zloader | f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949

General

Target

f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe
Size

364KB
MD5

237dcba926f68d809230a71529172e4c
SHA1

350ef285178655aa95e49b51957ec14d9e36ba78
SHA256

f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949
SHA512

8dd34cf5c04c8d2de31338da1abed2dbb0474f99198330fbe69a5a0f37a3027ccf70ea4d9647447477d1a1d446dfc621ab834b95117b8bcd67ed1cf18f047b30

Score

10^/10

zloader raz raz botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

Raz

Campaign

Raz

C2

http://softwareserviceupdater5.com/web/post.php

Attributes

build_id
35

rc4.plain

rsa_pubkey.plain

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe

description pid process target process

PID 1956 created 1204 1956 f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe Explorer.EXE
Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

description	pid	process	target process
PID 1956 created 1204	1956	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe	Explorer.EXE

Suspicious use of SetThreadContext 2 IoCs

Processes:

f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exef32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe

description	pid	process	target process
PID 948 set thread context of 1956	948	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe
PID 1956 set thread context of 600	1956	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe	msiexec.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

Processes:

f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exef32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe

pid	process
948	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe
948	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe
948	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe
948	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe
948	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe
948	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe
948	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe
948	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe
948	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe
948	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe
948	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe
948	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe
948	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe
948	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe
948	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe
948	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe
948	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe
948	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe
948	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe
948	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe
948	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe
948	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe
1956	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exef32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe

description	pid	process
Token: SeDebugPrivilege	948	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe
Token: SeDebugPrivilege	1956	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exef32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe

description	pid	process	target process
PID 948 wrote to memory of 1956	948	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe
PID 948 wrote to memory of 1956	948	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe
PID 948 wrote to memory of 1956	948	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe
PID 948 wrote to memory of 1956	948	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe
PID 948 wrote to memory of 1956	948	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe
PID 948 wrote to memory of 1956	948	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe
PID 948 wrote to memory of 1956	948	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe
PID 948 wrote to memory of 1956	948	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe
PID 948 wrote to memory of 1956	948	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe
PID 948 wrote to memory of 1956	948	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe
PID 1956 wrote to memory of 600	1956	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe	msiexec.exe
PID 1956 wrote to memory of 600	1956	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe	msiexec.exe
PID 1956 wrote to memory of 600	1956	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe	msiexec.exe
PID 1956 wrote to memory of 600	1956	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe	msiexec.exe
PID 1956 wrote to memory of 600	1956	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe	msiexec.exe
PID 1956 wrote to memory of 600	1956	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe	msiexec.exe
PID 1956 wrote to memory of 600	1956	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe	msiexec.exe
PID 1956 wrote to memory of 600	1956	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe	msiexec.exe
PID 1956 wrote to memory of 600	1956	f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe	msiexec.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1204

C:\Users\Admin\AppData\Local\Temp\f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe
"C:\Users\Admin\AppData\Local\Temp\f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:948

C:\Users\Admin\AppData\Local\Temp\f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe
"C:\Users\Admin\AppData\Local\Temp\f32f0d0bb54491c4c51a1ac17e62ede428373bb0130acaf6ac544c5b7b83e949.exe"
3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1956

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
2⤵
PID:600

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/600-74-0x0000000000090000-0x00000000000BD000-memory.dmp

Filesize
180KB

Download
memory/600-72-0x0000000000000000-mapping.dmp

Download
memory/600-71-0x0000000000090000-0x00000000000BD000-memory.dmp

Filesize
180KB

Download
memory/948-54-0x0000000000E40000-0x0000000000EA2000-memory.dmp

Filesize
392KB

Download
memory/948-55-0x0000000074F21000-0x0000000074F23000-memory.dmp

Filesize
8KB

Download
memory/948-56-0x0000000000680000-0x00000000006CA000-memory.dmp

Filesize
296KB

Download
memory/1956-62-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1956-63-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1956-65-0x0000000000404DD0-mapping.dmp

Download
memory/1956-64-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1956-68-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1956-60-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1956-58-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1956-57-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads