zloader | 4a409198e2a70b2cff5a09663e15a37fe6f3e8cf4dd894143c4be4067ec7da8e

General

Target

9081546b7e05805a5496bfcee49b3c736cb55b49e467529c7d7ac60781b29880.exe
Size

282KB
MD5

3b0c5d532922be20ae151490e7109c60
SHA1

4c3ba395594a5117d468084330902739ca08de0e
SHA256

9081546b7e05805a5496bfcee49b3c736cb55b49e467529c7d7ac60781b29880
SHA512

6a724591ee57cbc2ce9351ac556e666040f8ba6bcd37112b960a4fc0a16b493a7b94b0e70f9efe1a1d53597ec8a0a5ef08bbfc91ef4ace776f1df0f8c1555f4e

Score

10^/10

zloader r2 r2 botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

r2

Campaign

r2

C2

https://notsweets.net/LKhwojehDgwegSDG/gateJKjdsh.php

https://olpons.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://karamelliar.org/LKhwojehDgwegSDG/gateJKjdsh.php

https://dogrunn.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://azoraz.net/LKhwojehDgwegSDG/gateJKjdsh.php

rc4.plain

rsa_pubkey.plain

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

9081546b7e05805a5496bfcee49b3c736cb55b49e467529c7d7ac60781b29880.exe

description pid process target process

PID 3928 created 2908 3928 9081546b7e05805a5496bfcee49b3c736cb55b49e467529c7d7ac60781b29880.exe Explorer.EXE
Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

description	pid	process	target process
PID 3928 created 2908	3928	9081546b7e05805a5496bfcee49b3c736cb55b49e467529c7d7ac60781b29880.exe	Explorer.EXE

Blocklisted process makes network request 12 IoCs

Processes:

msiexec.exe

flow	pid	process
12	3984	msiexec.exe
14	3984	msiexec.exe
15	3984	msiexec.exe
16	3984	msiexec.exe
17	3984	msiexec.exe
18	3984	msiexec.exe
20	3984	msiexec.exe
23	3984	msiexec.exe
27	3984	msiexec.exe
28	3984	msiexec.exe
29	3984	msiexec.exe
30	3984	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

9081546b7e05805a5496bfcee49b3c736cb55b49e467529c7d7ac60781b29880.exe

description	pid	process	target process
PID 3928 set thread context of 3984	3928	9081546b7e05805a5496bfcee49b3c736cb55b49e467529c7d7ac60781b29880.exe	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

9081546b7e05805a5496bfcee49b3c736cb55b49e467529c7d7ac60781b29880.exe

pid	process
3928	9081546b7e05805a5496bfcee49b3c736cb55b49e467529c7d7ac60781b29880.exe
3928	9081546b7e05805a5496bfcee49b3c736cb55b49e467529c7d7ac60781b29880.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

9081546b7e05805a5496bfcee49b3c736cb55b49e467529c7d7ac60781b29880.exemsiexec.exe

description	pid	process
Token: SeDebugPrivilege	3928	9081546b7e05805a5496bfcee49b3c736cb55b49e467529c7d7ac60781b29880.exe
Token: SeSecurityPrivilege	3984	msiexec.exe
Token: SeSecurityPrivilege	3984	msiexec.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

9081546b7e05805a5496bfcee49b3c736cb55b49e467529c7d7ac60781b29880.exe

description	pid	process	target process
PID 3928 wrote to memory of 3984	3928	9081546b7e05805a5496bfcee49b3c736cb55b49e467529c7d7ac60781b29880.exe	msiexec.exe
PID 3928 wrote to memory of 3984	3928	9081546b7e05805a5496bfcee49b3c736cb55b49e467529c7d7ac60781b29880.exe	msiexec.exe
PID 3928 wrote to memory of 3984	3928	9081546b7e05805a5496bfcee49b3c736cb55b49e467529c7d7ac60781b29880.exe	msiexec.exe
PID 3928 wrote to memory of 3984	3928	9081546b7e05805a5496bfcee49b3c736cb55b49e467529c7d7ac60781b29880.exe	msiexec.exe
PID 3928 wrote to memory of 3984	3928	9081546b7e05805a5496bfcee49b3c736cb55b49e467529c7d7ac60781b29880.exe	msiexec.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2908

C:\Users\Admin\AppData\Local\Temp\9081546b7e05805a5496bfcee49b3c736cb55b49e467529c7d7ac60781b29880.exe
"C:\Users\Admin\AppData\Local\Temp\9081546b7e05805a5496bfcee49b3c736cb55b49e467529c7d7ac60781b29880.exe"
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3928

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
2⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:3984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3928-2-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

Filesize
4KB

Download
memory/3928-3-0x0000000000CB0000-0x0000000000CD2000-memory.dmp

Filesize
136KB

Download
memory/3928-4-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3984-5-0x0000000000000000-mapping.dmp

Download
memory/3984-6-0x0000000000500000-0x0000000000526000-memory.dmp

Filesize
152KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads