Analysis
-
max time kernel
117s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
10-05-2022 17:46
Static task
static1
Behavioral task
behavioral1
Sample
cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe
Resource
win7-20220414-en
General
-
Target
cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe
-
Size
804KB
-
MD5
9d6680e9b0807d476ce0f39ead7f6b2a
-
SHA1
fb65b9487a06464440cf86eb583ee68c34b4bd5d
-
SHA256
cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf
-
SHA512
4e7e93756d1f60ae7a472a80f04760e4b0fafeedcd3c8f83fbf85001cfb96ce96b287eb2f1621f5a68d13de11588b7eef480f047a667438af13816e05f68987e
Malware Config
Extracted
zloader
target1
target1
https://freebreez.com/LKhwojehDgwegSDG/gateJKjdsh.php
https://makaronz.com/LKhwojehDgwegSDG/gateJKjdsh.php
https://ricklick.com/LKhwojehDgwegSDG/gateJKjdsh.php
https://litlblockblack.com/LKhwojehDgwegSDG/gateJKjdsh.php
https://vaktorianpackif.com/LKhwojehDgwegSDG/gateJKjdsh.php
https://hbamefphmqsdgkqojgwe.com/LKhwojehDgwegSDG/gateJKjdsh.php
https://hoxfqvlgoabyfspvjimc.com/LKhwojehDgwegSDG/gateJKjdsh.php
https://yrsfuaegsevyffrfsgpj.com/LKhwojehDgwegSDG/gateJKjdsh.php
-
build_id
71
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exedescription pid process target process PID 1444 created 3064 1444 cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe Explorer.EXE -
Suspicious use of SetThreadContext 1 IoCs
Processes:
cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exedescription pid process target process PID 1444 set thread context of 3676 1444 cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe msiexec.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exepid process 1444 cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe 1444 cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exemsiexec.exedescription pid process Token: SeDebugPrivilege 1444 cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe Token: SeSecurityPrivilege 3676 msiexec.exe Token: SeSecurityPrivilege 3676 msiexec.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exedescription pid process target process PID 1444 wrote to memory of 3676 1444 cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe msiexec.exe PID 1444 wrote to memory of 3676 1444 cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe msiexec.exe PID 1444 wrote to memory of 3676 1444 cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe msiexec.exe PID 1444 wrote to memory of 3676 1444 cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe msiexec.exe PID 1444 wrote to memory of 3676 1444 cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe msiexec.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe"C:\Users\Admin\AppData\Local\Temp\cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1444-130-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1444-131-0x0000000000400000-0x00000000005C8000-memory.dmpFilesize
1.8MB
-
memory/3676-132-0x0000000000000000-mapping.dmp
-
memory/3676-133-0x00000000003C0000-0x00000000003ED000-memory.dmpFilesize
180KB
-
memory/3676-134-0x00000000003C0000-0x00000000003ED000-memory.dmpFilesize
180KB