zloader | cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf

General

Target

cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe
Size

804KB
MD5

9d6680e9b0807d476ce0f39ead7f6b2a
SHA1

fb65b9487a06464440cf86eb583ee68c34b4bd5d
SHA256

cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf
SHA512

4e7e93756d1f60ae7a472a80f04760e4b0fafeedcd3c8f83fbf85001cfb96ce96b287eb2f1621f5a68d13de11588b7eef480f047a667438af13816e05f68987e

Score

10^/10

zloader target1 target1 botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

target1

Campaign

target1

C2

https://freebreez.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://makaronz.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://ricklick.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://litlblockblack.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://vaktorianpackif.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://hbamefphmqsdgkqojgwe.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://hoxfqvlgoabyfspvjimc.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://yrsfuaegsevyffrfsgpj.com/LKhwojehDgwegSDG/gateJKjdsh.php

Attributes

build_id
71

rc4.plain

rsa_pubkey.plain

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe

description pid process target process

PID 536 created 1208 536 cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe Explorer.EXE
Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

description	pid	process	target process
PID 536 created 1208	536	cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe	Explorer.EXE

Suspicious use of SetThreadContext 1 IoCs

Processes:

cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe

description	pid	process	target process
PID 536 set thread context of 1644	536	cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe	msiexec.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe

pid process

536 cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe

pid	process
536	cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exemsiexec.exe

description	pid	process
Token: SeDebugPrivilege	536	cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe
Token: SeSecurityPrivilege	1644	msiexec.exe
Token: SeSecurityPrivilege	1644	msiexec.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe

description	pid	process	target process
PID 536 wrote to memory of 1644	536	cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe	msiexec.exe
PID 536 wrote to memory of 1644	536	cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe	msiexec.exe
PID 536 wrote to memory of 1644	536	cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe	msiexec.exe
PID 536 wrote to memory of 1644	536	cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe	msiexec.exe
PID 536 wrote to memory of 1644	536	cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe	msiexec.exe
PID 536 wrote to memory of 1644	536	cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe	msiexec.exe
PID 536 wrote to memory of 1644	536	cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe	msiexec.exe
PID 536 wrote to memory of 1644	536	cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe	msiexec.exe
PID 536 wrote to memory of 1644	536	cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe	msiexec.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1208

C:\Users\Admin\AppData\Local\Temp\cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe
"C:\Users\Admin\AppData\Local\Temp\cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe"
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:536

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1644

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/536-54-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/536-55-0x0000000000400000-0x00000000005C8000-memory.dmp

Filesize
1.8MB

Download
memory/1644-56-0x0000000000130000-0x000000000015D000-memory.dmp

Filesize
180KB

Download
memory/1644-58-0x0000000000130000-0x000000000015D000-memory.dmp

Filesize
180KB

Download
memory/1644-59-0x0000000000000000-mapping.dmp

Download
memory/1644-60-0x0000000075B61000-0x0000000075B63000-memory.dmp

Filesize
8KB

Download
memory/1644-61-0x0000000000130000-0x000000000015D000-memory.dmp

Filesize
180KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads