zloader | 02846dbf25b333625a0720075fb47da62a946e5b0b4f9e9ba14cef514d576b37

Resubmissions

10-09-2024 16:21

240910-ttserasepr 10

28-07-2020 23:07

200728-dgaye9ycja 10

Analysis

max time kernel
151s
max time network
110s
platform
windows7_x64
resource
win7v200722
submitted
28-07-2020 23:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cYNhXOc.dll
Size

508KB
MD5

7bebb1b85a609733df0b3205406723bb
SHA1

384f07648c732cd9490b7d3bff41ce5a0911b138
SHA256

02846dbf25b333625a0720075fb47da62a946e5b0b4f9e9ba14cef514d576b37
SHA512

4147af9ed60d340218deb382374a015a3bb4cc4abc585e833e1a81ba21bf05f485e2a4cfc7b99223e9015ccda993c5ff19693ce7c00fb18701e66cd259422865

Score

10^/10

trojan botnet zloader persistence spyware

Malware Config

Extracted

Family

zloader

Botnet

july28

Campaign

july28

https://vlcafxbdjtlvlcduwhga.com/web/post.php

https://softwareserviceupdater3.com/web/post.php

https://softwareserviceupdater4.com/web/post.php

2b4@jfhu#sd43fd!42d

rc4.plain

Signatures

Blacklisted process makes network request 21 IoCs

Processes:

msiexec.exe

flow	pid	Process
6	1388	msiexec.exe
8	1388	msiexec.exe
9	1388	msiexec.exe
10	1388	msiexec.exe
11	1388	msiexec.exe
12	1388	msiexec.exe
13	1388	msiexec.exe
14	1388	msiexec.exe
15	1388	msiexec.exe
16	1388	msiexec.exe
17	1388	msiexec.exe
18	1388	msiexec.exe
19	1388	msiexec.exe
20	1388	msiexec.exe
21	1388	msiexec.exe
22	1388	msiexec.exe
23	1388	msiexec.exe
24	1388	msiexec.exe
25	1388	msiexec.exe
26	1388	msiexec.exe
27	1388	msiexec.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

Processes:

ipconfig.exe

pid	Process
1920	ipconfig.exe

Runs net.exe

Suspicious use of WriteProcessMemory 52 IoCs

Processes:

rundll32.exerundll32.exemsiexec.execmd.execmd.exenet.execmd.execmd.exe

description	pid	Process	procid_target
PID 1452 wrote to memory of 1468	1452	rundll32.exe	24
PID 1452 wrote to memory of 1468	1452	rundll32.exe	24
PID 1452 wrote to memory of 1468	1452	rundll32.exe	24
PID 1452 wrote to memory of 1468	1452	rundll32.exe	24
PID 1452 wrote to memory of 1468	1452	rundll32.exe	24
PID 1452 wrote to memory of 1468	1452	rundll32.exe	24
PID 1452 wrote to memory of 1468	1452	rundll32.exe	24
PID 1468 wrote to memory of 1388	1468	rundll32.exe	27
PID 1468 wrote to memory of 1388	1468	rundll32.exe	27
PID 1468 wrote to memory of 1388	1468	rundll32.exe	27
PID 1468 wrote to memory of 1388	1468	rundll32.exe	27
PID 1468 wrote to memory of 1388	1468	rundll32.exe	27
PID 1468 wrote to memory of 1388	1468	rundll32.exe	27
PID 1468 wrote to memory of 1388	1468	rundll32.exe	27
PID 1468 wrote to memory of 1388	1468	rundll32.exe	27
PID 1468 wrote to memory of 1388	1468	rundll32.exe	27
PID 1388 wrote to memory of 1604	1388	msiexec.exe	30
PID 1388 wrote to memory of 1604	1388	msiexec.exe	30
PID 1388 wrote to memory of 1604	1388	msiexec.exe	30
PID 1388 wrote to memory of 1604	1388	msiexec.exe	30
PID 1604 wrote to memory of 1920	1604	cmd.exe	32
PID 1604 wrote to memory of 1920	1604	cmd.exe	32
PID 1604 wrote to memory of 1920	1604	cmd.exe	32
PID 1604 wrote to memory of 1920	1604	cmd.exe	32
PID 1388 wrote to memory of 1988	1388	msiexec.exe	33
PID 1388 wrote to memory of 1988	1388	msiexec.exe	33
PID 1388 wrote to memory of 1988	1388	msiexec.exe	33
PID 1388 wrote to memory of 1988	1388	msiexec.exe	33
PID 1988 wrote to memory of 1972	1988	cmd.exe	35
PID 1988 wrote to memory of 1972	1988	cmd.exe	35
PID 1988 wrote to memory of 1972	1988	cmd.exe	35
PID 1988 wrote to memory of 1972	1988	cmd.exe	35
PID 1972 wrote to memory of 1764	1972	net.exe	36
PID 1972 wrote to memory of 1764	1972	net.exe	36
PID 1972 wrote to memory of 1764	1972	net.exe	36
PID 1972 wrote to memory of 1764	1972	net.exe	36
PID 1388 wrote to memory of 1300	1388	msiexec.exe	37
PID 1388 wrote to memory of 1300	1388	msiexec.exe	37
PID 1388 wrote to memory of 1300	1388	msiexec.exe	37
PID 1388 wrote to memory of 1300	1388	msiexec.exe	37
PID 1300 wrote to memory of 1464	1300	cmd.exe	39
PID 1300 wrote to memory of 1464	1300	cmd.exe	39
PID 1300 wrote to memory of 1464	1300	cmd.exe	39
PID 1300 wrote to memory of 1464	1300	cmd.exe	39
PID 1388 wrote to memory of 1484	1388	msiexec.exe	40
PID 1388 wrote to memory of 1484	1388	msiexec.exe	40
PID 1388 wrote to memory of 1484	1388	msiexec.exe	40
PID 1388 wrote to memory of 1484	1388	msiexec.exe	40
PID 1484 wrote to memory of 1460	1484	cmd.exe	42
PID 1484 wrote to memory of 1460	1484	cmd.exe	42
PID 1484 wrote to memory of 1460	1484	cmd.exe	42
PID 1484 wrote to memory of 1460	1484	cmd.exe	42

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

rundll32.exemsiexec.exe

description	pid	Process
Token: SeDebugPrivilege	1468	rundll32.exe
Token: SeSecurityPrivilege	1388	msiexec.exe
Token: SeSecurityPrivilege	1388	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exemsiexec.exe

pid	Process
1468	rundll32.exe
1388	msiexec.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 1468 created 1204	1468	rundll32.exe	20

Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 1468 set thread context of 1388	1468	rundll32.exe	27

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Modifies service 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

ipconfig.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas	ipconfig.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs	ipconfig.exe

Discovers systems in the same network 1 TTPs 2 IoCs

discovery

Remote System Discovery

T1018

Processes:

net.exenet.exe

pid	Process
1460	net.exe
1464	net.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1204
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cYNhXOc.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1452
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\cYNhXOc.dll,#1
    3⤵
    - Suspicious use of WriteProcessMemory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Suspicious use of SetThreadContext
    PID:1468
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe
  2⤵
  - Blacklisted process makes network request
  - Suspicious use of WriteProcessMemory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:1388
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c ipconfig /all
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1604
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      Modifies service
      PID:1920
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net config workstation
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1988
  - - C:\Windows\SysWOW64\net.exe
      net config workstation
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1972
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 config workstation
        5⤵
        
        PID:1764
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net view /all
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1300
  - - C:\Windows\SysWOW64\net.exe
      net view /all
      4⤵
      Discovers systems in the same network
      PID:1464
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net view /all /domain
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1484
  - - C:\Windows\SysWOW64\net.exe
      net view /all /domain
      4⤵
      Discovers systems in the same network
      PID:1460

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1300-10-0x0000000000000000-mapping.dmp

Download
memory/1388-1-0x0000000000090000-0x00000000000BB000-memory.dmp

Filesize
172KB

Download
memory/1388-2-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/1388-3-0x0000000000090000-0x00000000000BB000-memory.dmp

Filesize
172KB

Download
memory/1388-4-0x0000000000000000-mapping.dmp

Download
memory/1460-13-0x0000000000000000-mapping.dmp

Download
memory/1464-11-0x0000000000000000-mapping.dmp

Download
memory/1468-0-0x0000000000000000-mapping.dmp

Download
memory/1484-12-0x0000000000000000-mapping.dmp

Download
memory/1604-5-0x0000000000000000-mapping.dmp

Download
memory/1764-9-0x0000000000000000-mapping.dmp

Download
memory/1920-6-0x0000000000000000-mapping.dmp

Download
memory/1972-8-0x0000000000000000-mapping.dmp

Download
memory/1988-7-0x0000000000000000-mapping.dmp

Download