Analysis

  • max time kernel
    142s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    18-04-2022 10:14

General

  • Target

    57dafb880df226e923da9f493c07980dc47b611f5bb6ebb337062de99b9e3a52.exe

  • Size

    447KB

  • MD5

    83059ecb2b70c5c283938fdb798de541

  • SHA1

    b8b151d34563d8510cbc4607b235edf57c36efaf

  • SHA256

    57dafb880df226e923da9f493c07980dc47b611f5bb6ebb337062de99b9e3a52

  • SHA512

    ed8024d89af1bd4d6da38af44d8466365c666cf1a5c0a5baa02db1c5493888e60618fe0bb3e72c0368b7272e97e1d7447c12aeb9e253437a50bc6977267a834b

Malware Config

Extracted

Family

zloader

Botnet

r1

Campaign

r1

C2

https://notsweets.net/LKhwojehDgwegSDG/gateJKjdsh.php

https://olpons.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://karamelliar.org/LKhwojehDgwegSDG/gateJKjdsh.php

https://dogrunn.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://azoraz.net/LKhwojehDgwegSDG/gateJKjdsh.php

Attributes
build_id
125
rc4.plain
rsa_pubkey.plain

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess ⋅ 1 IoCs
  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

  • Blocklisted process makes network request ⋅ 1 IoCs
  • Suspicious use of SetThreadContext ⋅ 1 IoCs
  • Program crash ⋅ 1 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 2 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 3 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 5 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    PID:3188
    • C:\Users\Admin\AppData\Local\Temp\57dafb880df226e923da9f493c07980dc47b611f5bb6ebb337062de99b9e3a52.exe
      "C:\Users\Admin\AppData\Local\Temp\57dafb880df226e923da9f493c07980dc47b611f5bb6ebb337062de99b9e3a52.exe"
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1840
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 484
        Program crash
        PID:2584
    • C:\Windows\SysWOW64\msiexec.exe
      msiexec.exe
      Blocklisted process makes network request
      Suspicious use of AdjustPrivilegeToken
      PID:4040
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1840 -ip 1840
    PID:2964

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Discovery

            Execution

              Exfiltration

                Impact

                  Initial Access

                    Lateral Movement

                      Persistence

                        Privilege Escalation

                          Replay Monitor

                          00:00 00:00

                          Downloads

                          • memory/1840-130-0x0000000002597000-0x00000000025B0000-memory.dmp
                          • memory/1840-132-0x00000000024C0000-0x00000000024E5000-memory.dmp
                          • memory/1840-131-0x0000000002597000-0x00000000025B0000-memory.dmp
                          • memory/1840-133-0x0000000000400000-0x000000000232C000-memory.dmp
                          • memory/4040-134-0x0000000000000000-mapping.dmp
                          • memory/4040-135-0x0000000000D30000-0x0000000000D58000-memory.dmp
                          • memory/4040-136-0x0000000000D30000-0x0000000000D58000-memory.dmp