zloader | b240ff47de5859d0428c980a30a36a787e141761e8d7c8b2db8ab2364d226a94

General

Target

b240ff47de5859d0428c980a30a36a787e141761e8d7c8b2db8ab2364d226a94.exe
Size

277KB
MD5

853ace320ab418afde34b3928e8205df
SHA1

971a090853596e34b5de28fef9bca1f3ad4fbc58
SHA256

b240ff47de5859d0428c980a30a36a787e141761e8d7c8b2db8ab2364d226a94
SHA512

85e1a0a9caf73d4727645ed723721efb322f0e4740f23da7e38eabc874060635bf5ecfe97262180a2aad6218fc51e4f3fe895d01f0df94c34c8073dc4f57a543

Score

10^/10

zloader vlenie2020 obnova20 botnet persistence trojan

Malware Config

Extracted

Family

zloader

Botnet

vlenie2020

Campaign

obnova20

C2

https://dasifosafjasfhasf.com/gate.php

https://kasfajfsafhasfhaf.com/gate.php

https://fdsjfjdsfjdsjfdjsfh.com/gate.php

https://fdsjfjdsfjdsdsjajjs.com/gate.php

https://idisaudhasdhasdj.com/gate.php

https://dsjdjsjdsadhasdas.com/gate.php

https://dsdjfhdsufudhjas.com/gate.php

Attributes

build_id
1869505135

rc4.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
Blocklisted process makes network request 1 IoCs

Processes:

msiexec.exe

flow pid process

11 820 msiexec.exe

flow	pid	process
11	820	msiexec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\Diigbi = "C:\\Users\\Admin\\AppData\\Roaming\\Gycy\\diab.exe"	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

b240ff47de5859d0428c980a30a36a787e141761e8d7c8b2db8ab2364d226a94.exe

description	pid	process	target process
PID 608 set thread context of 820	608	b240ff47de5859d0428c980a30a36a787e141761e8d7c8b2db8ab2364d226a94.exe	msiexec.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeSecurityPrivilege 820 msiexec.exe
Token: SeSecurityPrivilege 820 msiexec.exe

description	pid	process
Token: SeSecurityPrivilege	820	msiexec.exe
Token: SeSecurityPrivilege	820	msiexec.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

b240ff47de5859d0428c980a30a36a787e141761e8d7c8b2db8ab2364d226a94.exe

description	pid	process	target process
PID 608 wrote to memory of 820	608	b240ff47de5859d0428c980a30a36a787e141761e8d7c8b2db8ab2364d226a94.exe	msiexec.exe
PID 608 wrote to memory of 820	608	b240ff47de5859d0428c980a30a36a787e141761e8d7c8b2db8ab2364d226a94.exe	msiexec.exe
PID 608 wrote to memory of 820	608	b240ff47de5859d0428c980a30a36a787e141761e8d7c8b2db8ab2364d226a94.exe	msiexec.exe
PID 608 wrote to memory of 820	608	b240ff47de5859d0428c980a30a36a787e141761e8d7c8b2db8ab2364d226a94.exe	msiexec.exe
PID 608 wrote to memory of 820	608	b240ff47de5859d0428c980a30a36a787e141761e8d7c8b2db8ab2364d226a94.exe	msiexec.exe
PID 608 wrote to memory of 820	608	b240ff47de5859d0428c980a30a36a787e141761e8d7c8b2db8ab2364d226a94.exe	msiexec.exe
PID 608 wrote to memory of 820	608	b240ff47de5859d0428c980a30a36a787e141761e8d7c8b2db8ab2364d226a94.exe	msiexec.exe
PID 608 wrote to memory of 820	608	b240ff47de5859d0428c980a30a36a787e141761e8d7c8b2db8ab2364d226a94.exe	msiexec.exe
PID 608 wrote to memory of 820	608	b240ff47de5859d0428c980a30a36a787e141761e8d7c8b2db8ab2364d226a94.exe	msiexec.exe

C:\Users\Admin\AppData\Local\Temp\b240ff47de5859d0428c980a30a36a787e141761e8d7c8b2db8ab2364d226a94.exe
"C:\Users\Admin\AppData\Local\Temp\b240ff47de5859d0428c980a30a36a787e141761e8d7c8b2db8ab2364d226a94.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:608

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
2⤵
- Blocklisted process makes network request
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:820

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/608-54-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/608-55-0x00000000002A0000-0x00000000002C6000-memory.dmp

Filesize
152KB

Download
memory/820-57-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/820-58-0x00000000000F0000-0x0000000000116000-memory.dmp

Filesize
152KB

Download
memory/820-56-0x00000000000F0000-0x0000000000116000-memory.dmp

Filesize
152KB

Download
memory/820-59-0x0000000076001000-0x0000000076003000-memory.dmp

Filesize
8KB

Download
memory/820-60-0x00000000000F0000-0x0000000000116000-memory.dmp

Filesize
152KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads