zloader | eafbd21a0f9f082fa2e94e010569d7fa8512d978087c2633d652b865b922465a

General

Target
zloader 2_1.0.8.0.vir.exe
Size 243KB
Sample200719-67twab9dcn
SHA256 eafbd21a0f9f082fa2e94e010569d7fa8512d978087c2633d652b865b922465a
MD5 8e73a8a4a35ebfcc3e900ec4255cb296
SHA1 21e475e46bc909b91942f564803cd7f90046bb8d
SHA512 facc951d177237088cf316772cb600e0e9f88b4eda2eba43768db55b2e6642e59b059505104010ab4ec3527c6294e7332b36dc50c909bed706d3ce557314efb3
MD5 SHA1 SHA512

Score

10^/10

persistence trojan botnet zloader

Malware Config

Extracted

Family

zloader

Botnet

uchit

Campaign

plohostuchit

C2

https://oajdasnndkdahm.com/gate.php
https://kdsidsiadsakfsas.com/gate.php
https://jdafiasfjsafahhfs.com/gate.php
https://dasifosafjasfhasf.com/gate.php
https://kasfajfsafhasfhaf.com/gate.php
https://fdsjfjdsfjdsjfdjsfh.com/gate.php
https://fdsjfjdsfjdsdsjajjs.com/gate.php
https://idisaudhasdhasdj.com/gate.php
https://dsjdjsjdsadhasdas.com/gate.php
https://dsdjfhdsufudhjas.com/gate.php

rc4.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Blacklisted process makes network request 5 IoCs

flow	pid	Process
15	1816	msiexec.exe
16	1816	msiexec.exe
17	1816	msiexec.exe
18	1816	msiexec.exe
19	1816	msiexec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\Hubaub = "C:\\Users\\Admin\\AppData\\Roaming\\Egbu\\ohbagua.exe"	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1500 set thread context of 1816	1500	zloader 2_1.0.8.0.vir.exe	26

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1816	msiexec.exe
Token: SeSecurityPrivilege	1816	msiexec.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 1816	1500	zloader 2_1.0.8.0.vir.exe	26
PID 1500 wrote to memory of 1816	1500	zloader 2_1.0.8.0.vir.exe	26
PID 1500 wrote to memory of 1816	1500	zloader 2_1.0.8.0.vir.exe	26
PID 1500 wrote to memory of 1816	1500	zloader 2_1.0.8.0.vir.exe	26
PID 1500 wrote to memory of 1816	1500	zloader 2_1.0.8.0.vir.exe	26
PID 1500 wrote to memory of 1816	1500	zloader 2_1.0.8.0.vir.exe	26
PID 1500 wrote to memory of 1816	1500	zloader 2_1.0.8.0.vir.exe	26
PID 1500 wrote to memory of 1816	1500	zloader 2_1.0.8.0.vir.exe	26
PID 1500 wrote to memory of 1816	1500	zloader 2_1.0.8.0.vir.exe	26

C:\Users\Admin\AppData\Local\Temp\zloader 2_1.0.8.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader 2_1.0.8.0.vir.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe
  2⤵
  - Blacklisted process makes network request
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:1816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1816-0-0x0000000000090000-0x00000000000BA000-memory.dmp

Download

memory/1816-1-0x00000000000C0000-0x00000000000C1000-memory.dmp

Download

memory/1816-2-0x0000000000090000-0x00000000000BA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads