zloader | 21f41071eb31d4b4f2fb1e5d9be035014b1302313804e46077ca23da0dd30bc8

Resubmissions

19-07-2023 11:14

230719-nb99yscg87 10

19-07-2020 19:33

200719-m964m1njqe 10

Analysis

max time kernel
150s
max time network
142s
platform
windows7_x64
resource
win7v200430
submitted
19-07-2020 19:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

zloader 2_1.0.13.0.vir.exe
Size

154KB
MD5

07e6b50724981e0c96f7d23f48d309b5
SHA1

0c012857690e0eebf10eb0ccafcbad9434f99d91
SHA256

21f41071eb31d4b4f2fb1e5d9be035014b1302313804e46077ca23da0dd30bc8
SHA512

e930617c54fee9fbc9cfb37d6a014e808556f55306d50e2b83c81ef9478772ff4be4e86d55f03879ab5d0cba6a796268dbfb9ac06b2350502bbf56286dc83102

Score

10^/10

persistence trojan botnet zloader

Malware Config

Extracted

Family

zloader

Botnet

vlenie2020

Campaign

obnova20

https://dasifosafjasfhasf.com/gate.php

https://kasfajfsafhasfhaf.com/gate.php

https://fdsjfjdsfjdsjfdjsfh.com/gate.php

https://fdsjfjdsfjdsdsjajjs.com/gate.php

https://idisaudhasdhasdj.com/gate.php

https://dsjdjsjdsadhasdas.com/gate.php

https://dsdjfhdsufudhjas.com/gate.php

rc4.plain

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1296 set thread context of 1136	1296	zloader 2_1.0.13.0.vir.exe	26

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1136	msiexec.exe
Token: SeSecurityPrivilege	1136	msiexec.exe

Blacklisted process makes network request 5 IoCs

flow	pid	Process
10	1136	msiexec.exe
11	1136	msiexec.exe
12	1136	msiexec.exe
13	1136	msiexec.exe
14	1136	msiexec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\Fofy = "C:\\Users\\Admin\\AppData\\Roaming\\Ihdac\\hohyihb.exe"	msiexec.exe

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 1136	1296	zloader 2_1.0.13.0.vir.exe	26
PID 1296 wrote to memory of 1136	1296	zloader 2_1.0.13.0.vir.exe	26
PID 1296 wrote to memory of 1136	1296	zloader 2_1.0.13.0.vir.exe	26
PID 1296 wrote to memory of 1136	1296	zloader 2_1.0.13.0.vir.exe	26
PID 1296 wrote to memory of 1136	1296	zloader 2_1.0.13.0.vir.exe	26
PID 1296 wrote to memory of 1136	1296	zloader 2_1.0.13.0.vir.exe	26
PID 1296 wrote to memory of 1136	1296	zloader 2_1.0.13.0.vir.exe	26
PID 1296 wrote to memory of 1136	1296	zloader 2_1.0.13.0.vir.exe	26
PID 1296 wrote to memory of 1136	1296	zloader 2_1.0.13.0.vir.exe	26

C:\Users\Admin\AppData\Local\Temp\zloader 2_1.0.13.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader 2_1.0.13.0.vir.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Blacklisted process makes network request
  - Adds Run key to start application
  PID:1136

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1136-0-0x00000000000E0000-0x0000000000105000-memory.dmp

Filesize
148KB

Download
memory/1136-1-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/1136-2-0x00000000000E0000-0x0000000000105000-memory.dmp

Filesize
148KB

Download