Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 10:07
Static task
static1
Behavioral task
behavioral1
Sample
e6ff434fbb288fb16f228292d41ed7cad38d06eb091ef6b4ab5da61ac96de580.dll
Resource
win7-20220812-en
General
-
Target
e6ff434fbb288fb16f228292d41ed7cad38d06eb091ef6b4ab5da61ac96de580.dll
-
Size
274KB
-
MD5
d046de3d748585f4740f11f44c5e7c31
-
SHA1
2b04641bd67e7d4bc6170bbd05b33a33dea521da
-
SHA256
e6ff434fbb288fb16f228292d41ed7cad38d06eb091ef6b4ab5da61ac96de580
-
SHA512
8f5bbdd39a6932b7b30be8736e1d5f7df4d20b894a3396f18daa93b018f7fa0651d3d915d37a13f84359439e23060cd1f9ac12b7c5aeff8f2353b8e0422df6e1
-
SSDEEP
6144:sq0e5NP+8ZqKMLLnMxOl6sl4IgKW1rYxk4xJS4H1m3tz3qLWYemA:s2Cnj6sYS36aC
Malware Config
Extracted
zloader
kev
02/02
https://inservitudetothedivine.com/post.php
https://pebbleauto.com/post.php
https://ineenbeaudi.tk/post.php
-
build_id
325
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 1956 set thread context of 1192 1956 rundll32.exe msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 1192 msiexec.exe Token: SeSecurityPrivilege 1192 msiexec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1636 wrote to memory of 1956 1636 rundll32.exe rundll32.exe PID 1636 wrote to memory of 1956 1636 rundll32.exe rundll32.exe PID 1636 wrote to memory of 1956 1636 rundll32.exe rundll32.exe PID 1636 wrote to memory of 1956 1636 rundll32.exe rundll32.exe PID 1636 wrote to memory of 1956 1636 rundll32.exe rundll32.exe PID 1636 wrote to memory of 1956 1636 rundll32.exe rundll32.exe PID 1636 wrote to memory of 1956 1636 rundll32.exe rundll32.exe PID 1956 wrote to memory of 1192 1956 rundll32.exe msiexec.exe PID 1956 wrote to memory of 1192 1956 rundll32.exe msiexec.exe PID 1956 wrote to memory of 1192 1956 rundll32.exe msiexec.exe PID 1956 wrote to memory of 1192 1956 rundll32.exe msiexec.exe PID 1956 wrote to memory of 1192 1956 rundll32.exe msiexec.exe PID 1956 wrote to memory of 1192 1956 rundll32.exe msiexec.exe PID 1956 wrote to memory of 1192 1956 rundll32.exe msiexec.exe PID 1956 wrote to memory of 1192 1956 rundll32.exe msiexec.exe PID 1956 wrote to memory of 1192 1956 rundll32.exe msiexec.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e6ff434fbb288fb16f228292d41ed7cad38d06eb091ef6b4ab5da61ac96de580.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e6ff434fbb288fb16f228292d41ed7cad38d06eb091ef6b4ab5da61ac96de580.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1192-59-0x0000000000090000-0x00000000000B6000-memory.dmpFilesize
152KB
-
memory/1192-61-0x0000000000090000-0x00000000000B6000-memory.dmpFilesize
152KB
-
memory/1192-62-0x0000000000000000-mapping.dmp
-
memory/1192-64-0x0000000000090000-0x00000000000B6000-memory.dmpFilesize
152KB
-
memory/1192-66-0x0000000000090000-0x00000000000B6000-memory.dmpFilesize
152KB
-
memory/1956-54-0x0000000000000000-mapping.dmp
-
memory/1956-55-0x00000000762F1000-0x00000000762F3000-memory.dmpFilesize
8KB
-
memory/1956-56-0x0000000010000000-0x0000000012541000-memory.dmpFilesize
37.3MB
-
memory/1956-57-0x0000000002270000-0x00000000047AB000-memory.dmpFilesize
37.2MB
-
memory/1956-58-0x0000000010000000-0x0000000012541000-memory.dmpFilesize
37.3MB
-
memory/1956-65-0x0000000010000000-0x0000000012541000-memory.dmpFilesize
37.3MB