Analysis
-
max time kernel
127s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
19-04-2022 02:33
Static task
static1
Behavioral task
behavioral1
Sample
acc5fe0088037ddc055f9286380c56583effa1186afe9d08caea3e197b2643fd.dll
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
acc5fe0088037ddc055f9286380c56583effa1186afe9d08caea3e197b2643fd.dll
Resource
win10v2004-20220414-en
General
-
Target
acc5fe0088037ddc055f9286380c56583effa1186afe9d08caea3e197b2643fd.dll
-
Size
764KB
-
MD5
ebc6187124521528375d17372a16ae94
-
SHA1
1aee7da350e939d1686cd52c258f05270e63f990
-
SHA256
acc5fe0088037ddc055f9286380c56583effa1186afe9d08caea3e197b2643fd
-
SHA512
6e8f3dbc3a3121c00b6574558be8acc3331e7a8b7ca6aa2ae354d9d6ae62a69ffc3541f40b16cd0fb5364dd9f4ec430639a1ffaec987fa2d4dfd0850930f56f5
Malware Config
Extracted
zloader
17/03
https://dhteijwrb.host/milagrecf.php
https://aquolepp.pw/milagrecf.php
-
build_id
92
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\Kuolyvod = "rundll32.exe C:\\Users\\Admin\\AppData\\Roaming\\Izpuxi\\gioxnoo.dll,DllRegisterServer" msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 1944 set thread context of 1060 1944 rundll32.exe msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 1060 msiexec.exe Token: SeSecurityPrivilege 1060 msiexec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1664 wrote to memory of 1944 1664 rundll32.exe rundll32.exe PID 1664 wrote to memory of 1944 1664 rundll32.exe rundll32.exe PID 1664 wrote to memory of 1944 1664 rundll32.exe rundll32.exe PID 1664 wrote to memory of 1944 1664 rundll32.exe rundll32.exe PID 1664 wrote to memory of 1944 1664 rundll32.exe rundll32.exe PID 1664 wrote to memory of 1944 1664 rundll32.exe rundll32.exe PID 1664 wrote to memory of 1944 1664 rundll32.exe rundll32.exe PID 1944 wrote to memory of 1060 1944 rundll32.exe msiexec.exe PID 1944 wrote to memory of 1060 1944 rundll32.exe msiexec.exe PID 1944 wrote to memory of 1060 1944 rundll32.exe msiexec.exe PID 1944 wrote to memory of 1060 1944 rundll32.exe msiexec.exe PID 1944 wrote to memory of 1060 1944 rundll32.exe msiexec.exe PID 1944 wrote to memory of 1060 1944 rundll32.exe msiexec.exe PID 1944 wrote to memory of 1060 1944 rundll32.exe msiexec.exe PID 1944 wrote to memory of 1060 1944 rundll32.exe msiexec.exe PID 1944 wrote to memory of 1060 1944 rundll32.exe msiexec.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\acc5fe0088037ddc055f9286380c56583effa1186afe9d08caea3e197b2643fd.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\acc5fe0088037ddc055f9286380c56583effa1186afe9d08caea3e197b2643fd.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1060-60-0x00000000000D0000-0x0000000000101000-memory.dmpFilesize
196KB
-
memory/1060-62-0x0000000000110000-0x0000000000111000-memory.dmpFilesize
4KB
-
memory/1060-63-0x00000000000D0000-0x0000000000101000-memory.dmpFilesize
196KB
-
memory/1060-64-0x0000000000000000-mapping.dmp
-
memory/1060-66-0x00000000000D0000-0x0000000000101000-memory.dmpFilesize
196KB
-
memory/1944-54-0x0000000000000000-mapping.dmp
-
memory/1944-55-0x00000000754A1000-0x00000000754A3000-memory.dmpFilesize
8KB
-
memory/1944-56-0x00000000007D0000-0x00000000008AA000-memory.dmpFilesize
872KB
-
memory/1944-58-0x00000000007D0000-0x00000000008AA000-memory.dmpFilesize
872KB
-
memory/1944-57-0x00000000007D0000-0x0000000000801000-memory.dmpFilesize
196KB
-
memory/1944-59-0x00000000007D0000-0x00000000008AA000-memory.dmpFilesize
872KB