Resubmissions
05-11-2022 23:29
221105-3gsdnaabh2 1005-11-2022 15:13
221105-sl48xagdd3 1027-10-2022 06:35
221027-hcm8xsbce5 10Analysis
-
max time kernel
581s -
max time network
584s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27-10-2022 06:35
Behavioral task
behavioral1
Sample
e3932ab83bc05de2e91d321c4d479ff1aa3d10fdbd91e1687c80cc0ec88270e8.dll
Resource
win7-20220812-en
windows7-x64
6 signatures
600 seconds
General
-
Target
e3932ab83bc05de2e91d321c4d479ff1aa3d10fdbd91e1687c80cc0ec88270e8.dll
-
Size
111KB
-
MD5
e3564138588cba04c873bd054458f8b9
-
SHA1
157ec7421e1333b714d01a750b6d5d6517a92c45
-
SHA256
e3932ab83bc05de2e91d321c4d479ff1aa3d10fdbd91e1687c80cc0ec88270e8
-
SHA512
2a2e8ce45a928bcffdb40ebf6559c1f071bb3feccfd9cfe355e593acb559ecf84858cf4474708d311317ab08b3f981eba7c8b80dceae973839a0eec9049665c8
-
SSDEEP
1536:3ui/9Xb791Wff4K84oeRnobxxm2ShclQaLMin8F5vAC+WEQbAmTjTpeyv0+gPzff:H/J7jWHT/oegcaQF5XEgHbpeyvfgT
Malware Config
Extracted
Family
zloader
Botnet
DLLobnova
Campaign
1017
C2
https://fdsjfjdsfjdsjfdjsfh.com/gate.php
https://fdsjfjdsfjdsdsjajjs.com/gate.php
https://idisaudhasdhasdj.com/gate.php
https://dsjdjsjdsadhasdas.com/gate.php
https://dsdjfhdsufudhjas.com/gate.php
https://dsdjfhdsufudhjas.info/gate.php
https://fdsjfjdsfjdsdsjajjs.info/gate.php
https://idisaudhasdhasdj.info/gate.php
Attributes
-
build_id
28
rc4.plain
Signatures
-
Blocklisted process makes network request 64 IoCs
flow pid Process 5 1696 msiexec.exe 7 1696 msiexec.exe 9 1696 msiexec.exe 11 1696 msiexec.exe 13 1696 msiexec.exe 15 1696 msiexec.exe 17 1696 msiexec.exe 19 1696 msiexec.exe 20 1696 msiexec.exe 21 1696 msiexec.exe 22 1696 msiexec.exe 23 1696 msiexec.exe 24 1696 msiexec.exe 25 1696 msiexec.exe 26 1696 msiexec.exe 27 1696 msiexec.exe 28 1696 msiexec.exe 29 1696 msiexec.exe 30 1696 msiexec.exe 31 1696 msiexec.exe 32 1696 msiexec.exe 33 1696 msiexec.exe 34 1696 msiexec.exe 35 1696 msiexec.exe 36 1696 msiexec.exe 37 1696 msiexec.exe 38 1696 msiexec.exe 40 1696 msiexec.exe 42 1696 msiexec.exe 43 1696 msiexec.exe 44 1696 msiexec.exe 45 1696 msiexec.exe 46 1696 msiexec.exe 47 1696 msiexec.exe 48 1696 msiexec.exe 49 1696 msiexec.exe 50 1696 msiexec.exe 51 1696 msiexec.exe 52 1696 msiexec.exe 53 1696 msiexec.exe 54 1696 msiexec.exe 55 1696 msiexec.exe 56 1696 msiexec.exe 57 1696 msiexec.exe 58 1696 msiexec.exe 59 1696 msiexec.exe 60 1696 msiexec.exe 61 1696 msiexec.exe 62 1696 msiexec.exe 64 1696 msiexec.exe 65 1696 msiexec.exe 66 1696 msiexec.exe 67 1696 msiexec.exe 68 1696 msiexec.exe 69 1696 msiexec.exe 70 1696 msiexec.exe 71 1696 msiexec.exe 72 1696 msiexec.exe 73 1696 msiexec.exe 74 1696 msiexec.exe 75 1696 msiexec.exe 76 1696 msiexec.exe 77 1696 msiexec.exe 78 1696 msiexec.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Cegu = "rundll32.exe C:\\Users\\Admin\\AppData\\Roaming\\Didi\\edfoacyb.dll,DllRegisterServer" msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1988 set thread context of 1696 1988 regsvr32.exe 28 -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeSecurityPrivilege 1696 msiexec.exe Token: SeSecurityPrivilege 1696 msiexec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1048 wrote to memory of 1988 1048 regsvr32.exe 27 PID 1048 wrote to memory of 1988 1048 regsvr32.exe 27 PID 1048 wrote to memory of 1988 1048 regsvr32.exe 27 PID 1048 wrote to memory of 1988 1048 regsvr32.exe 27 PID 1048 wrote to memory of 1988 1048 regsvr32.exe 27 PID 1048 wrote to memory of 1988 1048 regsvr32.exe 27 PID 1048 wrote to memory of 1988 1048 regsvr32.exe 27 PID 1988 wrote to memory of 1696 1988 regsvr32.exe 28 PID 1988 wrote to memory of 1696 1988 regsvr32.exe 28 PID 1988 wrote to memory of 1696 1988 regsvr32.exe 28 PID 1988 wrote to memory of 1696 1988 regsvr32.exe 28 PID 1988 wrote to memory of 1696 1988 regsvr32.exe 28 PID 1988 wrote to memory of 1696 1988 regsvr32.exe 28 PID 1988 wrote to memory of 1696 1988 regsvr32.exe 28 PID 1988 wrote to memory of 1696 1988 regsvr32.exe 28 PID 1988 wrote to memory of 1696 1988 regsvr32.exe 28
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\e3932ab83bc05de2e91d321c4d479ff1aa3d10fdbd91e1687c80cc0ec88270e8.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\e3932ab83bc05de2e91d321c4d479ff1aa3d10fdbd91e1687c80cc0ec88270e8.dll2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Blocklisted process makes network request
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1696
-
-