Analysis
-
max time kernel
95s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25-09-2024 21:28
Static task
static1
Behavioral task
behavioral1
Sample
acc5fe0088037ddc055f9286380c56583effa1186afe9d08caea3e197b2643fd.dll
Resource
win7-20240708-en
General
-
Target
acc5fe0088037ddc055f9286380c56583effa1186afe9d08caea3e197b2643fd.dll
-
Size
764KB
-
MD5
ebc6187124521528375d17372a16ae94
-
SHA1
1aee7da350e939d1686cd52c258f05270e63f990
-
SHA256
acc5fe0088037ddc055f9286380c56583effa1186afe9d08caea3e197b2643fd
-
SHA512
6e8f3dbc3a3121c00b6574558be8acc3331e7a8b7ca6aa2ae354d9d6ae62a69ffc3541f40b16cd0fb5364dd9f4ec430639a1ffaec987fa2d4dfd0850930f56f5
-
SSDEEP
12288:hnRMkNXTsN/ReZfzXizT4w59FYayoqtlZ/e:hRMklbfzXizT4aF9Atl
Malware Config
Extracted
zloader
17/03
https://dhteijwrb.host/milagrecf.php
https://aquolepp.pw/milagrecf.php
-
build_id
92
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msiexec.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Poode = "rundll32.exe C:\\Users\\Admin\\AppData\\Roaming\\Ytamy\\sioqr.dll,DllRegisterServer" msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 3576 set thread context of 1512 3576 rundll32.exe msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
rundll32.exemsiexec.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 1512 msiexec.exe Token: SeSecurityPrivilege 1512 msiexec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1056 wrote to memory of 3576 1056 rundll32.exe rundll32.exe PID 1056 wrote to memory of 3576 1056 rundll32.exe rundll32.exe PID 1056 wrote to memory of 3576 1056 rundll32.exe rundll32.exe PID 3576 wrote to memory of 1512 3576 rundll32.exe msiexec.exe PID 3576 wrote to memory of 1512 3576 rundll32.exe msiexec.exe PID 3576 wrote to memory of 1512 3576 rundll32.exe msiexec.exe PID 3576 wrote to memory of 1512 3576 rundll32.exe msiexec.exe PID 3576 wrote to memory of 1512 3576 rundll32.exe msiexec.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\acc5fe0088037ddc055f9286380c56583effa1186afe9d08caea3e197b2643fd.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\acc5fe0088037ddc055f9286380c56583effa1186afe9d08caea3e197b2643fd.dll,#12⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1512