zloader | aed3dfe631190b233b06f472c55af6dd1d222bc07c3ac32284a29555bf6bf1e1

General

Target

aed3dfe631190b233b06f472c55af6dd1d222bc07c3ac32284a29555bf6bf1e1.exe
Size

204KB
MD5

3c444a0943effa540416d6e44fbcb13d
SHA1

e9d69e561e6adbac9e5db5375fd6b138d2fb3d2b
SHA256

aed3dfe631190b233b06f472c55af6dd1d222bc07c3ac32284a29555bf6bf1e1
SHA512

7496257548078d4f23229545d48f23a828c8afffca78bf6c0a3c4d78a2b83439629bff2d7b6753e78c214d1960abf1a535a61a8cfd25e10285228200b305781a

Score

10^/10

zloader canadaloads nerino botnet persistence trojan

Malware Config

Extracted

Family

zloader

Botnet

CanadaLoads

Campaign

Nerino

C2

https://tempmailsin112.com/bFnF0y1r/7QKpXmV3Pz.php

https://roadonroadonroad.com/bFnF0y1r/7QKpXmV3Pz.php

https://roadtocaliss.com/bFnF0y1r/7QKpXmV3Pz.php

https://referrer222.com/bFnF0y1r/7QKpXmV3Pz.php

https://makeitrainfordee.com/bFnF0y1r/7QKpXmV3Pz.php

https://makeitrainforffeer.com/bFnF0y1r/7QKpXmV3Pz.php

https://torosdodos221.com/bFnF0y1r/7QKpXmV3Pz.php

https://morningcoffeeclasd.com/bFnF0y1r/7QKpXmV3Pz.php

https://rememberingtss.com/bFnF0y1r/7QKpXmV3Pz.php

https://dodavova012.com/bFnF0y1r/7QKpXmV3Pz.php

Attributes

build_id
67

rc4.plain

rsa_pubkey.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
Blocklisted process makes network request 6 IoCs

Processes:

msiexec.exe

flow pid process

5 820 msiexec.exe
6 820 msiexec.exe
8 820 msiexec.exe
9 820 msiexec.exe
10 820 msiexec.exe
11 820 msiexec.exe

flow	pid	process
5	820	msiexec.exe
6	820	msiexec.exe
8	820	msiexec.exe
9	820	msiexec.exe
10	820	msiexec.exe
11	820	msiexec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\Luuq = "C:\\Users\\Admin\\AppData\\Roaming\\Bidy\\urhetuh.exe"	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

aed3dfe631190b233b06f472c55af6dd1d222bc07c3ac32284a29555bf6bf1e1.exe

description	pid	process	target process
PID 1944 set thread context of 820	1944	aed3dfe631190b233b06f472c55af6dd1d222bc07c3ac32284a29555bf6bf1e1.exe	msiexec.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeSecurityPrivilege 820 msiexec.exe
Token: SeSecurityPrivilege 820 msiexec.exe

description	pid	process
Token: SeSecurityPrivilege	820	msiexec.exe
Token: SeSecurityPrivilege	820	msiexec.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

aed3dfe631190b233b06f472c55af6dd1d222bc07c3ac32284a29555bf6bf1e1.exe

description	pid	process	target process
PID 1944 wrote to memory of 820	1944	aed3dfe631190b233b06f472c55af6dd1d222bc07c3ac32284a29555bf6bf1e1.exe	msiexec.exe
PID 1944 wrote to memory of 820	1944	aed3dfe631190b233b06f472c55af6dd1d222bc07c3ac32284a29555bf6bf1e1.exe	msiexec.exe
PID 1944 wrote to memory of 820	1944	aed3dfe631190b233b06f472c55af6dd1d222bc07c3ac32284a29555bf6bf1e1.exe	msiexec.exe
PID 1944 wrote to memory of 820	1944	aed3dfe631190b233b06f472c55af6dd1d222bc07c3ac32284a29555bf6bf1e1.exe	msiexec.exe
PID 1944 wrote to memory of 820	1944	aed3dfe631190b233b06f472c55af6dd1d222bc07c3ac32284a29555bf6bf1e1.exe	msiexec.exe
PID 1944 wrote to memory of 820	1944	aed3dfe631190b233b06f472c55af6dd1d222bc07c3ac32284a29555bf6bf1e1.exe	msiexec.exe
PID 1944 wrote to memory of 820	1944	aed3dfe631190b233b06f472c55af6dd1d222bc07c3ac32284a29555bf6bf1e1.exe	msiexec.exe
PID 1944 wrote to memory of 820	1944	aed3dfe631190b233b06f472c55af6dd1d222bc07c3ac32284a29555bf6bf1e1.exe	msiexec.exe
PID 1944 wrote to memory of 820	1944	aed3dfe631190b233b06f472c55af6dd1d222bc07c3ac32284a29555bf6bf1e1.exe	msiexec.exe

C:\Users\Admin\AppData\Local\Temp\aed3dfe631190b233b06f472c55af6dd1d222bc07c3ac32284a29555bf6bf1e1.exe
"C:\Users\Admin\AppData\Local\Temp\aed3dfe631190b233b06f472c55af6dd1d222bc07c3ac32284a29555bf6bf1e1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1944

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
2⤵
- Blocklisted process makes network request
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:820

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/820-57-0x0000000000090000-0x00000000000B9000-memory.dmp

Filesize
164KB

Download
memory/820-59-0x0000000000090000-0x00000000000B9000-memory.dmp

Filesize
164KB

Download
memory/820-60-0x0000000000000000-mapping.dmp

Download
memory/820-61-0x00000000753C1000-0x00000000753C3000-memory.dmp

Filesize
8KB

Download
memory/820-62-0x0000000000090000-0x00000000000B9000-memory.dmp

Filesize
164KB

Download
memory/1944-54-0x000000000088B000-0x00000000008A5000-memory.dmp

Filesize
104KB

Download
memory/1944-55-0x00000000002B0000-0x00000000002D6000-memory.dmp

Filesize
152KB

Download
memory/1944-56-0x0000000000400000-0x00000000007EF000-memory.dmp

Filesize
3.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads