Analysis
-
max time kernel
137s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
16-05-2022 02:11
Static task
static1
Behavioral task
behavioral1
Sample
f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe
Resource
win7-20220414-en
General
-
Target
f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe
-
Size
364KB
-
MD5
237dcba926f68d809230a71529172e4c
-
SHA1
350ef285178655aa95e49b51957ec14d9e36ba78
-
SHA256
f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949
-
SHA512
8dd34cf5c04c8d2de31338da1abed2dbb0474f99198330fbe69a5a0f37a3027ccf70ea4d9647447477d1a1d446dfc621ab834b95117b8bcd67ed1cf18f047b30
Malware Config
Extracted
zloader
Raz
Raz
http://softwareserviceupdater5.com/web/post.php
-
build_id
35
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exedescription pid process target process PID 1488 created 2948 1488 f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe Explorer.EXE -
suricata: ET MALWARE Zbot POST Request to C2
suricata: ET MALWARE Zbot POST Request to C2
-
Blocklisted process makes network request 1 IoCs
Processes:
msiexec.exeflow pid process 69 3108 msiexec.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exef32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exedescription pid process target process PID 4844 set thread context of 1488 4844 f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe PID 1488 set thread context of 3108 1488 f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe msiexec.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exef32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exepid process 4844 f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe 4844 f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe 4844 f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe 4844 f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe 4844 f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe 4844 f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe 4844 f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe 4844 f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe 4844 f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe 4844 f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe 4844 f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe 4844 f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe 4844 f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe 4844 f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe 4844 f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe 4844 f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe 4844 f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe 4844 f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe 4844 f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe 4844 f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe 4844 f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe 4844 f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe 1488 f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe 1488 f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exef32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exemsiexec.exedescription pid process Token: SeDebugPrivilege 4844 f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe Token: SeDebugPrivilege 1488 f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe Token: SeSecurityPrivilege 3108 msiexec.exe Token: SeSecurityPrivilege 3108 msiexec.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exef32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exedescription pid process target process PID 4844 wrote to memory of 1488 4844 f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe PID 4844 wrote to memory of 1488 4844 f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe PID 4844 wrote to memory of 1488 4844 f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe PID 4844 wrote to memory of 1488 4844 f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe PID 4844 wrote to memory of 1488 4844 f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe PID 4844 wrote to memory of 1488 4844 f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe PID 4844 wrote to memory of 1488 4844 f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe PID 4844 wrote to memory of 1488 4844 f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe PID 4844 wrote to memory of 1488 4844 f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe PID 1488 wrote to memory of 3108 1488 f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe msiexec.exe PID 1488 wrote to memory of 3108 1488 f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe msiexec.exe PID 1488 wrote to memory of 3108 1488 f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe msiexec.exe PID 1488 wrote to memory of 3108 1488 f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe msiexec.exe PID 1488 wrote to memory of 3108 1488 f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe msiexec.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe"C:\Users\Admin\AppData\Local\Temp\f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe"C:\Users\Admin\AppData\Local\Temp\f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe2⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1488-135-0x0000000000000000-mapping.dmp
-
memory/1488-136-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1488-138-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/3108-139-0x0000000000000000-mapping.dmp
-
memory/3108-140-0x0000000000870000-0x000000000089D000-memory.dmpFilesize
180KB
-
memory/3108-141-0x0000000000870000-0x000000000089D000-memory.dmpFilesize
180KB
-
memory/4844-130-0x0000000000E20000-0x0000000000E82000-memory.dmpFilesize
392KB
-
memory/4844-131-0x0000000005D10000-0x00000000062B4000-memory.dmpFilesize
5.6MB
-
memory/4844-132-0x0000000005840000-0x00000000058D2000-memory.dmpFilesize
584KB
-
memory/4844-133-0x00000000058E0000-0x00000000058EA000-memory.dmpFilesize
40KB
-
memory/4844-134-0x0000000005B80000-0x0000000005C1C000-memory.dmpFilesize
624KB