zloader | 57dafb880df226e923da9f493c07980dc47b611f5bb6ebb337062de99b9e3a52

General

Target

57dafb880df226e923da9f493c07980dc47b611f5bb6ebb337062de99b9e3a52.exe
Size

447KB
MD5

83059ecb2b70c5c283938fdb798de541
SHA1

b8b151d34563d8510cbc4607b235edf57c36efaf
SHA256

57dafb880df226e923da9f493c07980dc47b611f5bb6ebb337062de99b9e3a52
SHA512

ed8024d89af1bd4d6da38af44d8466365c666cf1a5c0a5baa02db1c5493888e60618fe0bb3e72c0368b7272e97e1d7447c12aeb9e253437a50bc6977267a834b

Score

10^/10

zloader r1 r1 botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

r1

Campaign

r1

C2

https://notsweets.net/LKhwojehDgwegSDG/gateJKjdsh.php

https://olpons.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://karamelliar.org/LKhwojehDgwegSDG/gateJKjdsh.php

https://dogrunn.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://azoraz.net/LKhwojehDgwegSDG/gateJKjdsh.php

Attributes

build_id
125

rc4.plain

rsa_pubkey.plain

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

57dafb880df226e923da9f493c07980dc47b611f5bb6ebb337062de99b9e3a52.exe

description pid process target process

PID 1840 created 3188 1840 57dafb880df226e923da9f493c07980dc47b611f5bb6ebb337062de99b9e3a52.exe Explorer.EXE
Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
Blocklisted process makes network request 1 IoCs

Processes:

msiexec.exe

flow pid process

16 4040 msiexec.exe

description	pid	process	target process
PID 1840 created 3188	1840	57dafb880df226e923da9f493c07980dc47b611f5bb6ebb337062de99b9e3a52.exe	Explorer.EXE

flow	pid	process
16	4040	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

57dafb880df226e923da9f493c07980dc47b611f5bb6ebb337062de99b9e3a52.exe

description	pid	process	target process
PID 1840 set thread context of 4040	1840	57dafb880df226e923da9f493c07980dc47b611f5bb6ebb337062de99b9e3a52.exe	msiexec.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2584 1840 WerFault.exe 57dafb880df226e923da9f493c07980dc47b611f5bb6ebb337062de99b9e3a52.exe

pid	pid_target	process	target process
2584	1840	WerFault.exe	57dafb880df226e923da9f493c07980dc47b611f5bb6ebb337062de99b9e3a52.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

57dafb880df226e923da9f493c07980dc47b611f5bb6ebb337062de99b9e3a52.exe

pid	process
1840	57dafb880df226e923da9f493c07980dc47b611f5bb6ebb337062de99b9e3a52.exe
1840	57dafb880df226e923da9f493c07980dc47b611f5bb6ebb337062de99b9e3a52.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

57dafb880df226e923da9f493c07980dc47b611f5bb6ebb337062de99b9e3a52.exemsiexec.exe

description	pid	process
Token: SeDebugPrivilege	1840	57dafb880df226e923da9f493c07980dc47b611f5bb6ebb337062de99b9e3a52.exe
Token: SeSecurityPrivilege	4040	msiexec.exe
Token: SeSecurityPrivilege	4040	msiexec.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

57dafb880df226e923da9f493c07980dc47b611f5bb6ebb337062de99b9e3a52.exe

description	pid	process	target process
PID 1840 wrote to memory of 4040	1840	57dafb880df226e923da9f493c07980dc47b611f5bb6ebb337062de99b9e3a52.exe	msiexec.exe
PID 1840 wrote to memory of 4040	1840	57dafb880df226e923da9f493c07980dc47b611f5bb6ebb337062de99b9e3a52.exe	msiexec.exe
PID 1840 wrote to memory of 4040	1840	57dafb880df226e923da9f493c07980dc47b611f5bb6ebb337062de99b9e3a52.exe	msiexec.exe
PID 1840 wrote to memory of 4040	1840	57dafb880df226e923da9f493c07980dc47b611f5bb6ebb337062de99b9e3a52.exe	msiexec.exe
PID 1840 wrote to memory of 4040	1840	57dafb880df226e923da9f493c07980dc47b611f5bb6ebb337062de99b9e3a52.exe	msiexec.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3188

C:\Users\Admin\AppData\Local\Temp\57dafb880df226e923da9f493c07980dc47b611f5bb6ebb337062de99b9e3a52.exe
"C:\Users\Admin\AppData\Local\Temp\57dafb880df226e923da9f493c07980dc47b611f5bb6ebb337062de99b9e3a52.exe"
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 484
3⤵
- Program crash
PID:2584

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
2⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:4040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1840 -ip 1840
1⤵
PID:2964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1840-130-0x0000000002597000-0x00000000025B0000-memory.dmp

Filesize
100KB

Download
memory/1840-132-0x00000000024C0000-0x00000000024E5000-memory.dmp

Filesize
148KB

Download
memory/1840-131-0x0000000002597000-0x00000000025B0000-memory.dmp

Filesize
100KB

Download
memory/1840-133-0x0000000000400000-0x000000000232C000-memory.dmp

Filesize
31.2MB

Download
memory/4040-134-0x0000000000000000-mapping.dmp

Download
memory/4040-135-0x0000000000D30000-0x0000000000D58000-memory.dmp

Filesize
160KB

Download
memory/4040-136-0x0000000000D30000-0x0000000000D58000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads