Analysis
-
max time kernel
153s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
09-03-2022 02:43
Static task
static1
Behavioral task
behavioral1
Sample
14c47cc16c55060409202302048d8b8f97c9b3fa462d7710ab91bb3f3f7a75e8.dll
Resource
win7-20220223-en
General
-
Target
14c47cc16c55060409202302048d8b8f97c9b3fa462d7710ab91bb3f3f7a75e8.dll
-
Size
370KB
-
MD5
243104faac6863b5b4a4263f4040f021
-
SHA1
597fbf324045926a5e3cc1617dc89f83ddd49792
-
SHA256
14c47cc16c55060409202302048d8b8f97c9b3fa462d7710ab91bb3f3f7a75e8
-
SHA512
3a0bf5a2731155559faf5167e00662fa69e18f81dfc671ac3132eec84ae0b4293429fda477f8bbb5d8576d64e6d36eac09e00a69c124ae99dc30f37e7868d985
Malware Config
Extracted
zloader
nut
30/11
https://aogmphregion.org.za/construction.php
https://aayanent.com/backups.php
https://eagle-family.co.uk/panel.php
https://khanbuilders.uk/wp-punch.php
https://construbienesjg.com/wp-punch.php
https://despautyajobssooka.ml/wp-smarts.php
-
build_id
257
Signatures
-
suricata: ET MALWARE Zbot POST Request to C2
suricata: ET MALWARE Zbot POST Request to C2
-
Blocklisted process makes network request 14 IoCs
Processes:
msiexec.exeflow pid process 37 912 msiexec.exe 38 912 msiexec.exe 39 912 msiexec.exe 40 912 msiexec.exe 41 912 msiexec.exe 42 912 msiexec.exe 53 912 msiexec.exe 57 912 msiexec.exe 58 912 msiexec.exe 59 912 msiexec.exe 63 912 msiexec.exe 64 912 msiexec.exe 66 912 msiexec.exe 69 912 msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1528 set thread context of 912 1528 regsvr32.exe msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 912 msiexec.exe Token: SeSecurityPrivilege 912 msiexec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 1396 wrote to memory of 1528 1396 regsvr32.exe regsvr32.exe PID 1396 wrote to memory of 1528 1396 regsvr32.exe regsvr32.exe PID 1396 wrote to memory of 1528 1396 regsvr32.exe regsvr32.exe PID 1528 wrote to memory of 912 1528 regsvr32.exe msiexec.exe PID 1528 wrote to memory of 912 1528 regsvr32.exe msiexec.exe PID 1528 wrote to memory of 912 1528 regsvr32.exe msiexec.exe PID 1528 wrote to memory of 912 1528 regsvr32.exe msiexec.exe PID 1528 wrote to memory of 912 1528 regsvr32.exe msiexec.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\14c47cc16c55060409202302048d8b8f97c9b3fa462d7710ab91bb3f3f7a75e8.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\14c47cc16c55060409202302048d8b8f97c9b3fa462d7710ab91bb3f3f7a75e8.dll2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/912-134-0x0000000000510000-0x0000000000536000-memory.dmpFilesize
152KB
-
memory/912-135-0x0000000000510000-0x0000000000536000-memory.dmpFilesize
152KB
-
memory/1528-131-0x0000000075220000-0x0000000075292000-memory.dmpFilesize
456KB
-
memory/1528-130-0x0000000075220000-0x0000000075246000-memory.dmpFilesize
152KB
-
memory/1528-132-0x0000000075220000-0x0000000075292000-memory.dmpFilesize
456KB
-
memory/1528-133-0x0000000000DE0000-0x0000000000DE1000-memory.dmpFilesize
4KB