Analysis
-
max time kernel
65s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
09-02-2023 02:28
Static task
static1
Behavioral task
behavioral1
Sample
entomology.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
entomology.dll
Resource
win10v2004-20220812-en
General
-
Target
entomology.dll
-
Size
225KB
-
MD5
96874e8ec64976899a1f7b90022f3e43
-
SHA1
ab33331de0ab0f9dddb2b8eb8e4e8c92b18a9c61
-
SHA256
badc87166cc28491dcae0164e7dc027aeb4b98eea5f765f776f58d8683cdec6a
-
SHA512
4e8bccc9fe9d507817f78950388a8726f95a5aafd9a9e192ef9e33871a67cb9d44ff56c4a0c03490c30e2d272ca08ba3819992bc21d810bc3885ac7f4cf5b63b
-
SSDEEP
3072:XPbq/XSqcbXdOg9gkx/yrNPwwApe6eIDK+C9iKy6K7kDlUzYak6ve432+fGxsN5w:jqKDXdOAgUKXvji7oDvaNm4mSGqe9d
Malware Config
Extracted
zloader
main
2020-06-12
https://matarlod.org/web/data
https://datearoc.org/web/data
https://rechnecy.org/web/data
https://ramissal.org/web/data
https://raidesci.org/web/data
https://glartrot.org/web/data
https://revenapo.org/web/data
https://brenonip.org/web/data
-
build_id
6
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 1712 set thread context of 1340 1712 rundll32.exe msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 1340 msiexec.exe Token: SeSecurityPrivilege 1340 msiexec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1108 wrote to memory of 1712 1108 rundll32.exe rundll32.exe PID 1108 wrote to memory of 1712 1108 rundll32.exe rundll32.exe PID 1108 wrote to memory of 1712 1108 rundll32.exe rundll32.exe PID 1108 wrote to memory of 1712 1108 rundll32.exe rundll32.exe PID 1108 wrote to memory of 1712 1108 rundll32.exe rundll32.exe PID 1108 wrote to memory of 1712 1108 rundll32.exe rundll32.exe PID 1108 wrote to memory of 1712 1108 rundll32.exe rundll32.exe PID 1712 wrote to memory of 1340 1712 rundll32.exe msiexec.exe PID 1712 wrote to memory of 1340 1712 rundll32.exe msiexec.exe PID 1712 wrote to memory of 1340 1712 rundll32.exe msiexec.exe PID 1712 wrote to memory of 1340 1712 rundll32.exe msiexec.exe PID 1712 wrote to memory of 1340 1712 rundll32.exe msiexec.exe PID 1712 wrote to memory of 1340 1712 rundll32.exe msiexec.exe PID 1712 wrote to memory of 1340 1712 rundll32.exe msiexec.exe PID 1712 wrote to memory of 1340 1712 rundll32.exe msiexec.exe PID 1712 wrote to memory of 1340 1712 rundll32.exe msiexec.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\entomology.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\entomology.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1340-58-0x0000000000090000-0x00000000000BC000-memory.dmpFilesize
176KB
-
memory/1340-60-0x0000000000090000-0x00000000000BC000-memory.dmpFilesize
176KB
-
memory/1340-61-0x0000000000000000-mapping.dmp
-
memory/1340-64-0x0000000000090000-0x00000000000BC000-memory.dmpFilesize
176KB
-
memory/1340-65-0x0000000000090000-0x00000000000BC000-memory.dmpFilesize
176KB
-
memory/1712-54-0x0000000000000000-mapping.dmp
-
memory/1712-55-0x0000000075771000-0x0000000075773000-memory.dmpFilesize
8KB
-
memory/1712-56-0x0000000000160000-0x000000000018A000-memory.dmpFilesize
168KB
-
memory/1712-57-0x0000000000410000-0x000000000043C000-memory.dmpFilesize
176KB
-
memory/1712-62-0x0000000000410000-0x000000000043C000-memory.dmpFilesize
176KB