Resubmissions
05-11-2022 23:29
221105-3gsdnaabh2 1005-11-2022 15:13
221105-sl48xagdd3 1027-10-2022 06:35
221027-hcm8xsbce5 10Analysis
-
max time kernel
534s -
max time network
537s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27-10-2022 06:35
Behavioral task
behavioral1
Sample
e3932ab83bc05de2e91d321c4d479ff1aa3d10fdbd91e1687c80cc0ec88270e8.dll
Resource
win7-20220812-en
windows7-x64
General
-
Target
e3932ab83bc05de2e91d321c4d479ff1aa3d10fdbd91e1687c80cc0ec88270e8.dll
-
Size
111KB
-
MD5
e3564138588cba04c873bd054458f8b9
-
SHA1
157ec7421e1333b714d01a750b6d5d6517a92c45
-
SHA256
e3932ab83bc05de2e91d321c4d479ff1aa3d10fdbd91e1687c80cc0ec88270e8
-
SHA512
2a2e8ce45a928bcffdb40ebf6559c1f071bb3feccfd9cfe355e593acb559ecf84858cf4474708d311317ab08b3f981eba7c8b80dceae973839a0eec9049665c8
-
SSDEEP
1536:3ui/9Xb791Wff4K84oeRnobxxm2ShclQaLMin8F5vAC+WEQbAmTjTpeyv0+gPzff:H/J7jWHT/oegcaQF5XEgHbpeyvfgT
Malware Config
Extracted
zloader
DLLobnova
1017
https://fdsjfjdsfjdsjfdjsfh.com/gate.php
https://fdsjfjdsfjdsdsjajjs.com/gate.php
https://idisaudhasdhasdj.com/gate.php
https://dsjdjsjdsadhasdas.com/gate.php
https://dsdjfhdsufudhjas.com/gate.php
https://dsdjfhdsufudhjas.info/gate.php
https://fdsjfjdsfjdsdsjajjs.info/gate.php
https://idisaudhasdhasdj.info/gate.php
-
build_id
28
Signatures
-
Blocklisted process makes network request 64 IoCs
flow pid Process 25 4284 msiexec.exe 26 4284 msiexec.exe 31 4284 msiexec.exe 33 4284 msiexec.exe 35 4284 msiexec.exe 37 4284 msiexec.exe 39 4284 msiexec.exe 40 4284 msiexec.exe 41 4284 msiexec.exe 42 4284 msiexec.exe 43 4284 msiexec.exe 44 4284 msiexec.exe 48 4284 msiexec.exe 49 4284 msiexec.exe 50 4284 msiexec.exe 51 4284 msiexec.exe 52 4284 msiexec.exe 53 4284 msiexec.exe 55 4284 msiexec.exe 56 4284 msiexec.exe 57 4284 msiexec.exe 59 4284 msiexec.exe 61 4284 msiexec.exe 62 4284 msiexec.exe 63 4284 msiexec.exe 64 4284 msiexec.exe 65 4284 msiexec.exe 66 4284 msiexec.exe 67 4284 msiexec.exe 68 4284 msiexec.exe 69 4284 msiexec.exe 71 4284 msiexec.exe 72 4284 msiexec.exe 73 4284 msiexec.exe 74 4284 msiexec.exe 75 4284 msiexec.exe 76 4284 msiexec.exe 77 4284 msiexec.exe 78 4284 msiexec.exe 79 4284 msiexec.exe 80 4284 msiexec.exe 81 4284 msiexec.exe 82 4284 msiexec.exe 83 4284 msiexec.exe 84 4284 msiexec.exe 85 4284 msiexec.exe 86 4284 msiexec.exe 87 4284 msiexec.exe 88 4284 msiexec.exe 89 4284 msiexec.exe 90 4284 msiexec.exe 91 4284 msiexec.exe 92 4284 msiexec.exe 93 4284 msiexec.exe 94 4284 msiexec.exe 95 4284 msiexec.exe 96 4284 msiexec.exe 97 4284 msiexec.exe 98 4284 msiexec.exe 99 4284 msiexec.exe 100 4284 msiexec.exe 101 4284 msiexec.exe 102 4284 msiexec.exe 103 4284 msiexec.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ibcaobe = "rundll32.exe C:\\Users\\Admin\\AppData\\Roaming\\Yggad\\ugafbyyh.dll,DllRegisterServer" msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1948 set thread context of 4284 1948 regsvr32.exe 91 -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeSecurityPrivilege 4284 msiexec.exe Token: SeSecurityPrivilege 4284 msiexec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3456 wrote to memory of 1948 3456 regsvr32.exe 83 PID 3456 wrote to memory of 1948 3456 regsvr32.exe 83 PID 3456 wrote to memory of 1948 3456 regsvr32.exe 83 PID 1948 wrote to memory of 4284 1948 regsvr32.exe 91 PID 1948 wrote to memory of 4284 1948 regsvr32.exe 91 PID 1948 wrote to memory of 4284 1948 regsvr32.exe 91 PID 1948 wrote to memory of 4284 1948 regsvr32.exe 91 PID 1948 wrote to memory of 4284 1948 regsvr32.exe 91
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\e3932ab83bc05de2e91d321c4d479ff1aa3d10fdbd91e1687c80cc0ec88270e8.dll1⤵
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\e3932ab83bc05de2e91d321c4d479ff1aa3d10fdbd91e1687c80cc0ec88270e8.dll2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Blocklisted process makes network request
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:4284
-
-