Analysis
-
max time kernel
101s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
12-10-2022 19:28
Static task
static1
Behavioral task
behavioral1
Sample
invest_20.dll
Resource
win7-20220901-en
General
-
Target
invest_20.dll
-
Size
453KB
-
MD5
c9affd7934e4d9b4dec4c40b2a71a381
-
SHA1
aac940f9906034938cd657ed2ba21bc675e6ae20
-
SHA256
31cf42b2a7c5c558f44cfc67684cc344c17d4946d3a1e0b2cecb8eb58173cb2f
-
SHA512
82d18e7815ed38c07ca0b6ec82cb2e30451d0e02a9cd761e1d55d6f05955fac3df303d96bac89dea6dfa3b90def945ca413ae9854dd7b24fbcc18e6c6040f18a
-
SSDEEP
6144:JWm73CWN0OejuX3VR4YCrqGro3O32YHFhIaA1fjYDr1qhHkmviFJf0:JKGK6Vtiq0UOdFhqLYwP2Jf0
Malware Config
Extracted
zloader
goldhub
01.04.20
https://105711.com/docs.php
https://209711.com/process.php
https://106311.com/comegetsome.php
https://124331.com/success.php
-
build_id
42
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
msiexec.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Esaxub = "rundll32.exe C:\\Users\\Admin\\AppData\\Roaming\\Ozwa\\efqe.dll,DllRegisterServer" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 1080 set thread context of 1880 1080 rundll32.exe msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 1880 msiexec.exe Token: SeSecurityPrivilege 1880 msiexec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2016 wrote to memory of 1080 2016 rundll32.exe rundll32.exe PID 2016 wrote to memory of 1080 2016 rundll32.exe rundll32.exe PID 2016 wrote to memory of 1080 2016 rundll32.exe rundll32.exe PID 2016 wrote to memory of 1080 2016 rundll32.exe rundll32.exe PID 2016 wrote to memory of 1080 2016 rundll32.exe rundll32.exe PID 2016 wrote to memory of 1080 2016 rundll32.exe rundll32.exe PID 2016 wrote to memory of 1080 2016 rundll32.exe rundll32.exe PID 1080 wrote to memory of 1880 1080 rundll32.exe msiexec.exe PID 1080 wrote to memory of 1880 1080 rundll32.exe msiexec.exe PID 1080 wrote to memory of 1880 1080 rundll32.exe msiexec.exe PID 1080 wrote to memory of 1880 1080 rundll32.exe msiexec.exe PID 1080 wrote to memory of 1880 1080 rundll32.exe msiexec.exe PID 1080 wrote to memory of 1880 1080 rundll32.exe msiexec.exe PID 1080 wrote to memory of 1880 1080 rundll32.exe msiexec.exe PID 1080 wrote to memory of 1880 1080 rundll32.exe msiexec.exe PID 1080 wrote to memory of 1880 1080 rundll32.exe msiexec.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\invest_20.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\invest_20.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1080-54-0x0000000000000000-mapping.dmp
-
memory/1080-55-0x0000000075A71000-0x0000000075A73000-memory.dmpFilesize
8KB
-
memory/1080-57-0x00000000751D0000-0x000000007525C000-memory.dmpFilesize
560KB
-
memory/1080-56-0x00000000751D0000-0x0000000075200000-memory.dmpFilesize
192KB
-
memory/1080-58-0x00000000751D0000-0x000000007525C000-memory.dmpFilesize
560KB
-
memory/1080-63-0x00000000751D0000-0x000000007525C000-memory.dmpFilesize
560KB
-
memory/1880-59-0x00000000000F0000-0x0000000000120000-memory.dmpFilesize
192KB
-
memory/1880-61-0x00000000000F0000-0x0000000000120000-memory.dmpFilesize
192KB
-
memory/1880-62-0x0000000000000000-mapping.dmp
-
memory/1880-65-0x00000000000F0000-0x0000000000120000-memory.dmpFilesize
192KB
-
memory/1880-66-0x00000000000F0000-0x0000000000120000-memory.dmpFilesize
192KB