Analysis
-
max time kernel
490s -
max time network
492s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27-10-2022 06:35
Behavioral task
behavioral1
Sample
f1bdd2bcbaf40bb99224fa293edc1581fd124da63c035657918877901d79bed8_unpacked.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f1bdd2bcbaf40bb99224fa293edc1581fd124da63c035657918877901d79bed8_unpacked.dll
Resource
win10v2004-20220812-en
General
-
Target
f1bdd2bcbaf40bb99224fa293edc1581fd124da63c035657918877901d79bed8_unpacked.dll
-
Size
144KB
-
MD5
eb8439d5ee379f19d25c2445d28e135a
-
SHA1
5426510acb07efc464c47bbe0cc413489365a3d9
-
SHA256
384f3719ba4fbcf355cc206e27f3bfca94e7bf14dd928de62ab5f74de90df34a
-
SHA512
5bbda761ff6c0286d346dd0fda5df2abeeb6ffb81149d0537db969feb682658dc1e5a75bb1d09a13398b26fee4163ace7d35bbd69196628b3daef53c0efdc982
-
SSDEEP
3072:c2kHDNNqo9hPNER+/2p1Ludye/w4FeNqEKJ7exog/Dt5eFSbvth90:cZHRNNbuc2HLxrgL7exx5ecv
Malware Config
Extracted
zloader
-
build_id
49
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bucyyb = "rundll32.exe C:\\Users\\Admin\\AppData\\Roaming\\Dyfue\\aggaydb.dll,DllRegisterServer" msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1164 set thread context of 5004 1164 regsvr32.exe msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 5004 msiexec.exe Token: SeSecurityPrivilege 5004 msiexec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 2860 wrote to memory of 1164 2860 regsvr32.exe regsvr32.exe PID 2860 wrote to memory of 1164 2860 regsvr32.exe regsvr32.exe PID 2860 wrote to memory of 1164 2860 regsvr32.exe regsvr32.exe PID 1164 wrote to memory of 5004 1164 regsvr32.exe msiexec.exe PID 1164 wrote to memory of 5004 1164 regsvr32.exe msiexec.exe PID 1164 wrote to memory of 5004 1164 regsvr32.exe msiexec.exe PID 1164 wrote to memory of 5004 1164 regsvr32.exe msiexec.exe PID 1164 wrote to memory of 5004 1164 regsvr32.exe msiexec.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\f1bdd2bcbaf40bb99224fa293edc1581fd124da63c035657918877901d79bed8_unpacked.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\f1bdd2bcbaf40bb99224fa293edc1581fd124da63c035657918877901d79bed8_unpacked.dll2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1164-132-0x0000000000000000-mapping.dmp
-
memory/5004-133-0x0000000000000000-mapping.dmp
-
memory/5004-134-0x0000000000670000-0x0000000000699000-memory.dmpFilesize
164KB
-
memory/5004-135-0x0000000000670000-0x0000000000699000-memory.dmpFilesize
164KB
-
memory/5004-136-0x0000000000670000-0x0000000000699000-memory.dmpFilesize
164KB