Analysis
-
max time kernel
149s -
max time network
131s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
05-02-2022 17:17
Static task
static1
Behavioral task
behavioral1
Sample
2f2670e8a7845cf300320415c6a16ffc34e662672f16d7cfcf5b911d088516d9.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
2f2670e8a7845cf300320415c6a16ffc34e662672f16d7cfcf5b911d088516d9.dll
Resource
win10v2004-en-20220113
General
-
Target
2f2670e8a7845cf300320415c6a16ffc34e662672f16d7cfcf5b911d088516d9.dll
-
Size
358KB
-
MD5
8bb66e279a58af871180adbb29e41f4f
-
SHA1
446cfe9fa815951085e4e587dd272911b9e5d32b
-
SHA256
2f2670e8a7845cf300320415c6a16ffc34e662672f16d7cfcf5b911d088516d9
-
SHA512
bb114ac54bcc95f1b465ec33400eead469ca97b5f9b8115bc9eb8016f07fa568cf2d0ef570d3f7b1301a44f1daf19b4c8e279fab892facd750601a45b6788204
Malware Config
Extracted
zloader
crypto1
crypto
http://wmwifbajxxbcxmucxmlc.com/post.php
http://ojnxjgfjlftfkkuxxiqd.com/post.php
http://pwkqhdgytsshkoibaake.com/post.php
http://snnmnkxdhflwgthqismb.com/post.php
http://iawfqecrwohcxnhwtofa.com/post.php
http://nlbmfsyplohyaicmxhum.com/post.php
http://fvqlkgedqjiqgapudkgq.com/post.php
http://cmmxhurildiigqghlryq.com/post.php
http://nmqsmbiabjdnuushksas.com/post.php
http://fyratyubvflktyyjiqgq.com/post.php
-
build_id
110
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
msiexec.exeflow pid process 5 472 msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 1532 set thread context of 472 1532 rundll32.exe msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 472 msiexec.exe Token: SeSecurityPrivilege 472 msiexec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2028 wrote to memory of 1532 2028 rundll32.exe rundll32.exe PID 2028 wrote to memory of 1532 2028 rundll32.exe rundll32.exe PID 2028 wrote to memory of 1532 2028 rundll32.exe rundll32.exe PID 2028 wrote to memory of 1532 2028 rundll32.exe rundll32.exe PID 2028 wrote to memory of 1532 2028 rundll32.exe rundll32.exe PID 2028 wrote to memory of 1532 2028 rundll32.exe rundll32.exe PID 2028 wrote to memory of 1532 2028 rundll32.exe rundll32.exe PID 1532 wrote to memory of 472 1532 rundll32.exe msiexec.exe PID 1532 wrote to memory of 472 1532 rundll32.exe msiexec.exe PID 1532 wrote to memory of 472 1532 rundll32.exe msiexec.exe PID 1532 wrote to memory of 472 1532 rundll32.exe msiexec.exe PID 1532 wrote to memory of 472 1532 rundll32.exe msiexec.exe PID 1532 wrote to memory of 472 1532 rundll32.exe msiexec.exe PID 1532 wrote to memory of 472 1532 rundll32.exe msiexec.exe PID 1532 wrote to memory of 472 1532 rundll32.exe msiexec.exe PID 1532 wrote to memory of 472 1532 rundll32.exe msiexec.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f2670e8a7845cf300320415c6a16ffc34e662672f16d7cfcf5b911d088516d9.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f2670e8a7845cf300320415c6a16ffc34e662672f16d7cfcf5b911d088516d9.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/472-58-0x00000000000D0000-0x00000000000D1000-memory.dmpFilesize
4KB
-
memory/472-57-0x0000000000090000-0x00000000000C4000-memory.dmpFilesize
208KB
-
memory/472-59-0x0000000000090000-0x00000000000C4000-memory.dmpFilesize
208KB
-
memory/472-61-0x0000000000090000-0x00000000000C4000-memory.dmpFilesize
208KB
-
memory/1532-53-0x0000000075F21000-0x0000000075F23000-memory.dmpFilesize
8KB
-
memory/1532-54-0x0000000072730000-0x0000000072764000-memory.dmpFilesize
208KB
-
memory/1532-55-0x0000000072730000-0x0000000073695000-memory.dmpFilesize
15.4MB
-
memory/1532-56-0x0000000000160000-0x0000000000161000-memory.dmpFilesize
4KB