zloader | 4a409198e2a70b2cff5a09663e15a37fe6f3e8cf4dd894143c4be4067ec7da8e

General

Target

9081546b7e05805a5496bfcee49b3c736cb55b49e467529c7d7ac60781b29880.exe
Size

282KB
MD5

3b0c5d532922be20ae151490e7109c60
SHA1

4c3ba395594a5117d468084330902739ca08de0e
SHA256

9081546b7e05805a5496bfcee49b3c736cb55b49e467529c7d7ac60781b29880
SHA512

6a724591ee57cbc2ce9351ac556e666040f8ba6bcd37112b960a4fc0a16b493a7b94b0e70f9efe1a1d53597ec8a0a5ef08bbfc91ef4ace776f1df0f8c1555f4e

Score

10^/10

zloader r2 r2 botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

r2

Campaign

r2

C2

https://notsweets.net/LKhwojehDgwegSDG/gateJKjdsh.php

https://olpons.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://karamelliar.org/LKhwojehDgwegSDG/gateJKjdsh.php

https://dogrunn.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://azoraz.net/LKhwojehDgwegSDG/gateJKjdsh.php

rc4.plain

rsa_pubkey.plain

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

9081546b7e05805a5496bfcee49b3c736cb55b49e467529c7d7ac60781b29880.exe

description pid process target process

PID 1432 created 1260 1432 9081546b7e05805a5496bfcee49b3c736cb55b49e467529c7d7ac60781b29880.exe Explorer.EXE
Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

description	pid	process	target process
PID 1432 created 1260	1432	9081546b7e05805a5496bfcee49b3c736cb55b49e467529c7d7ac60781b29880.exe	Explorer.EXE

Blocklisted process makes network request 17 IoCs

Processes:

msiexec.exe

flow	pid	process
7	1920	msiexec.exe
8	1920	msiexec.exe
9	1920	msiexec.exe
10	1920	msiexec.exe
11	1920	msiexec.exe
12	1920	msiexec.exe
15	1920	msiexec.exe
16	1920	msiexec.exe
17	1920	msiexec.exe
18	1920	msiexec.exe
19	1920	msiexec.exe
20	1920	msiexec.exe
23	1920	msiexec.exe
24	1920	msiexec.exe
25	1920	msiexec.exe
26	1920	msiexec.exe
27	1920	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

9081546b7e05805a5496bfcee49b3c736cb55b49e467529c7d7ac60781b29880.exe

description	pid	process	target process
PID 1432 set thread context of 1920	1432	9081546b7e05805a5496bfcee49b3c736cb55b49e467529c7d7ac60781b29880.exe	msiexec.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

9081546b7e05805a5496bfcee49b3c736cb55b49e467529c7d7ac60781b29880.exe

pid process

1432 9081546b7e05805a5496bfcee49b3c736cb55b49e467529c7d7ac60781b29880.exe

pid	process
1432	9081546b7e05805a5496bfcee49b3c736cb55b49e467529c7d7ac60781b29880.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

9081546b7e05805a5496bfcee49b3c736cb55b49e467529c7d7ac60781b29880.exemsiexec.exe

description	pid	process
Token: SeDebugPrivilege	1432	9081546b7e05805a5496bfcee49b3c736cb55b49e467529c7d7ac60781b29880.exe
Token: SeSecurityPrivilege	1920	msiexec.exe
Token: SeSecurityPrivilege	1920	msiexec.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

9081546b7e05805a5496bfcee49b3c736cb55b49e467529c7d7ac60781b29880.exe

description	pid	process	target process
PID 1432 wrote to memory of 1920	1432	9081546b7e05805a5496bfcee49b3c736cb55b49e467529c7d7ac60781b29880.exe	msiexec.exe
PID 1432 wrote to memory of 1920	1432	9081546b7e05805a5496bfcee49b3c736cb55b49e467529c7d7ac60781b29880.exe	msiexec.exe
PID 1432 wrote to memory of 1920	1432	9081546b7e05805a5496bfcee49b3c736cb55b49e467529c7d7ac60781b29880.exe	msiexec.exe
PID 1432 wrote to memory of 1920	1432	9081546b7e05805a5496bfcee49b3c736cb55b49e467529c7d7ac60781b29880.exe	msiexec.exe
PID 1432 wrote to memory of 1920	1432	9081546b7e05805a5496bfcee49b3c736cb55b49e467529c7d7ac60781b29880.exe	msiexec.exe
PID 1432 wrote to memory of 1920	1432	9081546b7e05805a5496bfcee49b3c736cb55b49e467529c7d7ac60781b29880.exe	msiexec.exe
PID 1432 wrote to memory of 1920	1432	9081546b7e05805a5496bfcee49b3c736cb55b49e467529c7d7ac60781b29880.exe	msiexec.exe
PID 1432 wrote to memory of 1920	1432	9081546b7e05805a5496bfcee49b3c736cb55b49e467529c7d7ac60781b29880.exe	msiexec.exe
PID 1432 wrote to memory of 1920	1432	9081546b7e05805a5496bfcee49b3c736cb55b49e467529c7d7ac60781b29880.exe	msiexec.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1260

C:\Users\Admin\AppData\Local\Temp\9081546b7e05805a5496bfcee49b3c736cb55b49e467529c7d7ac60781b29880.exe
"C:\Users\Admin\AppData\Local\Temp\9081546b7e05805a5496bfcee49b3c736cb55b49e467529c7d7ac60781b29880.exe"
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1432

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
2⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:1920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1032-8-0x000007FEF61D0000-0x000007FEF644A000-memory.dmp

Filesize
2.5MB

Download
memory/1432-2-0x0000000002480000-0x0000000002491000-memory.dmp

Filesize
68KB

Download
memory/1432-3-0x0000000000230000-0x0000000000252000-memory.dmp

Filesize
136KB

Download
memory/1432-4-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1920-5-0x0000000000000000-mapping.dmp

Download
memory/1920-6-0x0000000075BF1000-0x0000000075BF3000-memory.dmp

Filesize
8KB

Download
memory/1920-7-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads