eb62a2999e8fe9cc49685bd090564c29d1d81b642b2df67c7ac2c6c13e9efd8f | Triage

Analysis

max time kernel
9s
max time network
47s
platform
windows7_x64
resource
win7-20220414-en
submitted
20-05-2022 05:39

Sharing

Report Analysis Logs

General

Target

Conficker binaries/D9CB288F317124A0E63E3405ED290765.dll
Size

61KB
MD5

d9cb288f317124a0e63e3405ed290765
SHA1

5815b13044fc9248bf7c2dba771f0e6496d9e536
SHA256

bacc62584144981a57516b1bfcb4350d511f2fe89197a7605e3cdff645416dc1
SHA512

540bdca9e84ad7efd968f3eca59a6ccd35fb5f1a6df489b06b199a7d3075e8ba305554579d2a37734a38f33d4e0886797b75d5f34319a851d68add1b180f864b

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

Processes:

rundll32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\zbsigozs.sgt	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\zbsigozs.sgt	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1096 wrote to memory of 1352	1096	rundll32.exe	rundll32.exe
PID 1096 wrote to memory of 1352	1096	rundll32.exe	rundll32.exe
PID 1096 wrote to memory of 1352	1096	rundll32.exe	rundll32.exe
PID 1096 wrote to memory of 1352	1096	rundll32.exe	rundll32.exe
PID 1096 wrote to memory of 1352	1096	rundll32.exe	rundll32.exe
PID 1096 wrote to memory of 1352	1096	rundll32.exe	rundll32.exe
PID 1096 wrote to memory of 1352	1096	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Conficker binaries\D9CB288F317124A0E63E3405ED290765.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Conficker binaries\D9CB288F317124A0E63E3405ED290765.dll",#1
  2⤵
  - Drops file in System32 directory
  PID:1352

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1352-54-0x0000000000000000-mapping.dmp

Download
memory/1352-55-0x0000000075E51000-0x0000000075E53000-memory.dmp

Filesize
8KB

Download
memory/1352-59-0x0000000000120000-0x000000000013C000-memory.dmp

Filesize
112KB

Download
memory/1352-61-0x0000000000120000-0x000000000013C000-memory.dmp

Filesize
112KB

Download