Resubmissions

18-05-2024 14:39

240518-r1dttsgc3s 6

Analysis

  • max time kernel
    119s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    16-05-2024 22:52

General

  • Target

    4d68507752275a8607502b0ae14ef9a1_JaffaCakes118.exe

  • Size

    268KB

  • MD5

    4d68507752275a8607502b0ae14ef9a1

  • SHA1

    4e13b8267ca39e41b9dbf88dc3123fed37e409c0

  • SHA256

    6fee95a3e283d9ad09a399e99b086ef70c3679eb8ad548161bdfababe3da68fb

  • SHA512

    bbebbd027af9e953141efecbfde31137735d58e54ff26966475570c7414ddc03ee53636011fad404d60c8df0031a79d5f2b858819ded59428ead93a5d9732849

  • SSDEEP

    6144:dI4M7nO35HbqtMFurLa8BqUlv8TqE4TvLOJ5tEpo6LlE7:aj6qsE8UVk4TotEpNLlE

Malware Config

Extracted

Family

zloader

Botnet

saca

Campaign

adw2

C2

https://thoughtlibrary.top/library/topikpost.php

https://islacangrejo.fun/library/topikpost.php

Attributes
  • build_id

    1970759022

rc4.plain

Signatures

  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4d68507752275a8607502b0ae14ef9a1_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4d68507752275a8607502b0ae14ef9a1_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2888
    • C:\Windows\SysWOW64\msiexec.exe
      msiexec.exe
      2⤵
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      PID:2568

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2568-2-0x0000000000090000-0x00000000000B6000-memory.dmp

    Filesize

    152KB

  • memory/2568-4-0x00000000000C0000-0x00000000000C1000-memory.dmp

    Filesize

    4KB

  • memory/2568-6-0x0000000000090000-0x00000000000B6000-memory.dmp

    Filesize

    152KB

  • memory/2568-7-0x0000000000090000-0x00000000000B6000-memory.dmp

    Filesize

    152KB

  • memory/2568-9-0x0000000000090000-0x00000000000B6000-memory.dmp

    Filesize

    152KB

  • memory/2888-0-0x00000000013F0000-0x00000000013F1000-memory.dmp

    Filesize

    4KB

  • memory/2888-1-0x00000000013D0000-0x0000000001416000-memory.dmp

    Filesize

    280KB