zloader | 9f654fe304bd80d1114c515362319c59bc569a54cb445aacdf47672d56815da1

Analysis

max time kernel
54s
max time network
110s
platform
windows10_x64
resource
win10v200722
submitted
14-10-2020 01:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

t.exe
Size

210KB
MD5

12368655038e920cb2ada7d34fac40dd
SHA1

fca002da98c91b019a3fab4639a4b6e4d0de43d7
SHA256

9f654fe304bd80d1114c515362319c59bc569a54cb445aacdf47672d56815da1
SHA512

caa8e284640c31ad4c7b86945a71ad46aa2eb8bb7e47358b67b5fa575cac2894ad5d8d41e26a7782d7e080d8126c2c377e7bcc8e3ff2f5785c9c60119c519d0e

Score

10^/10

trojan botnet zloader

Malware Config

Extracted

Family

zloader

Botnet

Campaign

https://freebreez.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://makaronz.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://ricklick.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://litlblockblack.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://vaktorianpackif.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://hbamefphmqsdgkqojgwe.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://hoxfqvlgoabyfspvjimc.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://yrsfuaegsevyffrfsgpj.com/LKhwojehDgwegSDG/gateJKjdsh.php

rc4.plain

rsa_pubkey.plain

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

t.exe

description pid process target process

PID 4040 created 3060 4040 t.exe Explorer.EXE
Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
Suspicious use of SetThreadContext 1 IoCs

Processes:

t.exe

description pid process target process

PID 4040 set thread context of 724 4040 t.exe msiexec.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

t.exe

pid process

4040 t.exe
4040 t.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

t.exemsiexec.exe

description pid process

Token: SeDebugPrivilege 4040 t.exe
Token: SeSecurityPrivilege 724 msiexec.exe
Token: SeSecurityPrivilege 724 msiexec.exe

description	pid	process	target process
PID 4040 created 3060	4040	t.exe	Explorer.EXE

description	pid	process	target process
PID 4040 set thread context of 724	4040	t.exe	msiexec.exe

pid	process
4040	t.exe
4040	t.exe

description	pid	process
Token: SeDebugPrivilege	4040	t.exe
Token: SeSecurityPrivilege	724	msiexec.exe
Token: SeSecurityPrivilege	724	msiexec.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

t.exe

description	pid	process	target process
PID 4040 wrote to memory of 724	4040	t.exe	msiexec.exe
PID 4040 wrote to memory of 724	4040	t.exe	msiexec.exe
PID 4040 wrote to memory of 724	4040	t.exe	msiexec.exe
PID 4040 wrote to memory of 724	4040	t.exe	msiexec.exe
PID 4040 wrote to memory of 724	4040	t.exe	msiexec.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3060

C:\Users\Admin\AppData\Local\Temp\t.exe
"C:\Users\Admin\AppData\Local\Temp\t.exe"
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4040

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:724

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/724-2-0x00000000003D0000-0x00000000003FD000-memory.dmp

Filesize
180KB

Download
memory/724-3-0x0000000000000000-mapping.dmp

Download
memory/4040-0-0x0000000000C56000-0x0000000000C57000-memory.dmp

Filesize
4KB

Download
memory/4040-1-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download