Analysis
-
max time kernel
84s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
18-04-2022 10:13
Static task
static1
Behavioral task
behavioral1
Sample
6f3d6311fb91f7dea3d8d83833c94ee81b4e936d181619c5c9166f6994532141.exe
Resource
win7-20220414-en
General
-
Target
6f3d6311fb91f7dea3d8d83833c94ee81b4e936d181619c5c9166f6994532141.exe
-
Size
282KB
-
MD5
24a14eb9657fff6c151b279556cba1f0
-
SHA1
843624d36b63100beb5bc05e4ddec5659317eb9d
-
SHA256
6f3d6311fb91f7dea3d8d83833c94ee81b4e936d181619c5c9166f6994532141
-
SHA512
30043da4f8aa33085f2d8238d7151c06f74c8376a3bc2f9deba492e2692d3ed79b7737f416eed11fed9f40d273f84917717b7ecfa745b4fb30274c689664f024
Malware Config
Extracted
zloader
r2
r2
https://notsweets.net/LKhwojehDgwegSDG/gateJKjdsh.php
https://olpons.com/LKhwojehDgwegSDG/gateJKjdsh.php
https://karamelliar.org/LKhwojehDgwegSDG/gateJKjdsh.php
https://dogrunn.com/LKhwojehDgwegSDG/gateJKjdsh.php
https://azoraz.net/LKhwojehDgwegSDG/gateJKjdsh.php
-
build_id
136
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
6f3d6311fb91f7dea3d8d83833c94ee81b4e936d181619c5c9166f6994532141.exedescription pid process target process PID 1836 created 1232 1836 6f3d6311fb91f7dea3d8d83833c94ee81b4e936d181619c5c9166f6994532141.exe Explorer.EXE -
Blocklisted process makes network request 6 IoCs
Processes:
msiexec.exeflow pid process 5 1220 msiexec.exe 7 1220 msiexec.exe 9 1220 msiexec.exe 11 1220 msiexec.exe 13 1220 msiexec.exe 15 1220 msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
6f3d6311fb91f7dea3d8d83833c94ee81b4e936d181619c5c9166f6994532141.exedescription pid process target process PID 1836 set thread context of 1220 1836 6f3d6311fb91f7dea3d8d83833c94ee81b4e936d181619c5c9166f6994532141.exe msiexec.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
6f3d6311fb91f7dea3d8d83833c94ee81b4e936d181619c5c9166f6994532141.exepid process 1836 6f3d6311fb91f7dea3d8d83833c94ee81b4e936d181619c5c9166f6994532141.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
6f3d6311fb91f7dea3d8d83833c94ee81b4e936d181619c5c9166f6994532141.exemsiexec.exedescription pid process Token: SeDebugPrivilege 1836 6f3d6311fb91f7dea3d8d83833c94ee81b4e936d181619c5c9166f6994532141.exe Token: SeSecurityPrivilege 1220 msiexec.exe Token: SeSecurityPrivilege 1220 msiexec.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
6f3d6311fb91f7dea3d8d83833c94ee81b4e936d181619c5c9166f6994532141.exedescription pid process target process PID 1836 wrote to memory of 1220 1836 6f3d6311fb91f7dea3d8d83833c94ee81b4e936d181619c5c9166f6994532141.exe msiexec.exe PID 1836 wrote to memory of 1220 1836 6f3d6311fb91f7dea3d8d83833c94ee81b4e936d181619c5c9166f6994532141.exe msiexec.exe PID 1836 wrote to memory of 1220 1836 6f3d6311fb91f7dea3d8d83833c94ee81b4e936d181619c5c9166f6994532141.exe msiexec.exe PID 1836 wrote to memory of 1220 1836 6f3d6311fb91f7dea3d8d83833c94ee81b4e936d181619c5c9166f6994532141.exe msiexec.exe PID 1836 wrote to memory of 1220 1836 6f3d6311fb91f7dea3d8d83833c94ee81b4e936d181619c5c9166f6994532141.exe msiexec.exe PID 1836 wrote to memory of 1220 1836 6f3d6311fb91f7dea3d8d83833c94ee81b4e936d181619c5c9166f6994532141.exe msiexec.exe PID 1836 wrote to memory of 1220 1836 6f3d6311fb91f7dea3d8d83833c94ee81b4e936d181619c5c9166f6994532141.exe msiexec.exe PID 1836 wrote to memory of 1220 1836 6f3d6311fb91f7dea3d8d83833c94ee81b4e936d181619c5c9166f6994532141.exe msiexec.exe PID 1836 wrote to memory of 1220 1836 6f3d6311fb91f7dea3d8d83833c94ee81b4e936d181619c5c9166f6994532141.exe msiexec.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\6f3d6311fb91f7dea3d8d83833c94ee81b4e936d181619c5c9166f6994532141.exe"C:\Users\Admin\AppData\Local\Temp\6f3d6311fb91f7dea3d8d83833c94ee81b4e936d181619c5c9166f6994532141.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe2⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1220-58-0x0000000000090000-0x00000000000B6000-memory.dmpFilesize
152KB
-
memory/1220-60-0x0000000000100000-0x0000000000101000-memory.dmpFilesize
4KB
-
memory/1220-61-0x0000000000090000-0x00000000000B6000-memory.dmpFilesize
152KB
-
memory/1220-62-0x0000000000000000-mapping.dmp
-
memory/1220-63-0x0000000076011000-0x0000000076013000-memory.dmpFilesize
8KB
-
memory/1220-64-0x0000000000090000-0x00000000000B6000-memory.dmpFilesize
152KB
-
memory/1836-54-0x0000000000DC7000-0x0000000000DDE000-memory.dmpFilesize
92KB
-
memory/1836-55-0x0000000000DC7000-0x0000000000DDE000-memory.dmpFilesize
92KB
-
memory/1836-56-0x0000000000230000-0x0000000000252000-memory.dmpFilesize
136KB
-
memory/1836-57-0x0000000000400000-0x0000000000C20000-memory.dmpFilesize
8.1MB