Analysis
-
max time kernel
418s -
max time network
1142s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
17-11-2023 12:48
Static task
static1
Behavioral task
behavioral1
Sample
3648fe001994cb9c0a6b510213c268a6bd4761a3a99f3abb2738bf84f06d11cf.dll
Resource
win7-20231023-en
General
-
Target
3648fe001994cb9c0a6b510213c268a6bd4761a3a99f3abb2738bf84f06d11cf.dll
-
Size
512KB
-
MD5
fa9b3dfdb4b97dfe0db5991472f89399
-
SHA1
5677f26e926c8c8d7f7bf7eb085a9e48549a268b
-
SHA256
3648fe001994cb9c0a6b510213c268a6bd4761a3a99f3abb2738bf84f06d11cf
-
SHA512
e5ac96e3ef6ee9fa110b433c1c49a7f16f4ba6694ec76e10d31848ecd4f284b6845508979758a16121a63d6c4a1af2103268d6e03fbb1c6672005090d560cc74
-
SSDEEP
12288:7do6GchQc7N2h17L0/BRHdziwBAoXkW1SnyAP7:7O6G0Qc7Ne1c/BRH5JUfz
Malware Config
Extracted
zloader
miguel
20/04
https://dcaiqjgnbt.icu/wp-config.php
https://nmttxggtb.press/wp-config.php
-
build_id
165
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 2840 set thread context of 3444 2840 rundll32.exe msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 3444 msiexec.exe Token: SeSecurityPrivilege 3444 msiexec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 3860 wrote to memory of 2840 3860 rundll32.exe rundll32.exe PID 3860 wrote to memory of 2840 3860 rundll32.exe rundll32.exe PID 3860 wrote to memory of 2840 3860 rundll32.exe rundll32.exe PID 2840 wrote to memory of 3444 2840 rundll32.exe msiexec.exe PID 2840 wrote to memory of 3444 2840 rundll32.exe msiexec.exe PID 2840 wrote to memory of 3444 2840 rundll32.exe msiexec.exe PID 2840 wrote to memory of 3444 2840 rundll32.exe msiexec.exe PID 2840 wrote to memory of 3444 2840 rundll32.exe msiexec.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3648fe001994cb9c0a6b510213c268a6bd4761a3a99f3abb2738bf84f06d11cf.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3648fe001994cb9c0a6b510213c268a6bd4761a3a99f3abb2738bf84f06d11cf.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2840-0-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/2840-1-0x0000000001550000-0x0000000001551000-memory.dmpFilesize
4KB
-
memory/2840-2-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/2840-3-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/2840-6-0x0000000001550000-0x0000000001551000-memory.dmpFilesize
4KB
-
memory/2840-16-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/3444-15-0x0000000000C50000-0x0000000000C84000-memory.dmpFilesize
208KB
-
memory/3444-18-0x0000000000C50000-0x0000000000C84000-memory.dmpFilesize
208KB
-
memory/3444-19-0x0000000000C50000-0x0000000000C84000-memory.dmpFilesize
208KB