhd9ddksaas.ru/gate.php
https://dsdjfhdsufudhjas.su/gate.php
https://kdsadisadijdsasm2.com/gate.php
https://dsdjfhdsufudhjas.net/gate.php
https://dsdjfhd9ddksaas.eu/gate.php
-
build_id
3
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\Tixubi = "regsvr32.exe /s C:\\Users\\Admin\\AppData\\Roaming\\Quab\\avezqe.dll" msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 524 set thread context of 636 524 rundll32.exe msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 636 msiexec.exe Token: SeSecurityPrivilege 636 msiexec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1156 wrote to memory of 524 1156 rundll32.exe rundll32.exe PID 1156 wrote to memory of 524 1156 rundll32.exe rundll32.exe PID 1156 wrote to memory of 524 1156 rundll32.exe rundll32.exe PID 1156 wrote to memory of 524 1156 rundll32.exe rundll32.exe PID 1156 wrote to memory of 524 1156 rundll32.exe rundll32.exe PID 1156 wrote to memory of 524 1156 rundll32.exe rundll32.exe PID 1156 wrote to memory of 524 1156 rundll32.exe rundll32.exe PID 524 wrote to memory of 636 524 rundll32.exe msiexec.exe PID 524 wrote to memory of 636 524 rundll32.exe msiexec.exe PID 524 wrote to memory of 636 524 rundll32.exe msiexec.exe PID 524 wrote to memory of 636 524 rundll32.exe msiexec.exe PID 524 wrote to memory of 636 524 rundll32.exe msiexec.exe PID 524 wrote to memory of 636 524 rundll32.exe msiexec.exe PID 524 wrote to memory of 636 524 rundll32.exe msiexec.exe PID 524 wrote to memory of 636 524 rundll32.exe msiexec.exe PID 524 wrote to memory of 636 524 rundll32.exe msiexec.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0b61ae1202d964bea67cea9d663c8530b11c1268bcea9439b949e669b3b3be7c.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0b61ae1202d964bea67cea9d663c8530b11c1268bcea9439b949e669b3b3be7c.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/524-54-0x00000000766D1000-0x00000000766D3000-memory.dmpFilesize
8KB
-
memory/524-55-0x0000000000170000-0x0000000000171000-memory.dmpFilesize
4KB
-
memory/524-56-0x0000000075420000-0x0000000075469000-memory.dmpFilesize
292KB
-
memory/636-57-0x0000000000090000-0x00000000000BB000-memory.dmpFilesize
172KB
-
memory/636-58-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/636-59-0x0000000000090000-0x00000000000BB000-memory.dmpFilesize
172KB
-
memory/636-61-0x0000000000090000-0x00000000000BB000-memory.dmpFilesize
172KB