Analysis
-
max time kernel
135s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
24-06-2022 22:52
Static task
static1
Behavioral task
behavioral1
Sample
dbe9477ae91c832c2f8749829b9300435efda9299c6dd2b1bd06d49452083827.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
dbe9477ae91c832c2f8749829b9300435efda9299c6dd2b1bd06d49452083827.dll
-
Size
648KB
-
MD5
041ebd55472e90b6539ed5d520c01f99
-
SHA1
94cd854b532681dfce63dcd26275ffe735c2cfc2
-
SHA256
dbe9477ae91c832c2f8749829b9300435efda9299c6dd2b1bd06d49452083827
-
SHA512
371e5d64c9857b5c417a1080f97911a24c0001d60a989052bafe336264b1a858304f7abb1944de6d799e5e8019c78c32e58103d64dc32ee731cd14e2e33856d7
Malware Config
Extracted
Family
zloader
Botnet
miguel
Campaign
10/04
C2
https://gynrhcoe.pw/wp-config.php
https://wlqaqife.icu/wp-config.php
Attributes
-
build_id
142
rc4.plain
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 1752 set thread context of 1224 1752 rundll32.exe msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 1224 msiexec.exe Token: SeSecurityPrivilege 1224 msiexec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1976 wrote to memory of 1752 1976 rundll32.exe rundll32.exe PID 1976 wrote to memory of 1752 1976 rundll32.exe rundll32.exe PID 1976 wrote to memory of 1752 1976 rundll32.exe rundll32.exe PID 1976 wrote to memory of 1752 1976 rundll32.exe rundll32.exe PID 1976 wrote to memory of 1752 1976 rundll32.exe rundll32.exe PID 1976 wrote to memory of 1752 1976 rundll32.exe rundll32.exe PID 1976 wrote to memory of 1752 1976 rundll32.exe rundll32.exe PID 1752 wrote to memory of 1224 1752 rundll32.exe msiexec.exe PID 1752 wrote to memory of 1224 1752 rundll32.exe msiexec.exe PID 1752 wrote to memory of 1224 1752 rundll32.exe msiexec.exe PID 1752 wrote to memory of 1224 1752 rundll32.exe msiexec.exe PID 1752 wrote to memory of 1224 1752 rundll32.exe msiexec.exe PID 1752 wrote to memory of 1224 1752 rundll32.exe msiexec.exe PID 1752 wrote to memory of 1224 1752 rundll32.exe msiexec.exe PID 1752 wrote to memory of 1224 1752 rundll32.exe msiexec.exe PID 1752 wrote to memory of 1224 1752 rundll32.exe msiexec.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dbe9477ae91c832c2f8749829b9300435efda9299c6dd2b1bd06d49452083827.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dbe9477ae91c832c2f8749829b9300435efda9299c6dd2b1bd06d49452083827.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1224-59-0x0000000000130000-0x0000000000164000-memory.dmpFilesize
208KB
-
memory/1224-61-0x0000000000130000-0x0000000000164000-memory.dmpFilesize
208KB
-
memory/1224-62-0x0000000000000000-mapping.dmp
-
memory/1224-65-0x0000000000130000-0x0000000000164000-memory.dmpFilesize
208KB
-
memory/1224-66-0x0000000000130000-0x0000000000164000-memory.dmpFilesize
208KB
-
memory/1752-54-0x0000000000000000-mapping.dmp
-
memory/1752-55-0x00000000750C1000-0x00000000750C3000-memory.dmpFilesize
8KB
-
memory/1752-56-0x0000000074960000-0x0000000074994000-memory.dmpFilesize
208KB
-
memory/1752-57-0x0000000074960000-0x0000000074A19000-memory.dmpFilesize
740KB
-
memory/1752-58-0x0000000074960000-0x0000000074A19000-memory.dmpFilesize
740KB
-
memory/1752-63-0x0000000074960000-0x0000000074A19000-memory.dmpFilesize
740KB