zloader | 2ba65215543995ad4cac30ba3dfe32d23cafcc3e17c6c7bf4bb3ecbe7460adb5

General

Target

muadcuy.exe
Size

343KB
MD5

d5afcf6fe67071bc51781701b7f9281a
SHA1

6f1ac3e0a66b11200d323e615acbcb5f2fd8e4ba
SHA256

93951379e57e4f159bb62fd7dd563d1ac2f3f23c80ba89f2da2e395b8a647dcf
SHA512

3c5eac5cd73af63490a61867757c18b7fa971dc48bac3ec5e076c58f5530cb2962106c08f5375fb40038f048067f72e5b5cd2c31e6ad7379767544ec6d01949e

Score

10^/10

zloader sg sg botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

SG

Campaign

SG

C2

https://freebreez.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://makaronz.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://ricklick.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://litlblockblack.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://vaktorianpackif.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://hbamefphmqsdgkqojgwe.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://hoxfqvlgoabyfspvjimc.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://yrsfuaegsevyffrfsgpj.com/LKhwojehDgwegSDG/gateJKjdsh.php

rc4.plain

rsa_pubkey.plain

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

muadcuy.exe

description pid process target process

PID 1508 created 1264 1508 muadcuy.exe Explorer.EXE
Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
Loads dropped DLL 1 IoCs

Processes:

muadcuy.exe

pid process

748 muadcuy.exe

description	pid	process	target process
PID 1508 created 1264	1508	muadcuy.exe	Explorer.EXE

pid	process
748	muadcuy.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

muadcuy.exemuadcuy.exe

description	pid	process	target process
PID 748 set thread context of 1508	748	muadcuy.exe	muadcuy.exe
PID 1508 set thread context of 1616	1508	muadcuy.exe	msiexec.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

muadcuy.exe

pid process

1508 muadcuy.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

muadcuy.exe

pid process

748 muadcuy.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

muadcuy.exemsiexec.exe

description pid process

Token: SeDebugPrivilege 1508 muadcuy.exe
Token: SeSecurityPrivilege 1616 msiexec.exe
Token: SeSecurityPrivilege 1616 msiexec.exe

pid	process
1508	muadcuy.exe

pid	process
748	muadcuy.exe

description	pid	process
Token: SeDebugPrivilege	1508	muadcuy.exe
Token: SeSecurityPrivilege	1616	msiexec.exe
Token: SeSecurityPrivilege	1616	msiexec.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

muadcuy.exemuadcuy.exe

description	pid	process	target process
PID 748 wrote to memory of 1508	748	muadcuy.exe	muadcuy.exe
PID 748 wrote to memory of 1508	748	muadcuy.exe	muadcuy.exe
PID 748 wrote to memory of 1508	748	muadcuy.exe	muadcuy.exe
PID 748 wrote to memory of 1508	748	muadcuy.exe	muadcuy.exe
PID 748 wrote to memory of 1508	748	muadcuy.exe	muadcuy.exe
PID 748 wrote to memory of 1508	748	muadcuy.exe	muadcuy.exe
PID 748 wrote to memory of 1508	748	muadcuy.exe	muadcuy.exe
PID 748 wrote to memory of 1508	748	muadcuy.exe	muadcuy.exe
PID 748 wrote to memory of 1508	748	muadcuy.exe	muadcuy.exe
PID 748 wrote to memory of 1508	748	muadcuy.exe	muadcuy.exe
PID 748 wrote to memory of 1508	748	muadcuy.exe	muadcuy.exe
PID 748 wrote to memory of 1508	748	muadcuy.exe	muadcuy.exe
PID 1508 wrote to memory of 1616	1508	muadcuy.exe	msiexec.exe
PID 1508 wrote to memory of 1616	1508	muadcuy.exe	msiexec.exe
PID 1508 wrote to memory of 1616	1508	muadcuy.exe	msiexec.exe
PID 1508 wrote to memory of 1616	1508	muadcuy.exe	msiexec.exe
PID 1508 wrote to memory of 1616	1508	muadcuy.exe	msiexec.exe
PID 1508 wrote to memory of 1616	1508	muadcuy.exe	msiexec.exe
PID 1508 wrote to memory of 1616	1508	muadcuy.exe	msiexec.exe
PID 1508 wrote to memory of 1616	1508	muadcuy.exe	msiexec.exe
PID 1508 wrote to memory of 1616	1508	muadcuy.exe	msiexec.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1264

C:\Users\Admin\AppData\Local\Temp\muadcuy.exe
"C:\Users\Admin\AppData\Local\Temp\muadcuy.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:748

C:\Users\Admin\AppData\Local\Temp\muadcuy.exe
"C:\Users\Admin\AppData\Local\Temp\muadcuy.exe"
3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1508

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1616

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsn8F84.tmp\System.dll
MD5
fccff8cb7a1067e23fd2e2b63971a8e1

SHA1
30e2a9e137c1223a78a0f7b0bf96a1c361976d91

SHA256
6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

SHA512
f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

Download Submit
memory/1508-3-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1508-4-0x0000000000402BC0-mapping.dmp

Download
memory/1508-5-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1616-8-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/1616-7-0x00000000000D0000-0x00000000000FD000-memory.dmp

Filesize
180KB

Download
memory/1616-9-0x00000000000D0000-0x00000000000FD000-memory.dmp

Filesize
180KB

Download
memory/1616-10-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing