Analysis
-
max time kernel
97s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
17-04-2022 14:49
Static task
static1
Behavioral task
behavioral1
Sample
058ce66e9056d1c480dca60cdd9fd26295d79f43c123d190f86df654b58d3780.dll
Resource
win7-20220414-en
General
-
Target
058ce66e9056d1c480dca60cdd9fd26295d79f43c123d190f86df654b58d3780.dll
-
Size
576KB
-
MD5
8f738a7381504430a708006466b9f065
-
SHA1
784e1a0840827c287e39ec91b8e5dd8f11ce12ad
-
SHA256
058ce66e9056d1c480dca60cdd9fd26295d79f43c123d190f86df654b58d3780
-
SHA512
8abb366e9f2adc46b9b4d58dc2824247bd2a6447c0958bab903d167bfcdd340c94c5281c3de89c476399752b8cfb995e88d685fcae589d467ce3f9dd1020206e
Malware Config
Extracted
zloader
kev
21/10
https://jerseysl.online/gjd6vo.php
https://albeeah.co/yfllta.php
https://atipicconcept.ro/wbxpnk.php
https://bellebands.com/mbhtmn.php
https://butterflycalstudio.com/y2qtqq.php
https://camera-experts.com/yxubo7.php
https://proferblinpiacred.tk/wp-smarts.php
-
build_id
176
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4416 wrote to memory of 4484 4416 rundll32.exe rundll32.exe PID 4416 wrote to memory of 4484 4416 rundll32.exe rundll32.exe PID 4416 wrote to memory of 4484 4416 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\058ce66e9056d1c480dca60cdd9fd26295d79f43c123d190f86df654b58d3780.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\058ce66e9056d1c480dca60cdd9fd26295d79f43c123d190f86df654b58d3780.dll,#12⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2892-134-0x0000000000000000-mapping.dmp
-
memory/2892-135-0x00000000008B0000-0x00000000008D6000-memory.dmpFilesize
152KB
-
memory/2892-136-0x00000000008B0000-0x00000000008D6000-memory.dmpFilesize
152KB
-
memory/4484-130-0x0000000000000000-mapping.dmp
-
memory/4484-132-0x0000000010000000-0x000000001009E000-memory.dmpFilesize
632KB
-
memory/4484-131-0x0000000010000000-0x0000000010026000-memory.dmpFilesize
152KB
-
memory/4484-133-0x0000000010000000-0x000000001009E000-memory.dmpFilesize
632KB