zloader | 4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda

General

Target

4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe
Size

210KB
MD5

4bfa9cefa15eac5ca5cded94aa2c5e1b
SHA1

1a853121291b92f5e9aeb223207a2fb7a50c4c9c
SHA256

4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda
SHA512

c3aeaec789c9eeb9f097316b3b1baa795ae62db81c43402c77617f344a855bdb09c8bc6726d7b0912da38147d67e2c39ad3dbbb8625660129daf708ac5f621f9

Score

10^/10

zloader r1 r1 botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

r1

Campaign

r1

C2

https://freebreez.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://makaronz.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://ricklick.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://litlblockblack.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://vaktorianpackif.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://hbamefphmqsdgkqojgwe.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://hoxfqvlgoabyfspvjimc.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://yrsfuaegsevyffrfsgpj.com/LKhwojehDgwegSDG/gateJKjdsh.php

Attributes

build_id
83

rc4.plain

rsa_pubkey.plain

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe

description pid process target process

PID 1092 created 1268 1092 4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe Explorer.EXE
Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

description	pid	process	target process
PID 1092 created 1268	1092	4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe	Explorer.EXE

Suspicious use of SetThreadContext 1 IoCs

Processes:

4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe

description	pid	process	target process
PID 1092 set thread context of 1648	1092	4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe	msiexec.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe

pid process

1092 4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe

pid	process
1092	4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exemsiexec.exe

description	pid	process
Token: SeDebugPrivilege	1092	4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe
Token: SeSecurityPrivilege	1648	msiexec.exe
Token: SeSecurityPrivilege	1648	msiexec.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe

description	pid	process	target process
PID 1092 wrote to memory of 1648	1092	4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe	msiexec.exe
PID 1092 wrote to memory of 1648	1092	4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe	msiexec.exe
PID 1092 wrote to memory of 1648	1092	4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe	msiexec.exe
PID 1092 wrote to memory of 1648	1092	4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe	msiexec.exe
PID 1092 wrote to memory of 1648	1092	4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe	msiexec.exe
PID 1092 wrote to memory of 1648	1092	4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe	msiexec.exe
PID 1092 wrote to memory of 1648	1092	4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe	msiexec.exe
PID 1092 wrote to memory of 1648	1092	4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe	msiexec.exe
PID 1092 wrote to memory of 1648	1092	4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe	msiexec.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1268

C:\Users\Admin\AppData\Local\Temp\4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe
"C:\Users\Admin\AppData\Local\Temp\4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe"
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1092

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1648

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1092-54-0x0000000000A9B000-0x0000000000AB6000-memory.dmp

Filesize
108KB

Download
memory/1092-55-0x0000000000220000-0x000000000024A000-memory.dmp

Filesize
168KB

Download
memory/1092-56-0x0000000000400000-0x00000000008D4000-memory.dmp

Filesize
4.8MB

Download
memory/1648-57-0x0000000000090000-0x00000000000BD000-memory.dmp

Filesize
180KB

Download
memory/1648-59-0x0000000000090000-0x00000000000BD000-memory.dmp

Filesize
180KB

Download
memory/1648-60-0x0000000000000000-mapping.dmp

Download
memory/1648-61-0x00000000752A1000-0x00000000752A3000-memory.dmp

Filesize
8KB

Download
memory/1648-62-0x0000000000090000-0x00000000000BD000-memory.dmp

Filesize
180KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads