Analysis
-
max time kernel
125s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 23:37
Static task
static1
Behavioral task
behavioral1
Sample
dbeba2fb33aaba42768a5ed8055cc8ca4009ad1921319f90c78b78d4f0dd9f7b.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
dbeba2fb33aaba42768a5ed8055cc8ca4009ad1921319f90c78b78d4f0dd9f7b.dll
-
Size
489KB
-
MD5
8c293fe05b3af514723a1639810c06a3
-
SHA1
ac2f7668c7f3049930b52a83585ac479145cd059
-
SHA256
dbeba2fb33aaba42768a5ed8055cc8ca4009ad1921319f90c78b78d4f0dd9f7b
-
SHA512
2f8db26e93c54b08944a4080e55595f348090086f849fe427f6f07b17a8a57926b1e0d6481356feb0846af0c01ffbb06122750974d3f80e2ea3c465aab1acc23
Malware Config
Extracted
Family
zloader
Botnet
bot5
Campaign
bot5
C2
https://militanttra.at/owg.php
Attributes
-
build_id
15
rc4.plain
rsa_pubkey.plain
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 892 set thread context of 936 892 rundll32.exe msiexec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1944 wrote to memory of 892 1944 rundll32.exe rundll32.exe PID 1944 wrote to memory of 892 1944 rundll32.exe rundll32.exe PID 1944 wrote to memory of 892 1944 rundll32.exe rundll32.exe PID 1944 wrote to memory of 892 1944 rundll32.exe rundll32.exe PID 1944 wrote to memory of 892 1944 rundll32.exe rundll32.exe PID 1944 wrote to memory of 892 1944 rundll32.exe rundll32.exe PID 1944 wrote to memory of 892 1944 rundll32.exe rundll32.exe PID 892 wrote to memory of 936 892 rundll32.exe msiexec.exe PID 892 wrote to memory of 936 892 rundll32.exe msiexec.exe PID 892 wrote to memory of 936 892 rundll32.exe msiexec.exe PID 892 wrote to memory of 936 892 rundll32.exe msiexec.exe PID 892 wrote to memory of 936 892 rundll32.exe msiexec.exe PID 892 wrote to memory of 936 892 rundll32.exe msiexec.exe PID 892 wrote to memory of 936 892 rundll32.exe msiexec.exe PID 892 wrote to memory of 936 892 rundll32.exe msiexec.exe PID 892 wrote to memory of 936 892 rundll32.exe msiexec.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dbeba2fb33aaba42768a5ed8055cc8ca4009ad1921319f90c78b78d4f0dd9f7b.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dbeba2fb33aaba42768a5ed8055cc8ca4009ad1921319f90c78b78d4f0dd9f7b.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/892-54-0x0000000000000000-mapping.dmp
-
memory/892-55-0x0000000075441000-0x0000000075443000-memory.dmpFilesize
8KB
-
memory/892-57-0x0000000074A00000-0x0000000074A80000-memory.dmpFilesize
512KB
-
memory/892-56-0x0000000074A00000-0x0000000074A2B000-memory.dmpFilesize
172KB
-
memory/892-58-0x0000000074A00000-0x0000000074A80000-memory.dmpFilesize
512KB
-
memory/936-59-0x00000000000D0000-0x00000000000FB000-memory.dmpFilesize
172KB
-
memory/936-61-0x00000000000D0000-0x00000000000FB000-memory.dmpFilesize
172KB
-
memory/936-62-0x0000000000000000-mapping.dmp
-
memory/936-64-0x00000000000D0000-0x00000000000FB000-memory.dmpFilesize
172KB