zloader | 14c47cc16c55060409202302048d8b8f97c9b3fa462d7710ab91bb3f3f7a75e8

Analysis

max time kernel
153s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
09/03/2022, 02:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14c47cc16c55060409202302048d8b8f97c9b3fa462d7710ab91bb3f3f7a75e8.dll
Size

370KB
MD5

243104faac6863b5b4a4263f4040f021
SHA1

597fbf324045926a5e3cc1617dc89f83ddd49792
SHA256

14c47cc16c55060409202302048d8b8f97c9b3fa462d7710ab91bb3f3f7a75e8
SHA512

3a0bf5a2731155559faf5167e00662fa69e18f81dfc671ac3132eec84ae0b4293429fda477f8bbb5d8576d64e6d36eac09e00a69c124ae99dc30f37e7868d985

Score

10^/10

zloader nut 30/11 botnet suricata trojan

Malware Config

Extracted

Family

zloader

Botnet

nut

Campaign

30/11

https://aogmphregion.org.za/construction.php

https://aayanent.com/backups.php

https://eagle-family.co.uk/panel.php

https://khanbuilders.uk/wp-punch.php

https://construbienesjg.com/wp-punch.php

https://despautyajobssooka.ml/wp-smarts.php

Attributes

build_id
257

rc4.plain

rsa_pubkey.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
suricata: ET MALWARE Zbot POST Request to C2
suricata: ET MALWARE Zbot POST Request to C2
suricata

Blocklisted process makes network request 14 IoCs

flow	pid	Process
37	912	msiexec.exe
38	912	msiexec.exe
39	912	msiexec.exe
40	912	msiexec.exe
41	912	msiexec.exe
42	912	msiexec.exe
53	912	msiexec.exe
57	912	msiexec.exe
58	912	msiexec.exe
59	912	msiexec.exe
63	912	msiexec.exe
64	912	msiexec.exe
66	912	msiexec.exe
69	912	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1528 set thread context of 912	1528	regsvr32.exe	91

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	912	msiexec.exe
Token: SeSecurityPrivilege	912	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 1528	1396	regsvr32.exe	79
PID 1396 wrote to memory of 1528	1396	regsvr32.exe	79
PID 1396 wrote to memory of 1528	1396	regsvr32.exe	79
PID 1528 wrote to memory of 912	1528	regsvr32.exe	91
PID 1528 wrote to memory of 912	1528	regsvr32.exe	91
PID 1528 wrote to memory of 912	1528	regsvr32.exe	91
PID 1528 wrote to memory of 912	1528	regsvr32.exe	91
PID 1528 wrote to memory of 912	1528	regsvr32.exe	91

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\14c47cc16c55060409202302048d8b8f97c9b3fa462d7710ab91bb3f3f7a75e8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\14c47cc16c55060409202302048d8b8f97c9b3fa462d7710ab91bb3f3f7a75e8.dll
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec.exe
    3⤵
    - Blocklisted process makes network request
    - Suspicious use of AdjustPrivilegeToken
    PID:912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/912-134-0x0000000000510000-0x0000000000536000-memory.dmp

Filesize
152KB

Download
memory/912-135-0x0000000000510000-0x0000000000536000-memory.dmp

Filesize
152KB

Download
memory/1528-131-0x0000000075220000-0x0000000075292000-memory.dmp

Filesize
456KB

Download
memory/1528-130-0x0000000075220000-0x0000000075246000-memory.dmp

Filesize
152KB

Download
memory/1528-132-0x0000000075220000-0x0000000075292000-memory.dmp

Filesize
456KB

Download
memory/1528-133-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

Filesize
4KB

Download