zloader | 02846dbf25b333625a0720075fb47da62a946e5b0b4f9e9ba14cef514d576b37

Resubmissions

10-09-2024 16:21

240910-ttserasepr 10

28-07-2020 23:07

200728-dgaye9ycja 10

Analysis

max time kernel
150s
max time network
112s
platform
windows10_x64
resource
win10v200722
submitted
28-07-2020 23:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cYNhXOc.dll
Size

508KB
MD5

7bebb1b85a609733df0b3205406723bb
SHA1

384f07648c732cd9490b7d3bff41ce5a0911b138
SHA256

02846dbf25b333625a0720075fb47da62a946e5b0b4f9e9ba14cef514d576b37
SHA512

4147af9ed60d340218deb382374a015a3bb4cc4abc585e833e1a81ba21bf05f485e2a4cfc7b99223e9015ccda993c5ff19693ce7c00fb18701e66cd259422865

Score

10^/10

trojan botnet zloader spyware

Malware Config

Extracted

Family

zloader

Botnet

july28

Campaign

july28

https://vlcafxbdjtlvlcduwhga.com/web/post.php

https://softwareserviceupdater3.com/web/post.php

https://softwareserviceupdater4.com/web/post.php

2b4@jfhu#sd43fd!42d

rc4.plain

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Discovers systems in the same network 1 TTPs 2 IoCs

discovery

Remote System Discovery

T1018

pid	Process
516	net.exe
4064	net.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 648 wrote to memory of 724	648	rundll32.exe	66
PID 648 wrote to memory of 724	648	rundll32.exe	66
PID 648 wrote to memory of 724	648	rundll32.exe	66
PID 724 wrote to memory of 2784	724	rundll32.exe	73
PID 724 wrote to memory of 2784	724	rundll32.exe	73
PID 724 wrote to memory of 2784	724	rundll32.exe	73
PID 724 wrote to memory of 2784	724	rundll32.exe	73
PID 724 wrote to memory of 2784	724	rundll32.exe	73
PID 2784 wrote to memory of 3944	2784	msiexec.exe	74
PID 2784 wrote to memory of 3944	2784	msiexec.exe	74
PID 2784 wrote to memory of 3944	2784	msiexec.exe	74
PID 3944 wrote to memory of 3932	3944	cmd.exe	76
PID 3944 wrote to memory of 3932	3944	cmd.exe	76
PID 3944 wrote to memory of 3932	3944	cmd.exe	76
PID 2784 wrote to memory of 3180	2784	msiexec.exe	77
PID 2784 wrote to memory of 3180	2784	msiexec.exe	77
PID 2784 wrote to memory of 3180	2784	msiexec.exe	77
PID 3180 wrote to memory of 1668	3180	cmd.exe	79
PID 3180 wrote to memory of 1668	3180	cmd.exe	79
PID 3180 wrote to memory of 1668	3180	cmd.exe	79
PID 1668 wrote to memory of 3388	1668	net.exe	80
PID 1668 wrote to memory of 3388	1668	net.exe	80
PID 1668 wrote to memory of 3388	1668	net.exe	80
PID 2784 wrote to memory of 2708	2784	msiexec.exe	81
PID 2784 wrote to memory of 2708	2784	msiexec.exe	81
PID 2784 wrote to memory of 2708	2784	msiexec.exe	81
PID 2708 wrote to memory of 516	2708	cmd.exe	83
PID 2708 wrote to memory of 516	2708	cmd.exe	83
PID 2708 wrote to memory of 516	2708	cmd.exe	83
PID 2784 wrote to memory of 3348	2784	msiexec.exe	84
PID 2784 wrote to memory of 3348	2784	msiexec.exe	84
PID 2784 wrote to memory of 3348	2784	msiexec.exe	84
PID 3348 wrote to memory of 4064	3348	cmd.exe	86
PID 3348 wrote to memory of 4064	3348	cmd.exe	86
PID 3348 wrote to memory of 4064	3348	cmd.exe	86

Blacklisted process makes network request 16 IoCs

flow	pid	Process
15	2784	msiexec.exe
16	2784	msiexec.exe
17	2784	msiexec.exe
18	2784	msiexec.exe
19	2784	msiexec.exe
20	2784	msiexec.exe
21	2784	msiexec.exe
22	2784	msiexec.exe
23	2784	msiexec.exe
24	2784	msiexec.exe
25	2784	msiexec.exe
26	2784	msiexec.exe
27	2784	msiexec.exe
28	2784	msiexec.exe
29	2784	msiexec.exe
30	2784	msiexec.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 724 created 3068	724	rundll32.exe	56

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 724 set thread context of 2784	724	rundll32.exe	73

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
3932	ipconfig.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	724	rundll32.exe
Token: SeSecurityPrivilege	2784	msiexec.exe
Token: SeSecurityPrivilege	2784	msiexec.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
724	rundll32.exe
724	rundll32.exe
2784	msiexec.exe
2784	msiexec.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3068
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cYNhXOc.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:648
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\cYNhXOc.dll,#1
    3⤵
    - Suspicious use of WriteProcessMemory
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: EnumeratesProcesses
    PID:724
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  - Blacklisted process makes network request
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:2784
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c ipconfig /all
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3944
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:3932
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net config workstation
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3180
  - - C:\Windows\SysWOW64\net.exe
      net config workstation
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1668
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 config workstation
        5⤵
        
        PID:3388
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net view /all
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2708
  - - C:\Windows\SysWOW64\net.exe
      net view /all
      4⤵
      Discovers systems in the same network
      PID:516
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net view /all /domain
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3348
  - - C:\Windows\SysWOW64\net.exe
      net view /all /domain
      4⤵
      Discovers systems in the same network
      PID:4064

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2784-1-0x00000000008C0000-0x00000000008EB000-memory.dmp

Filesize
172KB

Download