Analysis
-
max time kernel
4294189s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
14-04-2022 02:16
Static task
static1
Behavioral task
behavioral1
Sample
tmp.dll
Resource
win7-20220311-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
tmp.dll
Resource
win10v2004-20220310-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
tmp.dll
-
Size
444KB
-
MD5
c6b350b0d6f8dc37c144f76a57c9dbe7
-
SHA1
e637d8a29d46281a5fa97d84af1dfe1d72223157
-
SHA256
6348bded936831629494c1d820fe8e3dbe3fb4d9f96940bbb4ca0c1872bef0ad
-
SHA512
5220ff154b731a8a1d1e768552fee037cacb12412eff931384c105d4caa5483da64c11b4839ab44885214d4d8831b280687b54b2438f89a230fce68bf7692dff
Score
10/10
Malware Config
Extracted
Family
zloader
Botnet
26/03
C2
https://vfgthujbxd.xyz/milagrecf.php
https://todiks.xyz/milagrecf.php
Attributes
-
build_id
108
rc4.plain
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows\CurrentVersion\Run msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows\CurrentVersion\Run\Osmexa = "rundll32.exe C:\\Users\\Admin\\AppData\\Roaming\\Olody\\oxnoyk.dll,DllRegisterServer" msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 1768 set thread context of 1408 1768 rundll32.exe msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 1408 msiexec.exe Token: SeSecurityPrivilege 1408 msiexec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1808 wrote to memory of 1768 1808 rundll32.exe rundll32.exe PID 1808 wrote to memory of 1768 1808 rundll32.exe rundll32.exe PID 1808 wrote to memory of 1768 1808 rundll32.exe rundll32.exe PID 1808 wrote to memory of 1768 1808 rundll32.exe rundll32.exe PID 1808 wrote to memory of 1768 1808 rundll32.exe rundll32.exe PID 1808 wrote to memory of 1768 1808 rundll32.exe rundll32.exe PID 1808 wrote to memory of 1768 1808 rundll32.exe rundll32.exe PID 1768 wrote to memory of 1408 1768 rundll32.exe msiexec.exe PID 1768 wrote to memory of 1408 1768 rundll32.exe msiexec.exe PID 1768 wrote to memory of 1408 1768 rundll32.exe msiexec.exe PID 1768 wrote to memory of 1408 1768 rundll32.exe msiexec.exe PID 1768 wrote to memory of 1408 1768 rundll32.exe msiexec.exe PID 1768 wrote to memory of 1408 1768 rundll32.exe msiexec.exe PID 1768 wrote to memory of 1408 1768 rundll32.exe msiexec.exe PID 1768 wrote to memory of 1408 1768 rundll32.exe msiexec.exe PID 1768 wrote to memory of 1408 1768 rundll32.exe msiexec.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\tmp.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\tmp.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1408-59-0x0000000000090000-0x00000000000BE000-memory.dmpFilesize
184KB
-
memory/1408-61-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/1408-62-0x0000000000090000-0x00000000000BE000-memory.dmpFilesize
184KB
-
memory/1408-63-0x0000000000000000-mapping.dmp
-
memory/1408-65-0x0000000000090000-0x00000000000BE000-memory.dmpFilesize
184KB
-
memory/1768-54-0x0000000000000000-mapping.dmp
-
memory/1768-55-0x0000000076AC1000-0x0000000076AC3000-memory.dmpFilesize
8KB
-
memory/1768-56-0x0000000075350000-0x000000007537E000-memory.dmpFilesize
184KB
-
memory/1768-57-0x0000000075350000-0x00000000753D5000-memory.dmpFilesize
532KB
-
memory/1768-58-0x0000000075350000-0x00000000753D5000-memory.dmpFilesize
532KB