Analysis
-
max time kernel
4294183s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20220223-en -
submitted
03-03-2022 15:29
Static task
static1
Behavioral task
behavioral1
Sample
gily.dll
Resource
win7-20220223-en
General
-
Target
gily.dll
-
Size
447KB
-
MD5
72d9d1613f2dd8d89d2372cc5f22e316
-
SHA1
07ee0fe5a1b4c51fca014d1b6aa9accdac6f0a00
-
SHA256
c5adc361e52c9a978ab90c6e56379a7c6202381e34d82a2a73b007c2469263bf
-
SHA512
7d0938c9463a31387182498a4223c3e1af27be6300b182883458d892c1e5a6c4f462191d6c01b327c573bf1e17890c725e655e4a7becc5088a94c70f88c42d81
Malware Config
Extracted
zloader
bat1k2
bat1k2
http://ad123234234.in/LKhwojehDgwegSDG/gateJKjdsh.php
http://ad123234234.info/LKhwojehDgwegSDG/gateJKjdsh.php
http://ad123234234.net/LKhwojehDgwegSDG/gateJKjdsh.php
http://ad123234234.org/LKhwojehDgwegSDG/gateJKjdsh.php
http://ad123234234.xyz/LKhwojehDgwegSDG/gateJKjdsh.php
-
build_id
28
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
regsvr32.exedescription pid process target process PID 524 created 1268 524 regsvr32.exe Explorer.EXE -
Suspicious use of SetThreadContext 1 IoCs
Processes:
regsvr32.exedescription pid process target process PID 524 set thread context of 1812 524 regsvr32.exe msiexec.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
regsvr32.exepid process 524 regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
regsvr32.exemsiexec.exedescription pid process Token: SeDebugPrivilege 524 regsvr32.exe Token: SeSecurityPrivilege 1812 msiexec.exe Token: SeSecurityPrivilege 1812 msiexec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 1992 wrote to memory of 524 1992 regsvr32.exe regsvr32.exe PID 1992 wrote to memory of 524 1992 regsvr32.exe regsvr32.exe PID 1992 wrote to memory of 524 1992 regsvr32.exe regsvr32.exe PID 1992 wrote to memory of 524 1992 regsvr32.exe regsvr32.exe PID 1992 wrote to memory of 524 1992 regsvr32.exe regsvr32.exe PID 1992 wrote to memory of 524 1992 regsvr32.exe regsvr32.exe PID 1992 wrote to memory of 524 1992 regsvr32.exe regsvr32.exe PID 524 wrote to memory of 1812 524 regsvr32.exe msiexec.exe PID 524 wrote to memory of 1812 524 regsvr32.exe msiexec.exe PID 524 wrote to memory of 1812 524 regsvr32.exe msiexec.exe PID 524 wrote to memory of 1812 524 regsvr32.exe msiexec.exe PID 524 wrote to memory of 1812 524 regsvr32.exe msiexec.exe PID 524 wrote to memory of 1812 524 regsvr32.exe msiexec.exe PID 524 wrote to memory of 1812 524 regsvr32.exe msiexec.exe PID 524 wrote to memory of 1812 524 regsvr32.exe msiexec.exe PID 524 wrote to memory of 1812 524 regsvr32.exe msiexec.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\gily.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\gily.dll3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/524-55-0x0000000076271000-0x0000000076273000-memory.dmpFilesize
8KB
-
memory/524-56-0x0000000075060000-0x000000007508D000-memory.dmpFilesize
180KB
-
memory/524-57-0x0000000075060000-0x00000000750DD000-memory.dmpFilesize
500KB
-
memory/524-58-0x00000000750D0000-0x00000000750D3000-memory.dmpFilesize
12KB
-
memory/524-59-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB
-
memory/1812-60-0x00000000000D0000-0x00000000000FD000-memory.dmpFilesize
180KB
-
memory/1812-61-0x0000000000100000-0x0000000000101000-memory.dmpFilesize
4KB
-
memory/1812-62-0x00000000000D0000-0x00000000000FD000-memory.dmpFilesize
180KB
-
memory/1812-64-0x00000000000D0000-0x00000000000FD000-memory.dmpFilesize
180KB
-
memory/1992-54-0x000007FEFC4D1000-0x000007FEFC4D3000-memory.dmpFilesize
8KB