Resubmissions
05-02-2022 14:14
220205-rkca3acbb4 10Analysis
-
max time kernel
149s -
max time network
129s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
05-02-2022 14:14
Static task
static1
Behavioral task
behavioral1
Sample
75b24a04b7ddddd036a8e677061e2cd86bc74f147f4b59de463964476db5f003.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
75b24a04b7ddddd036a8e677061e2cd86bc74f147f4b59de463964476db5f003.dll
Resource
win10v2004-en-20220113
General
-
Target
75b24a04b7ddddd036a8e677061e2cd86bc74f147f4b59de463964476db5f003.dll
-
Size
448KB
-
MD5
8159db73e81a064754313a4fd2e066ac
-
SHA1
658bf787c490baed9fce56f630c3351ad0d1916f
-
SHA256
75b24a04b7ddddd036a8e677061e2cd86bc74f147f4b59de463964476db5f003
-
SHA512
0707b6b1a963cd012f59621b7fb94d589fdbec90ea0d296c8ac0dd7e1858956d5f7b21d3a2ac5ad274373dc537af81a93db5cf498b4e0e91f3eee4811535317a
Malware Config
Extracted
zloader
April27misha
April27misha
http://wmwifbajxxbcxmucxmlc.com/post.php
http://onfovdaqqrwbvdfoqnof.com/post.php
http://cmmxhurildiigqghlryq.com/post.php
http://nmqsmbiabjdnuushksas.com/post.php
http://fvqlkgedqjiqgapudkgq.com/post.php
http://iawfqecrwohcxnhwtofa.com/post.php
http://nlbmfsyplohyaicmxhum.com/post.php
http://snnmnkxdhflwgthqismb.com/post.php
-
build_id
123
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
msiexec.exeflow pid process 5 524 msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 1112 set thread context of 524 1112 rundll32.exe msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 524 msiexec.exe Token: SeSecurityPrivilege 524 msiexec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1456 wrote to memory of 1112 1456 rundll32.exe rundll32.exe PID 1456 wrote to memory of 1112 1456 rundll32.exe rundll32.exe PID 1456 wrote to memory of 1112 1456 rundll32.exe rundll32.exe PID 1456 wrote to memory of 1112 1456 rundll32.exe rundll32.exe PID 1456 wrote to memory of 1112 1456 rundll32.exe rundll32.exe PID 1456 wrote to memory of 1112 1456 rundll32.exe rundll32.exe PID 1456 wrote to memory of 1112 1456 rundll32.exe rundll32.exe PID 1112 wrote to memory of 524 1112 rundll32.exe msiexec.exe PID 1112 wrote to memory of 524 1112 rundll32.exe msiexec.exe PID 1112 wrote to memory of 524 1112 rundll32.exe msiexec.exe PID 1112 wrote to memory of 524 1112 rundll32.exe msiexec.exe PID 1112 wrote to memory of 524 1112 rundll32.exe msiexec.exe PID 1112 wrote to memory of 524 1112 rundll32.exe msiexec.exe PID 1112 wrote to memory of 524 1112 rundll32.exe msiexec.exe PID 1112 wrote to memory of 524 1112 rundll32.exe msiexec.exe PID 1112 wrote to memory of 524 1112 rundll32.exe msiexec.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\75b24a04b7ddddd036a8e677061e2cd86bc74f147f4b59de463964476db5f003.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\75b24a04b7ddddd036a8e677061e2cd86bc74f147f4b59de463964476db5f003.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/524-58-0x00000000000D0000-0x0000000000104000-memory.dmpFilesize
208KB
-
memory/524-59-0x0000000000110000-0x0000000000111000-memory.dmpFilesize
4KB
-
memory/524-60-0x00000000000D0000-0x0000000000104000-memory.dmpFilesize
208KB
-
memory/524-62-0x00000000000D0000-0x0000000000104000-memory.dmpFilesize
208KB
-
memory/1112-54-0x0000000075601000-0x0000000075603000-memory.dmpFilesize
8KB
-
memory/1112-55-0x0000000072610000-0x0000000072644000-memory.dmpFilesize
208KB
-
memory/1112-57-0x0000000000200000-0x0000000000201000-memory.dmpFilesize
4KB
-
memory/1112-56-0x0000000072610000-0x0000000073586000-memory.dmpFilesize
15.5MB