zloader | 4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda

General

Target

4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe
Size

210KB
MD5

4bfa9cefa15eac5ca5cded94aa2c5e1b
SHA1

1a853121291b92f5e9aeb223207a2fb7a50c4c9c
SHA256

4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda
SHA512

c3aeaec789c9eeb9f097316b3b1baa795ae62db81c43402c77617f344a855bdb09c8bc6726d7b0912da38147d67e2c39ad3dbbb8625660129daf708ac5f621f9

Score

10^/10

zloader r1 r1 botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

r1

Campaign

r1

C2

https://freebreez.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://makaronz.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://ricklick.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://litlblockblack.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://vaktorianpackif.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://hbamefphmqsdgkqojgwe.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://hoxfqvlgoabyfspvjimc.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://yrsfuaegsevyffrfsgpj.com/LKhwojehDgwegSDG/gateJKjdsh.php

Attributes

build_id
83

rc4.plain

rsa_pubkey.plain

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe

description pid process target process

PID 2308 created 3052 2308 4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe Explorer.EXE
Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

description	pid	process	target process
PID 2308 created 3052	2308	4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe	Explorer.EXE

Suspicious use of SetThreadContext 1 IoCs

Processes:

4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe

description	pid	process	target process
PID 2308 set thread context of 4528	2308	4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe	msiexec.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3628 2308 WerFault.exe 4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe

pid	pid_target	process	target process
3628	2308	WerFault.exe	4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe

pid	process
2308	4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe
2308	4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exemsiexec.exe

description	pid	process
Token: SeDebugPrivilege	2308	4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe
Token: SeSecurityPrivilege	4528	msiexec.exe
Token: SeSecurityPrivilege	4528	msiexec.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe

description	pid	process	target process
PID 2308 wrote to memory of 4528	2308	4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe	msiexec.exe
PID 2308 wrote to memory of 4528	2308	4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe	msiexec.exe
PID 2308 wrote to memory of 4528	2308	4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe	msiexec.exe
PID 2308 wrote to memory of 4528	2308	4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe	msiexec.exe
PID 2308 wrote to memory of 4528	2308	4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe	msiexec.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3052

C:\Users\Admin\AppData\Local\Temp\4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe
"C:\Users\Admin\AppData\Local\Temp\4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda.exe"
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 460
3⤵
- Program crash
PID:3628

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2308 -ip 2308
1⤵
PID:4360

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2308-130-0x0000000000B88000-0x0000000000BA3000-memory.dmp

Filesize
108KB

Download
memory/2308-131-0x0000000000B30000-0x0000000000B5A000-memory.dmp

Filesize
168KB

Download
memory/2308-132-0x0000000000400000-0x00000000008D4000-memory.dmp

Filesize
4.8MB

Download
memory/4528-133-0x0000000000000000-mapping.dmp

Download
memory/4528-134-0x00000000002B0000-0x00000000002DD000-memory.dmp

Filesize
180KB

Download
memory/4528-135-0x00000000002B0000-0x00000000002DD000-memory.dmp

Filesize
180KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads