zloader | 1907a0cc44810a9ddcdcd3701c390d036feedbc55a812e797add53a7c935e178

General

Target

1907a0cc44810a9ddcdcd3701c390d036feedbc55a812e797add53a7c935e178.exe
Size

2.0MB
MD5

b5843ad453d4b6e360b939c5d348d0b2
SHA1

511b7849dfbca06c951001f8f3e958806fd4acfa
SHA256

1907a0cc44810a9ddcdcd3701c390d036feedbc55a812e797add53a7c935e178
SHA512

0eeeb1f0e88fb66f0d44e836ae8e9d7eebcb039397abe4ce331071d8077a7e84e4286e432c80a39502cd46548a1ce973eff195de2325d298ecb1980bcbf77ef2

Score

10^/10

zloader eldo eldo botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

ELDO

Campaign

ELDO

C2

https://notsweets.net/LKhwojehDgwegSDG/gateJKjdsh.php

https://olpons.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://karamelliar.org/LKhwojehDgwegSDG/gateJKjdsh.php

https://dogrunn.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://azoraz.net/LKhwojehDgwegSDG/gateJKjdsh.php

Attributes

build_id
132

rc4.plain

rsa_pubkey.plain

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

1907a0cc44810a9ddcdcd3701c390d036feedbc55a812e797add53a7c935e178.exe

description pid process target process

PID 508 created 2576 508 1907a0cc44810a9ddcdcd3701c390d036feedbc55a812e797add53a7c935e178.exe Explorer.EXE
Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
Blocklisted process makes network request 1 IoCs

Processes:

msiexec.exe

flow pid process

25 1256 msiexec.exe

description	pid	process	target process
PID 508 created 2576	508	1907a0cc44810a9ddcdcd3701c390d036feedbc55a812e797add53a7c935e178.exe	Explorer.EXE

flow	pid	process
25	1256	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

1907a0cc44810a9ddcdcd3701c390d036feedbc55a812e797add53a7c935e178.exe

description	pid	process	target process
PID 508 set thread context of 1256	508	1907a0cc44810a9ddcdcd3701c390d036feedbc55a812e797add53a7c935e178.exe	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

1907a0cc44810a9ddcdcd3701c390d036feedbc55a812e797add53a7c935e178.exe

pid	process
508	1907a0cc44810a9ddcdcd3701c390d036feedbc55a812e797add53a7c935e178.exe
508	1907a0cc44810a9ddcdcd3701c390d036feedbc55a812e797add53a7c935e178.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

1907a0cc44810a9ddcdcd3701c390d036feedbc55a812e797add53a7c935e178.exemsiexec.exe

description	pid	process
Token: SeDebugPrivilege	508	1907a0cc44810a9ddcdcd3701c390d036feedbc55a812e797add53a7c935e178.exe
Token: SeSecurityPrivilege	1256	msiexec.exe
Token: SeSecurityPrivilege	1256	msiexec.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

1907a0cc44810a9ddcdcd3701c390d036feedbc55a812e797add53a7c935e178.exe

description	pid	process	target process
PID 508 wrote to memory of 1256	508	1907a0cc44810a9ddcdcd3701c390d036feedbc55a812e797add53a7c935e178.exe	msiexec.exe
PID 508 wrote to memory of 1256	508	1907a0cc44810a9ddcdcd3701c390d036feedbc55a812e797add53a7c935e178.exe	msiexec.exe
PID 508 wrote to memory of 1256	508	1907a0cc44810a9ddcdcd3701c390d036feedbc55a812e797add53a7c935e178.exe	msiexec.exe
PID 508 wrote to memory of 1256	508	1907a0cc44810a9ddcdcd3701c390d036feedbc55a812e797add53a7c935e178.exe	msiexec.exe
PID 508 wrote to memory of 1256	508	1907a0cc44810a9ddcdcd3701c390d036feedbc55a812e797add53a7c935e178.exe	msiexec.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2576
- C:\Users\Admin\AppData\Local\Temp\1907a0cc44810a9ddcdcd3701c390d036feedbc55a812e797add53a7c935e178.exe
  "C:\Users\Admin\AppData\Local\Temp\1907a0cc44810a9ddcdcd3701c390d036feedbc55a812e797add53a7c935e178.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:508
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of AdjustPrivilegeToken
  PID:1256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/508-130-0x0000000000410000-0x0000000000436000-memory.dmp

Filesize
152KB

Download
memory/508-131-0x0000000000410000-0x0000000000709000-memory.dmp

Filesize
3.0MB

Download
memory/508-132-0x0000000000410000-0x0000000000709000-memory.dmp

Filesize
3.0MB

Download
memory/1256-133-0x0000000000000000-mapping.dmp

Download
memory/1256-134-0x00000000003D0000-0x00000000003F6000-memory.dmp

Filesize
152KB

Download
memory/1256-135-0x00000000003D0000-0x00000000003F6000-memory.dmp

Filesize
152KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads