Analysis

  • max time kernel
    153s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    01-02-2022 10:49

General

  • Target

    1be04e51510b2aafb51598838b97124a73952c46b17d3d1c38254dd6d94e82a7.dll

  • Size

    274KB

  • MD5

    11abbd1cd5e968e03b053426b33e64e1

  • SHA1

    7e1bc02b6bc16d4df3f532c8e8498f898ed0acb6

  • SHA256

    1be04e51510b2aafb51598838b97124a73952c46b17d3d1c38254dd6d94e82a7

  • SHA512

    36ef0aa604b36e0e2cdeaded3f4e0593a63747ee80ea114a6ad771d3744c2f56a840148d9b47e7710689d08c8e7f7ffed6d318c99c68b26dcffef8b595e22bc8

Malware Config

Extracted

Family

zloader

Botnet

banking

Campaign

banking

C2

https://iloveyoubaby1.pro/gate.php

https://idsakjfsanfaskj.com/gate.php

https://fslakdasjdnsasjsj.com/gate.php

https://dksadjsahnfaskmsa.com/gate.php

https://dskdsajdsahda.info/gate.php

https://dskdsajdsadasda.info/gate.php

https://dskjdsadhsahjsas.info/gate.php

https://dsjadjsadjsadjafsa.info/gate.php

https://fsakjdsafasifkajfaf.pro/gate.php

https://djsadhsadsadjashs.pro/gate.php

Attributes
  • build_id

    3

rc4.plain

Signatures

  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

  • Blocklisted process makes network request 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\1be04e51510b2aafb51598838b97124a73952c46b17d3d1c38254dd6d94e82a7.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:944
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\1be04e51510b2aafb51598838b97124a73952c46b17d3d1c38254dd6d94e82a7.dll,#1
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:960
      • C:\Windows\SysWOW64\msiexec.exe
        msiexec.exe
        3⤵
        • Blocklisted process makes network request
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        PID:1652

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/960-54-0x0000000076151000-0x0000000076153000-memory.dmp

    Filesize

    8KB

  • memory/960-55-0x0000000074CC0000-0x0000000074D07000-memory.dmp

    Filesize

    284KB

  • memory/960-59-0x0000000074C70000-0x0000000074CB7000-memory.dmp

    Filesize

    284KB

  • memory/1652-57-0x0000000000090000-0x0000000000091000-memory.dmp

    Filesize

    4KB

  • memory/1652-56-0x00000000000F0000-0x0000000000122000-memory.dmp

    Filesize

    200KB

  • memory/1652-58-0x00000000000F0000-0x0000000000122000-memory.dmp

    Filesize

    200KB

  • memory/1652-61-0x00000000000F0000-0x0000000000122000-memory.dmp

    Filesize

    200KB