zloader | 787c78e5654a6671a8e7f499d5d45a6c04f33a1a0d4b2226752b70da52ea592b

Analysis

max time kernel
150s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
18-04-2022 05:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

787c78e5654a6671a8e7f499d5d45a6c04f33a1a0d4b2226752b70da52ea592b.exe
Size

736KB
MD5

5c26254bbde4b83aa81994a0386daf2a
SHA1

4d6a63deaaf17cc6753419dffb33f402714cf83d
SHA256

787c78e5654a6671a8e7f499d5d45a6c04f33a1a0d4b2226752b70da52ea592b
SHA512

865df8fc49ad434ebfa55620944f333a00401905b169b38b21c58ca15af67888f8616241ed37950bd1b217720f33a3fa1ceb9d6b6b0f2c5ed44bfed9223b07e7

Score

10^/10

zloader google1 google1 botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

google1

Campaign

google1

https://eecakesconf.at/web982/gate.php

Attributes

build_id
2

rc4.plain

rsa_pubkey.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1888 set thread context of 4200	1888	787c78e5654a6671a8e7f499d5d45a6c04f33a1a0d4b2226752b70da52ea592b.exe	78

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 4200	1888	787c78e5654a6671a8e7f499d5d45a6c04f33a1a0d4b2226752b70da52ea592b.exe	78
PID 1888 wrote to memory of 4200	1888	787c78e5654a6671a8e7f499d5d45a6c04f33a1a0d4b2226752b70da52ea592b.exe	78
PID 1888 wrote to memory of 4200	1888	787c78e5654a6671a8e7f499d5d45a6c04f33a1a0d4b2226752b70da52ea592b.exe	78
PID 1888 wrote to memory of 4200	1888	787c78e5654a6671a8e7f499d5d45a6c04f33a1a0d4b2226752b70da52ea592b.exe	78
PID 1888 wrote to memory of 4200	1888	787c78e5654a6671a8e7f499d5d45a6c04f33a1a0d4b2226752b70da52ea592b.exe	78

C:\Users\Admin\AppData\Local\Temp\787c78e5654a6671a8e7f499d5d45a6c04f33a1a0d4b2226752b70da52ea592b.exe
"C:\Users\Admin\AppData\Local\Temp\787c78e5654a6671a8e7f499d5d45a6c04f33a1a0d4b2226752b70da52ea592b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe
  2⤵
  PID:4200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1888-130-0x0000000000B00000-0x0000000000B29000-memory.dmp

Filesize
164KB

Download
memory/1888-131-0x0000000000B00000-0x0000000000EA8000-memory.dmp

Filesize
3.7MB

Download
memory/1888-132-0x0000000000B00000-0x0000000000EA8000-memory.dmp

Filesize
3.7MB

Download
memory/4200-134-0x0000000000380000-0x00000000003A9000-memory.dmp

Filesize
164KB

Download
memory/4200-135-0x0000000000380000-0x00000000003A9000-memory.dmp

Filesize
164KB

Download