zloader | aed3dfe631190b233b06f472c55af6dd1d222bc07c3ac32284a29555bf6bf1e1

General

Target

aed3dfe631190b233b06f472c55af6dd1d222bc07c3ac32284a29555bf6bf1e1.exe
Size

204KB
MD5

3c444a0943effa540416d6e44fbcb13d
SHA1

e9d69e561e6adbac9e5db5375fd6b138d2fb3d2b
SHA256

aed3dfe631190b233b06f472c55af6dd1d222bc07c3ac32284a29555bf6bf1e1
SHA512

7496257548078d4f23229545d48f23a828c8afffca78bf6c0a3c4d78a2b83439629bff2d7b6753e78c214d1960abf1a535a61a8cfd25e10285228200b305781a

Score

10^/10

zloader canadaloads nerino botnet persistence trojan

Malware Config

Extracted

Family

zloader

Botnet

CanadaLoads

Campaign

Nerino

C2

https://tempmailsin112.com/bFnF0y1r/7QKpXmV3Pz.php

https://roadonroadonroad.com/bFnF0y1r/7QKpXmV3Pz.php

https://roadtocaliss.com/bFnF0y1r/7QKpXmV3Pz.php

https://referrer222.com/bFnF0y1r/7QKpXmV3Pz.php

https://makeitrainfordee.com/bFnF0y1r/7QKpXmV3Pz.php

https://makeitrainforffeer.com/bFnF0y1r/7QKpXmV3Pz.php

https://torosdodos221.com/bFnF0y1r/7QKpXmV3Pz.php

https://morningcoffeeclasd.com/bFnF0y1r/7QKpXmV3Pz.php

https://rememberingtss.com/bFnF0y1r/7QKpXmV3Pz.php

https://dodavova012.com/bFnF0y1r/7QKpXmV3Pz.php

Attributes

build_id
67

rc4.plain

rsa_pubkey.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Blocklisted process makes network request 6 IoCs

flow	pid	Process
5	820	msiexec.exe
6	820	msiexec.exe
8	820	msiexec.exe
9	820	msiexec.exe
10	820	msiexec.exe
11	820	msiexec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\Luuq = "C:\\Users\\Admin\\AppData\\Roaming\\Bidy\\urhetuh.exe"	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1944 set thread context of 820	1944	aed3dfe631190b233b06f472c55af6dd1d222bc07c3ac32284a29555bf6bf1e1.exe	27

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	820	msiexec.exe
Token: SeSecurityPrivilege	820	msiexec.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 820	1944	aed3dfe631190b233b06f472c55af6dd1d222bc07c3ac32284a29555bf6bf1e1.exe	27
PID 1944 wrote to memory of 820	1944	aed3dfe631190b233b06f472c55af6dd1d222bc07c3ac32284a29555bf6bf1e1.exe	27
PID 1944 wrote to memory of 820	1944	aed3dfe631190b233b06f472c55af6dd1d222bc07c3ac32284a29555bf6bf1e1.exe	27
PID 1944 wrote to memory of 820	1944	aed3dfe631190b233b06f472c55af6dd1d222bc07c3ac32284a29555bf6bf1e1.exe	27
PID 1944 wrote to memory of 820	1944	aed3dfe631190b233b06f472c55af6dd1d222bc07c3ac32284a29555bf6bf1e1.exe	27
PID 1944 wrote to memory of 820	1944	aed3dfe631190b233b06f472c55af6dd1d222bc07c3ac32284a29555bf6bf1e1.exe	27
PID 1944 wrote to memory of 820	1944	aed3dfe631190b233b06f472c55af6dd1d222bc07c3ac32284a29555bf6bf1e1.exe	27
PID 1944 wrote to memory of 820	1944	aed3dfe631190b233b06f472c55af6dd1d222bc07c3ac32284a29555bf6bf1e1.exe	27
PID 1944 wrote to memory of 820	1944	aed3dfe631190b233b06f472c55af6dd1d222bc07c3ac32284a29555bf6bf1e1.exe	27

C:\Users\Admin\AppData\Local\Temp\aed3dfe631190b233b06f472c55af6dd1d222bc07c3ac32284a29555bf6bf1e1.exe
"C:\Users\Admin\AppData\Local\Temp\aed3dfe631190b233b06f472c55af6dd1d222bc07c3ac32284a29555bf6bf1e1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe
  2⤵
  - Blocklisted process makes network request
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:820

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/820-57-0x0000000000090000-0x00000000000B9000-memory.dmp

Filesize
164KB

Download
memory/820-59-0x0000000000090000-0x00000000000B9000-memory.dmp

Filesize
164KB

Download
memory/820-61-0x00000000753C1000-0x00000000753C3000-memory.dmp

Filesize
8KB

Download
memory/820-62-0x0000000000090000-0x00000000000B9000-memory.dmp

Filesize
164KB

Download
memory/1944-54-0x000000000088B000-0x00000000008A5000-memory.dmp

Filesize
104KB

Download
memory/1944-55-0x00000000002B0000-0x00000000002D6000-memory.dmp

Filesize
152KB

Download
memory/1944-56-0x0000000000400000-0x00000000007EF000-memory.dmp

Filesize
3.9MB

Download

Analysis

Sharing