zloader | cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf

General

Target

cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe
Size

804KB
MD5

9d6680e9b0807d476ce0f39ead7f6b2a
SHA1

fb65b9487a06464440cf86eb583ee68c34b4bd5d
SHA256

cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf
SHA512

4e7e93756d1f60ae7a472a80f04760e4b0fafeedcd3c8f83fbf85001cfb96ce96b287eb2f1621f5a68d13de11588b7eef480f047a667438af13816e05f68987e

Score

10^/10

zloader target1 target1 botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

target1

Campaign

target1

C2

https://freebreez.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://makaronz.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://ricklick.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://litlblockblack.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://vaktorianpackif.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://hbamefphmqsdgkqojgwe.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://hoxfqvlgoabyfspvjimc.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://yrsfuaegsevyffrfsgpj.com/LKhwojehDgwegSDG/gateJKjdsh.php

Attributes

build_id
71

rc4.plain

rsa_pubkey.plain

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 536 created 1208	536	cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe	12

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 536 set thread context of 1644	536	cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
536	cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	536	cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe
Token: SeSecurityPrivilege	1644	msiexec.exe
Token: SeSecurityPrivilege	1644	msiexec.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 1644	536	cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe	28
PID 536 wrote to memory of 1644	536	cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe	28
PID 536 wrote to memory of 1644	536	cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe	28
PID 536 wrote to memory of 1644	536	cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe	28
PID 536 wrote to memory of 1644	536	cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe	28
PID 536 wrote to memory of 1644	536	cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe	28
PID 536 wrote to memory of 1644	536	cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe	28
PID 536 wrote to memory of 1644	536	cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe	28
PID 536 wrote to memory of 1644	536	cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe	28

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1208
- C:\Users\Admin\AppData\Local\Temp\cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe
  "C:\Users\Admin\AppData\Local\Temp\cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:536
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/536-54-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/536-55-0x0000000000400000-0x00000000005C8000-memory.dmp

Filesize
1.8MB

Download
memory/1644-56-0x0000000000130000-0x000000000015D000-memory.dmp

Filesize
180KB

Download
memory/1644-58-0x0000000000130000-0x000000000015D000-memory.dmp

Filesize
180KB

Download
memory/1644-60-0x0000000075B61000-0x0000000075B63000-memory.dmp

Filesize
8KB

Download
memory/1644-61-0x0000000000130000-0x000000000015D000-memory.dmp

Filesize
180KB

Download

Analysis

Sharing