Analysis
-
max time kernel
171s -
max time network
194s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
19-04-2022 02:33
Static task
static1
Behavioral task
behavioral1
Sample
acc5fe0088037ddc055f9286380c56583effa1186afe9d08caea3e197b2643fd.dll
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
acc5fe0088037ddc055f9286380c56583effa1186afe9d08caea3e197b2643fd.dll
Resource
win10v2004-20220414-en
General
-
Target
acc5fe0088037ddc055f9286380c56583effa1186afe9d08caea3e197b2643fd.dll
-
Size
764KB
-
MD5
ebc6187124521528375d17372a16ae94
-
SHA1
1aee7da350e939d1686cd52c258f05270e63f990
-
SHA256
acc5fe0088037ddc055f9286380c56583effa1186afe9d08caea3e197b2643fd
-
SHA512
6e8f3dbc3a3121c00b6574558be8acc3331e7a8b7ca6aa2ae354d9d6ae62a69ffc3541f40b16cd0fb5364dd9f4ec430639a1ffaec987fa2d4dfd0850930f56f5
Malware Config
Extracted
zloader
17/03
https://dhteijwrb.host/milagrecf.php
https://aquolepp.pw/milagrecf.php
-
build_id
92
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows\CurrentVersion\Run msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Unxi = "rundll32.exe C:\\Users\\Admin\\AppData\\Roaming\\Axtuc\\weicbybo.dll,DllRegisterServer" msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 4156 set thread context of 4444 4156 rundll32.exe msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 4444 msiexec.exe Token: SeSecurityPrivilege 4444 msiexec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 3100 wrote to memory of 4156 3100 rundll32.exe rundll32.exe PID 3100 wrote to memory of 4156 3100 rundll32.exe rundll32.exe PID 3100 wrote to memory of 4156 3100 rundll32.exe rundll32.exe PID 4156 wrote to memory of 4444 4156 rundll32.exe msiexec.exe PID 4156 wrote to memory of 4444 4156 rundll32.exe msiexec.exe PID 4156 wrote to memory of 4444 4156 rundll32.exe msiexec.exe PID 4156 wrote to memory of 4444 4156 rundll32.exe msiexec.exe PID 4156 wrote to memory of 4444 4156 rundll32.exe msiexec.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\acc5fe0088037ddc055f9286380c56583effa1186afe9d08caea3e197b2643fd.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\acc5fe0088037ddc055f9286380c56583effa1186afe9d08caea3e197b2643fd.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4156-130-0x0000000000000000-mapping.dmp
-
memory/4156-131-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/4156-132-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/4444-133-0x0000000000000000-mapping.dmp
-
memory/4444-134-0x0000000001200000-0x0000000001231000-memory.dmpFilesize
196KB
-
memory/4444-135-0x0000000001200000-0x0000000001231000-memory.dmpFilesize
196KB