Overview

overview

10

Static

static

1907a0cc44...78.exe

windows7_x64

10

1907a0cc44...78.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    72s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    18-04-2022 05:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1907a0cc44810a9ddcdcd3701c390d036feedbc55a812e797add53a7c935e178.exe

  • Size

    2.0MB

  • MD5

    b5843ad453d4b6e360b939c5d348d0b2

  • SHA1

    511b7849dfbca06c951001f8f3e958806fd4acfa

  • SHA256

    1907a0cc44810a9ddcdcd3701c390d036feedbc55a812e797add53a7c935e178

  • SHA512

    0eeeb1f0e88fb66f0d44e836ae8e9d7eebcb039397abe4ce331071d8077a7e84e4286e432c80a39502cd46548a1ce973eff195de2325d298ecb1980bcbf77ef2

Score
10/10
zloadereldoeldobotnettrojan

Malware Config

Extracted

Family

zloader

Botnet

ELDO

Campaign

ELDO

C2

https://notsweets.net/LKhwojehDgwegSDG/gateJKjdsh.php

https://olpons.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://karamelliar.org/LKhwojehDgwegSDG/gateJKjdsh.php

https://dogrunn.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://azoraz.net/LKhwojehDgwegSDG/gateJKjdsh.php
Attributes
  • build_id

    132

rc4.plain
rsa_pubkey.plain

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

    trojanbotnetzloader
  • Blocklisted process makes network request 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:2576
      • C:\Users\Admin\AppData\Local\Temp\1907a0cc44810a9ddcdcd3701c390d036feedbc55a812e797add53a7c935e178.exe
        "C:\Users\Admin\AppData\Local\Temp\1907a0cc44810a9ddcdcd3701c390d036feedbc55a812e797add53a7c935e178.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:508
      • C:\Windows\SysWOW64\msiexec.exe
        msiexec.exe
        2⤵
        • Blocklisted process makes network request
        • Suspicious use of AdjustPrivilegeToken
        PID:1256

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/508-130-0x0000000000410000-0x0000000000436000-memory.dmp
      Filesize

      152KB

      Download
    • memory/508-131-0x0000000000410000-0x0000000000709000-memory.dmp
      Filesize

      3.0MB

      Download
    • memory/508-132-0x0000000000410000-0x0000000000709000-memory.dmp
      Filesize

      3.0MB

      Download
    • memory/1256-133-0x0000000000000000-mapping.dmp
      Download
    • memory/1256-134-0x00000000003D0000-0x00000000003F6000-memory.dmp
      Filesize

      152KB

      Download
    • memory/1256-135-0x00000000003D0000-0x00000000003F6000-memory.dmp
      Filesize

      152KB

      Download