zloader | 4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda

General

Target

4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe
Size

210KB
MD5

4bfa9cefa15eac5ca5cded94aa2c5e1b
SHA1

1a853121291b92f5e9aeb223207a2fb7a50c4c9c
SHA256

4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda
SHA512

c3aeaec789c9eeb9f097316b3b1baa795ae62db81c43402c77617f344a855bdb09c8bc6726d7b0912da38147d67e2c39ad3dbbb8625660129daf708ac5f621f9

Score

10^/10

zloader r1 r1 botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

r1

Campaign

r1

C2

https://freebreez.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://makaronz.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://ricklick.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://litlblockblack.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://vaktorianpackif.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://hbamefphmqsdgkqojgwe.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://hoxfqvlgoabyfspvjimc.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://yrsfuaegsevyffrfsgpj.com/LKhwojehDgwegSDG/gateJKjdsh.php

Attributes

build_id
83

rc4.plain

rsa_pubkey.plain

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1092 created 1268	1092	4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe	8

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1092 set thread context of 1648	1092	4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1092	4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1092	4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe
Token: SeSecurityPrivilege	1648	msiexec.exe
Token: SeSecurityPrivilege	1648	msiexec.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 1648	1092	4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe	28
PID 1092 wrote to memory of 1648	1092	4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe	28
PID 1092 wrote to memory of 1648	1092	4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe	28
PID 1092 wrote to memory of 1648	1092	4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe	28
PID 1092 wrote to memory of 1648	1092	4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe	28
PID 1092 wrote to memory of 1648	1092	4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe	28
PID 1092 wrote to memory of 1648	1092	4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe	28
PID 1092 wrote to memory of 1648	1092	4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe	28
PID 1092 wrote to memory of 1648	1092	4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe	28

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1268
- C:\Users\Admin\AppData\Local\Temp\4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe
  "C:\Users\Admin\AppData\Local\Temp\4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1092
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1092-54-0x0000000000A9B000-0x0000000000AB6000-memory.dmp

Filesize
108KB

Download
memory/1092-55-0x0000000000220000-0x000000000024A000-memory.dmp

Filesize
168KB

Download
memory/1092-56-0x0000000000400000-0x00000000008D4000-memory.dmp

Filesize
4.8MB

Download
memory/1648-57-0x0000000000090000-0x00000000000BD000-memory.dmp

Filesize
180KB

Download
memory/1648-59-0x0000000000090000-0x00000000000BD000-memory.dmp

Filesize
180KB

Download
memory/1648-61-0x00000000752A1000-0x00000000752A3000-memory.dmp

Filesize
8KB

Download
memory/1648-62-0x0000000000090000-0x00000000000BD000-memory.dmp

Filesize
180KB

Download

Analysis

Sharing