zloader | 6fee95a3e283d9ad09a399e99b086ef70c3679eb8ad548161bdfababe3da68fb

General

Target

6fee95a3e283d9ad09a399e99b086ef70c3679eb8ad548161bdfababe3da68fb.exe
Size

268KB
MD5

4d68507752275a8607502b0ae14ef9a1
SHA1

4e13b8267ca39e41b9dbf88dc3123fed37e409c0
SHA256

6fee95a3e283d9ad09a399e99b086ef70c3679eb8ad548161bdfababe3da68fb
SHA512

bbebbd027af9e953141efecbfde31137735d58e54ff26966475570c7414ddc03ee53636011fad404d60c8df0031a79d5f2b858819ded59428ead93a5d9732849

Score

10^/10

zloader saca adw2 botnet persistence trojan

Malware Config

Extracted

Family

zloader

Botnet

saca

Campaign

adw2

C2

https://thoughtlibrary.top/library/topikpost.php

https://islacangrejo.fun/library/topikpost.php

Attributes

build_id
1970759022

rc4.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\Baidud = "C:\\Users\\Admin\\AppData\\Roaming\\Ofga\\caoddaaf.exe"	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1276 set thread context of 560	1276	6fee95a3e283d9ad09a399e99b086ef70c3679eb8ad548161bdfababe3da68fb.exe	29

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	560	msiexec.exe
Token: SeSecurityPrivilege	560	msiexec.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 560	1276	6fee95a3e283d9ad09a399e99b086ef70c3679eb8ad548161bdfababe3da68fb.exe	29
PID 1276 wrote to memory of 560	1276	6fee95a3e283d9ad09a399e99b086ef70c3679eb8ad548161bdfababe3da68fb.exe	29
PID 1276 wrote to memory of 560	1276	6fee95a3e283d9ad09a399e99b086ef70c3679eb8ad548161bdfababe3da68fb.exe	29
PID 1276 wrote to memory of 560	1276	6fee95a3e283d9ad09a399e99b086ef70c3679eb8ad548161bdfababe3da68fb.exe	29
PID 1276 wrote to memory of 560	1276	6fee95a3e283d9ad09a399e99b086ef70c3679eb8ad548161bdfababe3da68fb.exe	29
PID 1276 wrote to memory of 560	1276	6fee95a3e283d9ad09a399e99b086ef70c3679eb8ad548161bdfababe3da68fb.exe	29
PID 1276 wrote to memory of 560	1276	6fee95a3e283d9ad09a399e99b086ef70c3679eb8ad548161bdfababe3da68fb.exe	29
PID 1276 wrote to memory of 560	1276	6fee95a3e283d9ad09a399e99b086ef70c3679eb8ad548161bdfababe3da68fb.exe	29
PID 1276 wrote to memory of 560	1276	6fee95a3e283d9ad09a399e99b086ef70c3679eb8ad548161bdfababe3da68fb.exe	29

C:\Users\Admin\AppData\Local\Temp\6fee95a3e283d9ad09a399e99b086ef70c3679eb8ad548161bdfababe3da68fb.exe
"C:\Users\Admin\AppData\Local\Temp\6fee95a3e283d9ad09a399e99b086ef70c3679eb8ad548161bdfababe3da68fb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe
  2⤵
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/560-57-0x00000000000D0000-0x00000000000F6000-memory.dmp

Filesize
152KB

Download
memory/560-58-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/560-59-0x00000000000D0000-0x00000000000F6000-memory.dmp

Filesize
152KB

Download
memory/560-61-0x00000000000D0000-0x00000000000F6000-memory.dmp

Filesize
152KB

Download
memory/1276-54-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download
memory/1276-55-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/1276-56-0x00000000002A0000-0x00000000002C6000-memory.dmp

Filesize
152KB

Download

Analysis

Sharing