Resubmissions

03-07-2024 16:04

240703-thygmaycpc 10

01-07-2024 18:12

240701-ws6xvswbkj 10

01-07-2024 18:03

240701-wm5sls1gka 10

01-07-2024 18:03

240701-wm39sa1gjf 10

01-07-2024 18:03

240701-wm2e7avhkj 10

01-07-2024 18:03

240701-wmzxcs1fre 10

01-07-2024 18:02

240701-wmzats1frc 10

01-07-2024 18:02

240701-wmvbwa1fqh 10

22-11-2023 17:02

231122-vkac9adg64 10

Analysis

  • max time kernel
    117s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    01-07-2024 18:03

General

  • Target

    2b5e50bc3077610128051bc3e657c3f0e331fb8fed2559c6596911890ea866ba.dll

  • Size

    183KB

  • MD5

    6d2864f9d3349fc4292884e7baab4bcc

  • SHA1

    b4e7df23ccd50f4d136f66e62d56815eab09e720

  • SHA256

    2b5e50bc3077610128051bc3e657c3f0e331fb8fed2559c6596911890ea866ba

  • SHA512

    dcfc50105df4ea00add6dc3d121baa3ff93180a0be71e444e89e3a8249d1fd2103eb34aa61aa57ada45c5a86ed5783a67e10f21eeb9dda802a49f627aaa0cec0

  • SSDEEP

    3072:V+EdIHvacHR4IJ1/eIvfHJKsopu5Zu1yiJ1nE8dFZfdcn0TctjCQ9gXaj0jjh3DL:V+aKvac72IfHJmpu5g1yUpE8dFZls0o6

Malware Config

Extracted

Family

zloader

Botnet

07/04

C2

https://xyajbocpggsr.site/wp-config.php

https://ooygvpxrb.pw/wp-config.php

Attributes
  • build_id

    131

rc4.plain

Signatures

  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2b5e50bc3077610128051bc3e657c3f0e331fb8fed2559c6596911890ea866ba.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2952
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\2b5e50bc3077610128051bc3e657c3f0e331fb8fed2559c6596911890ea866ba.dll
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:3012
      • C:\Windows\SysWOW64\msiexec.exe
        msiexec.exe
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2768

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2768-2-0x0000000000110000-0x0000000000111000-memory.dmp
    Filesize

    4KB

  • memory/2768-0-0x00000000000D0000-0x0000000000103000-memory.dmp
    Filesize

    204KB

  • memory/2768-4-0x00000000000D0000-0x0000000000103000-memory.dmp
    Filesize

    204KB

  • memory/2768-5-0x00000000000D0000-0x0000000000103000-memory.dmp
    Filesize

    204KB

  • memory/2768-8-0x00000000000D0000-0x0000000000103000-memory.dmp
    Filesize

    204KB

  • memory/2768-7-0x00000000000D0000-0x0000000000103000-memory.dmp
    Filesize

    204KB

  • memory/2768-10-0x00000000000D0000-0x0000000000103000-memory.dmp
    Filesize

    204KB