zloader | 121d7fc3a0a43a6ef4b73f564175b92727281155b221ff6f34c00d73438b679e

Resubmissions

23-01-2024 11:25

240123-njkn9saeb5 10

26-06-2020 08:43

200626-2199vtd32x 10

Analysis

max time kernel
150s
max time network
142s
platform
windows10_x64
resource
win10v200430
submitted
26-06-2020 08:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JEsNEuI.dll
Size

356KB
MD5

9eea7a0571baf33fa6877e8f8ebb3ad7
SHA1

9a7738f3f73d78d9fe18ba5401081d27f4222c8d
SHA256

121d7fc3a0a43a6ef4b73f564175b92727281155b221ff6f34c00d73438b679e
SHA512

90b6440f8c0fd2946eb5e47882aaf6b608fc900e9684daf4da74579d8863e83d26be7d27e2e074a98fdf631f2e9d44bc3e79a619ef88db009ade73516afa3e94

Score

10^/10

spyware trojan botnet zloader

Malware Config

Signatures

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 1828	1648	rundll32.exe	69
PID 1648 wrote to memory of 1828	1648	rundll32.exe	69
PID 1648 wrote to memory of 1828	1648	rundll32.exe	69
PID 1828 wrote to memory of 2800	1828	rundll32.exe	73
PID 1828 wrote to memory of 2800	1828	rundll32.exe	73
PID 1828 wrote to memory of 2800	1828	rundll32.exe	73
PID 1828 wrote to memory of 2800	1828	rundll32.exe	73
PID 1828 wrote to memory of 2800	1828	rundll32.exe	73
PID 2800 wrote to memory of 4024	2800	msiexec.exe	74
PID 2800 wrote to memory of 4024	2800	msiexec.exe	74
PID 2800 wrote to memory of 4024	2800	msiexec.exe	74
PID 4024 wrote to memory of 492	4024	cmd.exe	76
PID 4024 wrote to memory of 492	4024	cmd.exe	76
PID 4024 wrote to memory of 492	4024	cmd.exe	76
PID 2800 wrote to memory of 2292	2800	msiexec.exe	77
PID 2800 wrote to memory of 2292	2800	msiexec.exe	77
PID 2800 wrote to memory of 2292	2800	msiexec.exe	77
PID 2292 wrote to memory of 1456	2292	cmd.exe	79
PID 2292 wrote to memory of 1456	2292	cmd.exe	79
PID 2292 wrote to memory of 1456	2292	cmd.exe	79
PID 1456 wrote to memory of 356	1456	net.exe	80
PID 1456 wrote to memory of 356	1456	net.exe	80
PID 1456 wrote to memory of 356	1456	net.exe	80
PID 2800 wrote to memory of 3908	2800	msiexec.exe	81
PID 2800 wrote to memory of 3908	2800	msiexec.exe	81
PID 2800 wrote to memory of 3908	2800	msiexec.exe	81
PID 3908 wrote to memory of 1988	3908	cmd.exe	83
PID 3908 wrote to memory of 1988	3908	cmd.exe	83
PID 3908 wrote to memory of 1988	3908	cmd.exe	83
PID 2800 wrote to memory of 3760	2800	msiexec.exe	84
PID 2800 wrote to memory of 3760	2800	msiexec.exe	84
PID 2800 wrote to memory of 3760	2800	msiexec.exe	84
PID 3760 wrote to memory of 2304	3760	cmd.exe	86
PID 3760 wrote to memory of 2304	3760	cmd.exe	86
PID 3760 wrote to memory of 2304	3760	cmd.exe	86

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1828 set thread context of 2800	1828	rundll32.exe	73

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2800	msiexec.exe
Token: SeSecurityPrivilege	2800	msiexec.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2800	msiexec.exe
2800	msiexec.exe
2800	msiexec.exe
2800	msiexec.exe
2800	msiexec.exe
2800	msiexec.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
Runs net.exe

Blacklisted process makes network request 18 IoCs

flow	pid	Process
8	2800	msiexec.exe
9	2800	msiexec.exe
10	2800	msiexec.exe
11	2800	msiexec.exe
12	2800	msiexec.exe
13	2800	msiexec.exe
14	2800	msiexec.exe
15	2800	msiexec.exe
16	2800	msiexec.exe
17	2800	msiexec.exe
18	2800	msiexec.exe
19	2800	msiexec.exe
20	2800	msiexec.exe
21	2800	msiexec.exe
22	2800	msiexec.exe
23	2800	msiexec.exe
24	2800	msiexec.exe
25	2800	msiexec.exe

Discovers systems in the same network 1 TTPs 2 IoCs

discovery

Remote System Discovery

T1018

pid	Process
1988	net.exe
2304	net.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JEsNEuI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\JEsNEuI.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  - Suspicious use of SetThreadContext
  PID:1828
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: EnumeratesProcesses
    - Blacklisted process makes network request
    PID:2800
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c ipconfig /all
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4024
    - - C:\Windows\SysWOW64\ipconfig.exe
        
        ipconfig /all
        5⤵
        
        PID:492
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net config workstation
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2292
    - - C:\Windows\SysWOW64\net.exe
        
        net config workstation
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1456
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 config workstation
        6⤵
        
        PID:356
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net view /all
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3908
    - - C:\Windows\SysWOW64\net.exe
        
        net view /all
        5⤵
        Discovers systems in the same network
        
        PID:1988
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net view /all /domain
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3760
    - - C:\Windows\SysWOW64\net.exe
        
        net view /all /domain
        5⤵
        Discovers systems in the same network
        
        PID:2304

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2800-1-0x0000000002DD0000-0x0000000002DFB000-memory.dmp

Filesize
172KB

Download