zloader | 16464a294fc276ea38e4f8aedd7fa6d1f426036d42b342bde27bdc63b5c6658c

General

Target

16464a294fc276ea38e4f8aedd7fa6d1f426036d42b342bde27bdc63b5c6658c.dll
Size

310KB
MD5

b9d425b1970b5fd03aed67053d97916d
SHA1

6b198494ce7d94fe26e72f4d0de776c897d9231a
SHA256

16464a294fc276ea38e4f8aedd7fa6d1f426036d42b342bde27bdc63b5c6658c
SHA512

621449a17709fb703c18e84b31956a1fefd7a0204743061c401f7208a12c9a51df6f60eee0be155ca290d0336e46b7fdef8eaa4267dc8147916f43d824cb989d

Score

10^/10

zloader banking banking botnet persistence trojan

Malware Config

Extracted

Family

zloader

Botnet

banking

Campaign

banking

C2

https://iloveyoubaby1.pro/gate.php

https://idsakjfsanfaskj.com/gate.php

https://fslakdasjdnsasjsj.com/gate.php

https://dksadjsahnfaskmsa.com/gate.php

https://dskdsajdsahda.info/gate.php

https://dskdsajdsadasda.info/gate.php

https://dskjdsadhsahjsas.info/gate.php

https://dsjadjsadjsadjafsa.info/gate.php

https://fsakjdsafasifkajfaf.pro/gate.php

https://djsadhsadsadjashs.pro/gate.php

Attributes

build_id
2

rc4.plain

rsa_pubkey.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
Blocklisted process makes network request 7 IoCs

Processes:

msiexec.exe

flow pid process

5 2012 msiexec.exe
7 2012 msiexec.exe
13 2012 msiexec.exe
19 2012 msiexec.exe
21 2012 msiexec.exe
23 2012 msiexec.exe
25 2012 msiexec.exe

flow	pid	process
5	2012	msiexec.exe
7	2012	msiexec.exe
13	2012	msiexec.exe
19	2012	msiexec.exe
21	2012	msiexec.exe
23	2012	msiexec.exe
25	2012	msiexec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ereqmim = "regsvr32.exe /s C:\\Users\\Admin\\AppData\\Roaming\\Lugaw\\icebypz.dll"	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 828 set thread context of 2012 828 rundll32.exe msiexec.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeSecurityPrivilege 2012 msiexec.exe
Token: SeSecurityPrivilege 2012 msiexec.exe

description	pid	process	target process
PID 828 set thread context of 2012	828	rundll32.exe	msiexec.exe

description	pid	process
Token: SeSecurityPrivilege	2012	msiexec.exe
Token: SeSecurityPrivilege	2012	msiexec.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1692 wrote to memory of 828	1692	rundll32.exe	rundll32.exe
PID 1692 wrote to memory of 828	1692	rundll32.exe	rundll32.exe
PID 1692 wrote to memory of 828	1692	rundll32.exe	rundll32.exe
PID 1692 wrote to memory of 828	1692	rundll32.exe	rundll32.exe
PID 1692 wrote to memory of 828	1692	rundll32.exe	rundll32.exe
PID 1692 wrote to memory of 828	1692	rundll32.exe	rundll32.exe
PID 1692 wrote to memory of 828	1692	rundll32.exe	rundll32.exe
PID 828 wrote to memory of 2012	828	rundll32.exe	msiexec.exe
PID 828 wrote to memory of 2012	828	rundll32.exe	msiexec.exe
PID 828 wrote to memory of 2012	828	rundll32.exe	msiexec.exe
PID 828 wrote to memory of 2012	828	rundll32.exe	msiexec.exe
PID 828 wrote to memory of 2012	828	rundll32.exe	msiexec.exe
PID 828 wrote to memory of 2012	828	rundll32.exe	msiexec.exe
PID 828 wrote to memory of 2012	828	rundll32.exe	msiexec.exe
PID 828 wrote to memory of 2012	828	rundll32.exe	msiexec.exe
PID 828 wrote to memory of 2012	828	rundll32.exe	msiexec.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\16464a294fc276ea38e4f8aedd7fa6d1f426036d42b342bde27bdc63b5c6658c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1692

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\16464a294fc276ea38e4f8aedd7fa6d1f426036d42b342bde27bdc63b5c6658c.dll,#1
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:828

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
3⤵
- Blocklisted process makes network request
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:2012

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/828-55-0x0000000076071000-0x0000000076073000-memory.dmp

Filesize
8KB

Download
memory/828-60-0x00000000005A0000-0x00000000005EF000-memory.dmp

Filesize
316KB

Download
memory/2012-57-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/2012-56-0x0000000000090000-0x00000000000BC000-memory.dmp

Filesize
176KB

Download
memory/2012-58-0x0000000000090000-0x00000000000BC000-memory.dmp

Filesize
176KB

Download
memory/2012-61-0x0000000000090000-0x00000000000BC000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing