zloader | cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf

Analysis

max time kernel
117s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
10-05-2022 17:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe
Size

804KB
MD5

9d6680e9b0807d476ce0f39ead7f6b2a
SHA1

fb65b9487a06464440cf86eb583ee68c34b4bd5d
SHA256

cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf
SHA512

4e7e93756d1f60ae7a472a80f04760e4b0fafeedcd3c8f83fbf85001cfb96ce96b287eb2f1621f5a68d13de11588b7eef480f047a667438af13816e05f68987e

Score

10^/10

zloader target1 target1 botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

target1

Campaign

target1

https://freebreez.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://makaronz.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://ricklick.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://litlblockblack.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://vaktorianpackif.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://hbamefphmqsdgkqojgwe.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://hoxfqvlgoabyfspvjimc.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://yrsfuaegsevyffrfsgpj.com/LKhwojehDgwegSDG/gateJKjdsh.php

Attributes

build_id
71

rc4.plain

rsa_pubkey.plain

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1444 created 3064	1444	cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe	27

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1444 set thread context of 3676	1444	cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe	98

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1444	cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe
1444	cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1444	cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe
Token: SeSecurityPrivilege	3676	msiexec.exe
Token: SeSecurityPrivilege	3676	msiexec.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 3676	1444	cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe	98
PID 1444 wrote to memory of 3676	1444	cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe	98
PID 1444 wrote to memory of 3676	1444	cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe	98
PID 1444 wrote to memory of 3676	1444	cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe	98
PID 1444 wrote to memory of 3676	1444	cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe	98

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3064
- C:\Users\Admin\AppData\Local\Temp\cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe
  "C:\Users\Admin\AppData\Local\Temp\cec54379d0c951fbe85b7f678bc3faab29bd9643375825d105a568ba2890abbf.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1444
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1444-130-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1444-131-0x0000000000400000-0x00000000005C8000-memory.dmp

Filesize
1.8MB

Download
memory/3676-133-0x00000000003C0000-0x00000000003ED000-memory.dmp

Filesize
180KB

Download
memory/3676-134-0x00000000003C0000-0x00000000003ED000-memory.dmp

Filesize
180KB

Download