Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
05-02-2022 19:02
Static task
static1
Behavioral task
behavioral1
Sample
14d333f6817a40cc66251901b630df311dc518be513f3be9e4fc308ab7ff562d.vbs
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
14d333f6817a40cc66251901b630df311dc518be513f3be9e4fc308ab7ff562d.vbs
Resource
win10v2004-en-20220112
General
-
Target
14d333f6817a40cc66251901b630df311dc518be513f3be9e4fc308ab7ff562d.vbs
-
Size
1.5MB
-
MD5
0d59d38d2ec5c6aa8b14e1ab7e7f0c5c
-
SHA1
a587242db9200982a8a9d8308ce4c020020c6264
-
SHA256
14d333f6817a40cc66251901b630df311dc518be513f3be9e4fc308ab7ff562d
-
SHA512
c5f3247cd102d290df14860a73b2c1ffd666b9bb89a0afc35b54d004ef6e87b9455c48b46ed8a9c494293b1362156934afd27a543fd76b95dca97d99df0e6c54
Malware Config
Extracted
zloader
main
19.04.2020
https://spardanos.com/sound.php
https://lonehee.com/sound.php
https://surgued.com/sound.php
https://tremood.com/sound.php
https://soceneo.com/sound.php
https://baatiot.com/sound.php
https://welefus.com/sound.php
https://maremeo.com/sound.php
-
build_id
39
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1720 1428 rundll32.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 1888 rundll32.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\Faovfu = "rundll32.exe C:\\Users\\Admin\\AppData\\Roaming\\Epmi\\qiuxcec.dll,DllRegisterServer" msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 1888 set thread context of 1388 1888 rundll32.exe msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 1388 msiexec.exe Token: SeSecurityPrivilege 1388 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
WScript.exepid process 1628 WScript.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1720 wrote to memory of 1888 1720 rundll32.exe rundll32.exe PID 1720 wrote to memory of 1888 1720 rundll32.exe rundll32.exe PID 1720 wrote to memory of 1888 1720 rundll32.exe rundll32.exe PID 1720 wrote to memory of 1888 1720 rundll32.exe rundll32.exe PID 1720 wrote to memory of 1888 1720 rundll32.exe rundll32.exe PID 1720 wrote to memory of 1888 1720 rundll32.exe rundll32.exe PID 1720 wrote to memory of 1888 1720 rundll32.exe rundll32.exe PID 1888 wrote to memory of 1388 1888 rundll32.exe msiexec.exe PID 1888 wrote to memory of 1388 1888 rundll32.exe msiexec.exe PID 1888 wrote to memory of 1388 1888 rundll32.exe msiexec.exe PID 1888 wrote to memory of 1388 1888 rundll32.exe msiexec.exe PID 1888 wrote to memory of 1388 1888 rundll32.exe msiexec.exe PID 1888 wrote to memory of 1388 1888 rundll32.exe msiexec.exe PID 1888 wrote to memory of 1388 1888 rundll32.exe msiexec.exe PID 1888 wrote to memory of 1388 1888 rundll32.exe msiexec.exe PID 1888 wrote to memory of 1388 1888 rundll32.exe msiexec.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\14d333f6817a40cc66251901b630df311dc518be513f3be9e4fc308ab7ff562d.vbs"1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\rundll32.exerundll32 C:\Users\Admin\AppData\Local\Temp\MdXOYcXZkheUMIO.txt,DllRegisterServer1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32 C:\Users\Admin\AppData\Local\Temp\MdXOYcXZkheUMIO.txt,DllRegisterServer2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MdXOYcXZkheUMIO.txtMD5
bba9ace9dc7cce4cac9439a43fa4c9a0
SHA18a66109684bfb149ae5f59adaceb380b040f1afc
SHA256e62889be5bf912d37044d83aab08dfa85c7863ec9baeac93e0397e03a407f95a
SHA51249ab85bd8272bb8e54b93cb899af72cfaf169b0db39ac334d60e2e13daa1c393e6e7e563d308d002b9e9724a51740f6a860176885afcc1473fa9a04587134d82
-
\Users\Admin\AppData\Local\Temp\MdXOYcXZkheUMIO.txtMD5
bba9ace9dc7cce4cac9439a43fa4c9a0
SHA18a66109684bfb149ae5f59adaceb380b040f1afc
SHA256e62889be5bf912d37044d83aab08dfa85c7863ec9baeac93e0397e03a407f95a
SHA51249ab85bd8272bb8e54b93cb899af72cfaf169b0db39ac334d60e2e13daa1c393e6e7e563d308d002b9e9724a51740f6a860176885afcc1473fa9a04587134d82
-
memory/1388-62-0x00000000000D0000-0x00000000000D1000-memory.dmpFilesize
4KB
-
memory/1388-61-0x0000000000090000-0x00000000000C2000-memory.dmpFilesize
200KB
-
memory/1388-63-0x0000000000090000-0x00000000000C2000-memory.dmpFilesize
200KB
-
memory/1388-65-0x0000000000090000-0x00000000000C2000-memory.dmpFilesize
200KB
-
memory/1628-54-0x000007FEFB711000-0x000007FEFB713000-memory.dmpFilesize
8KB
-
memory/1628-55-0x00000000022B0000-0x00000000022B1000-memory.dmpFilesize
4KB
-
memory/1888-57-0x0000000075D61000-0x0000000075D63000-memory.dmpFilesize
8KB
-
memory/1888-59-0x00000000001A0000-0x00000000001F8000-memory.dmpFilesize
352KB
-
memory/1888-60-0x0000000010000000-0x00000000100E7000-memory.dmpFilesize
924KB