Analysis
-
max time kernel
482s -
max time network
485s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27-10-2022 06:35
Behavioral task
behavioral1
Sample
bd882e2eefd0145ff169d868c1815df272f84a5ad1e501cfa5c3336839774171_unpacked.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
bd882e2eefd0145ff169d868c1815df272f84a5ad1e501cfa5c3336839774171_unpacked.exe
Resource
win10v2004-20220812-en
General
-
Target
bd882e2eefd0145ff169d868c1815df272f84a5ad1e501cfa5c3336839774171_unpacked.exe
-
Size
119KB
-
MD5
8af1f18ed86898a92c5e20d9d3abaf7a
-
SHA1
e789544575c2a0a74524ab50fc47d348af876093
-
SHA256
bd882e2eefd0145ff169d868c1815df272f84a5ad1e501cfa5c3336839774171
-
SHA512
ac12219195622d65790a63c405a32c0b9f38fe74e7492cb7894d934b84792e22c25ba3453cdcd7fc9e228190082b0e132bce167e0e6e4c10aeea804ac2a168c2
-
SSDEEP
3072:7LnLvYuSYOkboKxL35ouXgkfMVtViEoW:XLYuSYIKxDwLj
Malware Config
Extracted
zloader
-
build_id
3238765
Signatures
-
Blocklisted process makes network request 15 IoCs
Processes:
msiexec.exeflow pid process 8 4456 msiexec.exe 9 4456 msiexec.exe 10 4456 msiexec.exe 11 4456 msiexec.exe 12 4456 msiexec.exe 42 4456 msiexec.exe 43 4456 msiexec.exe 44 4456 msiexec.exe 45 4456 msiexec.exe 46 4456 msiexec.exe 50 4456 msiexec.exe 51 4456 msiexec.exe 52 4456 msiexec.exe 53 4456 msiexec.exe 54 4456 msiexec.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Duigidid = "C:\\Users\\Admin\\AppData\\Roaming\\Hoogc\\dyobice.exe" msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
bd882e2eefd0145ff169d868c1815df272f84a5ad1e501cfa5c3336839774171_unpacked.exedescription pid process target process PID 5040 set thread context of 4456 5040 bd882e2eefd0145ff169d868c1815df272f84a5ad1e501cfa5c3336839774171_unpacked.exe msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 4456 msiexec.exe Token: SeSecurityPrivilege 4456 msiexec.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
bd882e2eefd0145ff169d868c1815df272f84a5ad1e501cfa5c3336839774171_unpacked.exedescription pid process target process PID 5040 wrote to memory of 4456 5040 bd882e2eefd0145ff169d868c1815df272f84a5ad1e501cfa5c3336839774171_unpacked.exe msiexec.exe PID 5040 wrote to memory of 4456 5040 bd882e2eefd0145ff169d868c1815df272f84a5ad1e501cfa5c3336839774171_unpacked.exe msiexec.exe PID 5040 wrote to memory of 4456 5040 bd882e2eefd0145ff169d868c1815df272f84a5ad1e501cfa5c3336839774171_unpacked.exe msiexec.exe PID 5040 wrote to memory of 4456 5040 bd882e2eefd0145ff169d868c1815df272f84a5ad1e501cfa5c3336839774171_unpacked.exe msiexec.exe PID 5040 wrote to memory of 4456 5040 bd882e2eefd0145ff169d868c1815df272f84a5ad1e501cfa5c3336839774171_unpacked.exe msiexec.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd882e2eefd0145ff169d868c1815df272f84a5ad1e501cfa5c3336839774171_unpacked.exe"C:\Users\Admin\AppData\Local\Temp\bd882e2eefd0145ff169d868c1815df272f84a5ad1e501cfa5c3336839774171_unpacked.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe2⤵
- Blocklisted process makes network request
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4456-132-0x0000000000000000-mapping.dmp
-
memory/4456-133-0x00000000009B0000-0x00000000009D2000-memory.dmpFilesize
136KB
-
memory/4456-134-0x00000000009B0000-0x00000000009D2000-memory.dmpFilesize
136KB
-
memory/4456-135-0x00000000009B0000-0x00000000009D2000-memory.dmpFilesize
136KB