Analysis
-
max time kernel
156s -
max time network
165s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
05-02-2022 16:01
Static task
static1
Behavioral task
behavioral1
Sample
4f1b67de033cb3d692e494a0104243edb1504185df21e5086dba1d10d941c12a.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
4f1b67de033cb3d692e494a0104243edb1504185df21e5086dba1d10d941c12a.dll
Resource
win10v2004-en-20220113
General
-
Target
4f1b67de033cb3d692e494a0104243edb1504185df21e5086dba1d10d941c12a.dll
-
Size
877KB
-
MD5
4773b4f06e91d998f15f56986eca1c04
-
SHA1
47bd5aa4356028de73fde18268e4891bf7ec5aae
-
SHA256
4f1b67de033cb3d692e494a0104243edb1504185df21e5086dba1d10d941c12a
-
SHA512
6709ee7c50729eab38b0ab6fc72948fa66458c277d9109e605824105827db87d9c34e7559c4a9a7c7e2f3908f8c4ac49be587e9210928c99757a600a3b9d3c77
Malware Config
Extracted
zloader
main
20.04.2020
https://tremood.com/sound.php
https://soceneo.com/sound.php
https://baatiot.com/sound.php
https://welefus.com/sound.php
https://maremeo.com/sound.php
-
build_id
41
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\Kuwity = "rundll32.exe C:\\Users\\Admin\\AppData\\Roaming\\Gyahk\\kicy.dll,DllRegisterServer" msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 1504 set thread context of 1720 1504 rundll32.exe msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 1720 msiexec.exe Token: SeSecurityPrivilege 1720 msiexec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1668 wrote to memory of 1504 1668 rundll32.exe rundll32.exe PID 1668 wrote to memory of 1504 1668 rundll32.exe rundll32.exe PID 1668 wrote to memory of 1504 1668 rundll32.exe rundll32.exe PID 1668 wrote to memory of 1504 1668 rundll32.exe rundll32.exe PID 1668 wrote to memory of 1504 1668 rundll32.exe rundll32.exe PID 1668 wrote to memory of 1504 1668 rundll32.exe rundll32.exe PID 1668 wrote to memory of 1504 1668 rundll32.exe rundll32.exe PID 1504 wrote to memory of 1720 1504 rundll32.exe msiexec.exe PID 1504 wrote to memory of 1720 1504 rundll32.exe msiexec.exe PID 1504 wrote to memory of 1720 1504 rundll32.exe msiexec.exe PID 1504 wrote to memory of 1720 1504 rundll32.exe msiexec.exe PID 1504 wrote to memory of 1720 1504 rundll32.exe msiexec.exe PID 1504 wrote to memory of 1720 1504 rundll32.exe msiexec.exe PID 1504 wrote to memory of 1720 1504 rundll32.exe msiexec.exe PID 1504 wrote to memory of 1720 1504 rundll32.exe msiexec.exe PID 1504 wrote to memory of 1720 1504 rundll32.exe msiexec.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4f1b67de033cb3d692e494a0104243edb1504185df21e5086dba1d10d941c12a.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4f1b67de033cb3d692e494a0104243edb1504185df21e5086dba1d10d941c12a.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1504-55-0x0000000075831000-0x0000000075833000-memory.dmpFilesize
8KB
-
memory/1504-56-0x0000000000270000-0x00000000002BD000-memory.dmpFilesize
308KB
-
memory/1504-57-0x0000000010000000-0x00000000100DF000-memory.dmpFilesize
892KB
-
memory/1720-59-0x0000000000110000-0x0000000000111000-memory.dmpFilesize
4KB
-
memory/1720-58-0x00000000000D0000-0x0000000000102000-memory.dmpFilesize
200KB
-
memory/1720-60-0x00000000000D0000-0x0000000000102000-memory.dmpFilesize
200KB
-
memory/1720-62-0x00000000000D0000-0x0000000000102000-memory.dmpFilesize
200KB