zloader | f1bdd2bcbaf40bb99224fa293edc1581fd124da63c035657918877901d79bed8

Analysis

max time kernel
504s
max time network
507s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/10/2022, 06:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f1bdd2bcbaf40bb99224fa293edc1581fd124da63c035657918877901d79bed8.dll
Size 338KB
Sample221027-hcnjpabchk
SHA256 f1bdd2bcbaf40bb99224fa293edc1581fd124da63c035657918877901d79bed8
MD5 62d565051f3cae6d6bc8971420bec819
SHA1 b6c0f532108a3b392e9d8c1b0cfbf85cf8aa8fb3
SHA512 c1401aeb4788ff39a501529ab3cd55223570404657be98c137326d76f7a23e5bf6dbb1faefd609519819c509ffcfd4d47f06c09afacad460485fbda9eb87d9ff
SSDEEP 6144:d8ARSuigJ6mbVNjIECSQX3U0PflxxB7HDZnU7d:CARSacgjIV5Hl5jZMd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

zloader botnet persistence trojan

Malware Config

Extracted

Family

zloader

Attributes

build_id
49

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idduhoog = "rundll32.exe C:\\Users\\Admin\\AppData\\Roaming\\Ybdiyb\\yhhaogu.dll,DllRegisterServer"	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1972 set thread context of 5108	1972	rundll32.exe	93

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	5108	msiexec.exe
Token: SeSecurityPrivilege	5108	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 1972	1900	rundll32.exe	82
PID 1900 wrote to memory of 1972	1900	rundll32.exe	82
PID 1900 wrote to memory of 1972	1900	rundll32.exe	82
PID 1972 wrote to memory of 5108	1972	rundll32.exe	93
PID 1972 wrote to memory of 5108	1972	rundll32.exe	93
PID 1972 wrote to memory of 5108	1972	rundll32.exe	93
PID 1972 wrote to memory of 5108	1972	rundll32.exe	93
PID 1972 wrote to memory of 5108	1972	rundll32.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f1bdd2bcbaf40bb99224fa293edc1581fd124da63c035657918877901d79bed8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f1bdd2bcbaf40bb99224fa293edc1581fd124da63c035657918877901d79bed8.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec.exe
    3⤵
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    PID:5108

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1972-133-0x0000000074090000-0x00000000740B9000-memory.dmp

Download

memory/1972-134-0x0000000074090000-0x00000000749EE000-memory.dmp

Download

memory/1972-135-0x0000000074090000-0x00000000749EE000-memory.dmp

Download

memory/1972-136-0x0000000074090000-0x00000000749EE000-memory.dmp

Download

memory/1972-139-0x0000000074090000-0x00000000749EE000-memory.dmp

Download

memory/5108-138-0x00000000007A0000-0x00000000007C9000-memory.dmp

Download

memory/5108-140-0x00000000007A0000-0x00000000007C9000-memory.dmp

Download

memory/5108-141-0x00000000007A0000-0x00000000007C9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads