Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
23-01-2024 18:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
please.dll
Resource
win7-20231215-en
windows7-x64
4 signatures
150 seconds
General
-
Target
please.dll
-
Size
482KB
-
MD5
e3149d4aa412560c17a6051d94b3960c
-
SHA1
755154ac9e1c2df88e92d7c17fbaa2e1ec29b9f8
-
SHA256
c19ccce75b409643dc722848f71132d580641d75432caed49d44aec358972ec7
-
SHA512
c6c7a211fec2a94feacc62211744108bb55e235cc7ddd3f948a3ccf87c7f32d7ff39b441e4367a675452ffbb744e13cd344bdbb0e60da1c7bfd8ce950cefb7ad
-
SSDEEP
6144:Bps0ZfRyzpQTM3juL0Fc8HMuThl3iouaNgOGg3jwgL0SR1Tct78gquLs:BpnZZy1zu0C8sutOaNhT4SR1Cgn
Malware Config
Extracted
Family
zloader
Botnet
bot5
Campaign
bot5
C2
https://militanttra.at/owg.php
Attributes
-
build_id
11
rc4.plain
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1896 set thread context of 3324 1896 rundll32.exe 97 -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeSecurityPrivilege 3324 msiexec.exe Token: SeSecurityPrivilege 3324 msiexec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4256 wrote to memory of 1896 4256 rundll32.exe 85 PID 4256 wrote to memory of 1896 4256 rundll32.exe 85 PID 4256 wrote to memory of 1896 4256 rundll32.exe 85 PID 1896 wrote to memory of 3324 1896 rundll32.exe 97 PID 1896 wrote to memory of 3324 1896 rundll32.exe 97 PID 1896 wrote to memory of 3324 1896 rundll32.exe 97 PID 1896 wrote to memory of 3324 1896 rundll32.exe 97 PID 1896 wrote to memory of 3324 1896 rundll32.exe 97
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\please.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\please.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3324
-
-