Resubmissions
03-08-2023 07:52
230803-jqkwdsca99 1027-07-2023 11:24
230727-nhyvhaec35 1026-12-2022 13:39
221226-qx588sgb9y 1026-12-2022 13:39
221226-qx1zhsgb9x 1026-12-2022 13:38
221226-qxxbbsda57 1026-12-2022 13:38
221226-qxjp8sda56 10Analysis
-
max time kernel
71s -
max time network
120s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
-
submitted
26-12-2022 13:39
General
-
Target
cad0968f5ab3bedeffef68bbe18f92946fb97967cef59970157029480ed15bb9.exe
-
Size
139KB
-
MD5
d91b498e5fc6c91e1e86b339407b58f7
-
SHA1
369e3c4646a69b99a797e0e288fd3145e2a6f35a
-
SHA256
cad0968f5ab3bedeffef68bbe18f92946fb97967cef59970157029480ed15bb9
-
SHA512
b981f7c4857327708233bf7e44bfb485c1cc7148ca850a63b12f854215edb583f5a499109d67b94f213226d23d0f4e0e5d04b888193fa5e799e30f051e9c9dbd
-
SSDEEP
3072:XBkH2At/3YyzX2OpphkGYI+C9AwcOZBJ7zk:n6/IAFkCDc+BJ7w
Malware Config
Extracted
zloader
vlenie10
obnova10
https://kdsidsiadsakfsas.com/gate.php
https://jdafiasfjsafahhfs.com/gate.php
https://dasifosafjasfhasf.com/gate.php
https://kasfajfsafhasfhaf.com/gate.php
https://fdsjfjdsfjdsjfdjsfh.com/gate.php
https://fdsjfjdsfjdsdsjajjs.com/gate.php
https://idisaudhasdhasdj.com/gate.php
https://dsjdjsjdsadhasdas.com/gate.php
https://dsdjfhdsufudhjas.com/gate.php
-
build_id
1869505135
Signatures
-
Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
-
Blocklisted process makes network request 10 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates system info in registry 2 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cad0968f5ab3bedeffef68bbe18f92946fb97967cef59970157029480ed15bb9.exe"C:\Users\Admin\AppData\Local\Temp\cad0968f5ab3bedeffef68bbe18f92946fb97967cef59970157029480ed15bb9.exe"1⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe2⤵
- Blocklisted process makes network request
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
152KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
152KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
152KB
-
Filesize
128KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
128KB
-
Filesize
128KB