Resubmissions

31-01-2024 21:42

240131-1ktpsadab6 10

24-01-2024 07:47

240124-jml92sdcd6 10

23-01-2024 11:54

240123-n25r6ahhfk 10

24-06-2020 13:36

200624-enc457kzrj 10

Analysis

  • max time kernel
    142s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-01-2024 21:42

General

  • Target

    A004BC8B4F3DB1EF5A66579B9746B5B1.dll

  • Size

    424KB

  • MD5

    a004bc8b4f3db1ef5a66579b9746b5b1

  • SHA1

    88a5fcebfd7a037a9ca9573772ac2334a61b25de

  • SHA256

    42bb5eae534eb2cea979c300b797a65febf291b28aea0b9d8bbea7d0a41bffa2

  • SHA512

    28aed111b2ecea90c2da03871f36272b8680d392c245fdf0e2f4d4454974a3a51d6744133cecfc2576bbc778742f9b824e8355026b53d029d13ff79bb2136f9b

  • SSDEEP

    6144:kQ0fpRug1NzpAhY2Zgi1ny2YT2oqCesyc+V6pDDW3FdREH5gH+xWz1:kQ0Rsg58Yti9y2voysiVmO3BlH+W

Malware Config

Extracted

Family

zloader

Botnet

June18newret

Campaign

June

C2

http://snnmnkxdhflwgthqismb.com/web/post.php

http://nlbmfsyplohyaicmxhum.com/web/post.php

http://softwareserviceupdater1.com/web/post.php

http://softwareserviceupdater2.com/web/post.php

Attributes
  • build_id

    3

rc4.plain
rsa_pubkey.plain

Signatures

  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\A004BC8B4F3DB1EF5A66579B9746B5B1.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1668
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\A004BC8B4F3DB1EF5A66579B9746B5B1.dll,#1
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:4856
      • C:\Windows\SysWOW64\msiexec.exe
        msiexec.exe
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3100-8-0x0000000000480000-0x00000000004AB000-memory.dmp

    Filesize

    172KB

  • memory/3100-11-0x0000000000480000-0x00000000004AB000-memory.dmp

    Filesize

    172KB

  • memory/4856-1-0x0000000010000000-0x0000000010F72000-memory.dmp

    Filesize

    15.4MB

  • memory/4856-2-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

    Filesize

    4KB

  • memory/4856-0-0x0000000010000000-0x0000000010F72000-memory.dmp

    Filesize

    15.4MB

  • memory/4856-3-0x0000000010000000-0x0000000010F72000-memory.dmp

    Filesize

    15.4MB

  • memory/4856-9-0x0000000010000000-0x0000000010F72000-memory.dmp

    Filesize

    15.4MB