Analysis
-
max time kernel
105s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
16-05-2022 02:15
Static task
static1
Behavioral task
behavioral1
Sample
903c3b246b516395e8aaca0c647d496005d9d6609107f7f67a061b5390608010.dll
Resource
win7-20220414-en
General
-
Target
903c3b246b516395e8aaca0c647d496005d9d6609107f7f67a061b5390608010.dll
-
Size
448KB
-
MD5
8a46f0c4be8a91b533142a112618a885
-
SHA1
32a765a9a32ec7065087b172607e0f9a8119fc20
-
SHA256
903c3b246b516395e8aaca0c647d496005d9d6609107f7f67a061b5390608010
-
SHA512
54a9c56d0b18779fc6d7c54f5b01bdf8cb2d830f7b035de2817950b90c1f363f1ad0a6a46db66fc0470c0e7b5c221d35cbe69752afbfb56560caaa42f06e7e5e
Malware Config
Extracted
zloader
bat1k3
bat1k3
http://ad123234234.in/LKhwojehDgwegSDG/gateJKjdsh.php
http://ad123234234.info/LKhwojehDgwegSDG/gateJKjdsh.php
http://ad123234234.net/LKhwojehDgwegSDG/gateJKjdsh.php
http://ad123234234.org/LKhwojehDgwegSDG/gateJKjdsh.php
http://ad123234234.xyz/LKhwojehDgwegSDG/gateJKjdsh.php
-
build_id
29
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 1712 created 1232 1712 regsvr32.exe 11 -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1712 set thread context of 2004 1712 regsvr32.exe 29 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1712 regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1712 regsvr32.exe Token: SeSecurityPrivilege 2004 msiexec.exe Token: SeSecurityPrivilege 2004 msiexec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 868 wrote to memory of 1712 868 regsvr32.exe 28 PID 868 wrote to memory of 1712 868 regsvr32.exe 28 PID 868 wrote to memory of 1712 868 regsvr32.exe 28 PID 868 wrote to memory of 1712 868 regsvr32.exe 28 PID 868 wrote to memory of 1712 868 regsvr32.exe 28 PID 868 wrote to memory of 1712 868 regsvr32.exe 28 PID 868 wrote to memory of 1712 868 regsvr32.exe 28 PID 1712 wrote to memory of 2004 1712 regsvr32.exe 29 PID 1712 wrote to memory of 2004 1712 regsvr32.exe 29 PID 1712 wrote to memory of 2004 1712 regsvr32.exe 29 PID 1712 wrote to memory of 2004 1712 regsvr32.exe 29 PID 1712 wrote to memory of 2004 1712 regsvr32.exe 29 PID 1712 wrote to memory of 2004 1712 regsvr32.exe 29 PID 1712 wrote to memory of 2004 1712 regsvr32.exe 29 PID 1712 wrote to memory of 2004 1712 regsvr32.exe 29 PID 1712 wrote to memory of 2004 1712 regsvr32.exe 29
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1232
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\903c3b246b516395e8aaca0c647d496005d9d6609107f7f67a061b5390608010.dll2⤵
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\903c3b246b516395e8aaca0c647d496005d9d6609107f7f67a061b5390608010.dll3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1712
-
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2004
-