zloader | 15319e2289bb351467d4944bff9ae6c08a16d1e6f321b42311defe4b337fb6f0

Resubmissions

31-10-2023 08:38

231031-kjprfabf94 10

03-05-2022 14:53

220503-r9rgaacbbl 10

Analysis

max time kernel
141s
max time network
146s
platform
windows7_x64
resource
win7-20220414-en
submitted
03-05-2022 14:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15319e2289bb351467d4944bff9ae6c08a16d1e6f321b42311defe4b337fb6f0.exe
Size

186KB
MD5

efe5547a2572257807e7ff798ddb8b13
SHA1

0e5b0e9299a9078a9c6cab5abaccc0aee328b6d4
SHA256

15319e2289bb351467d4944bff9ae6c08a16d1e6f321b42311defe4b337fb6f0
SHA512

397db5a334a35569296cc72962482aff2749644ca0a54e4f356ee2768eaf97f3fe516bb11905c82ee36d64ea22443588a8697d3543422f25194b0a267dfad13c

Score

10^/10

zloader canadaloads nerino botnet persistence trojan

Malware Config

Extracted

Family

zloader

Botnet

CanadaLoads

Campaign

Nerino

https://makemoneywithforexxs.com/bFnF0y1r/7QKpXmV3Pz.php

https://monanuslanus.com/bFnF0y1r/7QKpXmV3Pz.php

https://lericastrongs.com/bFnF0y1r/7QKpXmV3Pz.php

https://hyllionsudks.com/bFnF0y1r/7QKpXmV3Pz.php

https://crimewasddef.com/bFnF0y1r/7QKpXmV3Pz.php

https://derekdsingel.com/bFnF0y1r/7QKpXmV3Pz.php

https://simplereffiret.com/bFnF0y1r/7QKpXmV3Pz.php

https://regeerscomba.com/bFnF0y1r/7QKpXmV3Pz.php

Attributes

build_id
73

rc4.plain

rsa_pubkey.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
Blocklisted process makes network request 5 IoCs

Processes:

msiexec.exe

flow pid process

5 2008 msiexec.exe
6 2008 msiexec.exe
7 2008 msiexec.exe
8 2008 msiexec.exe
10 2008 msiexec.exe

flow	pid	process
5	2008	msiexec.exe
6	2008	msiexec.exe
7	2008	msiexec.exe
8	2008	msiexec.exe
10	2008	msiexec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ylnaluhi = "C:\\Users\\Admin\\AppData\\Roaming\\Eral\\suar.exe"	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

15319e2289bb351467d4944bff9ae6c08a16d1e6f321b42311defe4b337fb6f0.exe

description	pid	process	target process
PID 548 set thread context of 2008	548	15319e2289bb351467d4944bff9ae6c08a16d1e6f321b42311defe4b337fb6f0.exe	msiexec.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeSecurityPrivilege 2008 msiexec.exe
Token: SeSecurityPrivilege 2008 msiexec.exe

description	pid	process
Token: SeSecurityPrivilege	2008	msiexec.exe
Token: SeSecurityPrivilege	2008	msiexec.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

15319e2289bb351467d4944bff9ae6c08a16d1e6f321b42311defe4b337fb6f0.exe

description	pid	process	target process
PID 548 wrote to memory of 2008	548	15319e2289bb351467d4944bff9ae6c08a16d1e6f321b42311defe4b337fb6f0.exe	msiexec.exe
PID 548 wrote to memory of 2008	548	15319e2289bb351467d4944bff9ae6c08a16d1e6f321b42311defe4b337fb6f0.exe	msiexec.exe
PID 548 wrote to memory of 2008	548	15319e2289bb351467d4944bff9ae6c08a16d1e6f321b42311defe4b337fb6f0.exe	msiexec.exe
PID 548 wrote to memory of 2008	548	15319e2289bb351467d4944bff9ae6c08a16d1e6f321b42311defe4b337fb6f0.exe	msiexec.exe
PID 548 wrote to memory of 2008	548	15319e2289bb351467d4944bff9ae6c08a16d1e6f321b42311defe4b337fb6f0.exe	msiexec.exe
PID 548 wrote to memory of 2008	548	15319e2289bb351467d4944bff9ae6c08a16d1e6f321b42311defe4b337fb6f0.exe	msiexec.exe
PID 548 wrote to memory of 2008	548	15319e2289bb351467d4944bff9ae6c08a16d1e6f321b42311defe4b337fb6f0.exe	msiexec.exe
PID 548 wrote to memory of 2008	548	15319e2289bb351467d4944bff9ae6c08a16d1e6f321b42311defe4b337fb6f0.exe	msiexec.exe
PID 548 wrote to memory of 2008	548	15319e2289bb351467d4944bff9ae6c08a16d1e6f321b42311defe4b337fb6f0.exe	msiexec.exe

C:\Users\Admin\AppData\Local\Temp\15319e2289bb351467d4944bff9ae6c08a16d1e6f321b42311defe4b337fb6f0.exe
"C:\Users\Admin\AppData\Local\Temp\15319e2289bb351467d4944bff9ae6c08a16d1e6f321b42311defe4b337fb6f0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:548

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
2⤵
- Blocklisted process makes network request
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:2008

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/548-54-0x00000000006AB000-0x00000000006C5000-memory.dmp

Filesize
104KB

Download
memory/548-55-0x0000000000230000-0x0000000000256000-memory.dmp

Filesize
152KB

Download
memory/548-56-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2008-57-0x0000000000090000-0x00000000000B9000-memory.dmp

Filesize
164KB

Download
memory/2008-59-0x0000000000090000-0x00000000000B9000-memory.dmp

Filesize
164KB

Download
memory/2008-60-0x0000000000000000-mapping.dmp

Download
memory/2008-61-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download
memory/2008-62-0x0000000000090000-0x00000000000B9000-memory.dmp

Filesize
164KB

Download