zloader | 21f41071eb31d4b4f2fb1e5d9be035014b1302313804e46077ca23da0dd30bc8

Resubmissions

19-07-2023 11:14

230719-nb99yscg87 10

19-07-2020 19:33

200719-m964m1njqe 10

Analysis

max time kernel
299s
max time network
170s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
19-07-2023 11:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

zloader 2_1.0.13.0.exe
Size

154KB
MD5

07e6b50724981e0c96f7d23f48d309b5
SHA1

0c012857690e0eebf10eb0ccafcbad9434f99d91
SHA256

21f41071eb31d4b4f2fb1e5d9be035014b1302313804e46077ca23da0dd30bc8
SHA512

e930617c54fee9fbc9cfb37d6a014e808556f55306d50e2b83c81ef9478772ff4be4e86d55f03879ab5d0cba6a796268dbfb9ac06b2350502bbf56286dc83102
SSDEEP

3072:NOgSKE2Om5C3nAnpedwh6cXtoqnDqQ8CrE6mA3b77BJDg:MgSKEhmcQnpSwh6cu0T8CY6mA3/7X

Score

10^/10

zloader vlenie2020 obnova20 botnet persistence trojan

Malware Config

Extracted

Family

zloader

Botnet

vlenie2020

Campaign

obnova20

https://dasifosafjasfhasf.com/gate.php

https://kasfajfsafhasfhaf.com/gate.php

https://fdsjfjdsfjdsjfdjsfh.com/gate.php

https://fdsjfjdsfjdsdsjajjs.com/gate.php

https://idisaudhasdhasdj.com/gate.php

https://dsjdjsjdsadhasdas.com/gate.php

https://dsdjfhdsufudhjas.com/gate.php

Attributes

build_id
1869505135

rc4.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Blocklisted process makes network request 6 IoCs

flow	pid	Process
11	2924	msiexec.exe
13	2924	msiexec.exe
15	2924	msiexec.exe
17	2924	msiexec.exe
19	2924	msiexec.exe
21	2924	msiexec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Windows\CurrentVersion\Run	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Windows\CurrentVersion\Run\Egyb = "C:\\Users\\Admin\\AppData\\Roaming\\Iduf\\yfcufad.exe"	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1964 set thread context of 2924	1964	zloader 2_1.0.13.0.exe	30

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2924	msiexec.exe
Token: SeSecurityPrivilege	2924	msiexec.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2924	1964	zloader 2_1.0.13.0.exe	30
PID 1964 wrote to memory of 2924	1964	zloader 2_1.0.13.0.exe	30
PID 1964 wrote to memory of 2924	1964	zloader 2_1.0.13.0.exe	30
PID 1964 wrote to memory of 2924	1964	zloader 2_1.0.13.0.exe	30
PID 1964 wrote to memory of 2924	1964	zloader 2_1.0.13.0.exe	30
PID 1964 wrote to memory of 2924	1964	zloader 2_1.0.13.0.exe	30
PID 1964 wrote to memory of 2924	1964	zloader 2_1.0.13.0.exe	30
PID 1964 wrote to memory of 2924	1964	zloader 2_1.0.13.0.exe	30
PID 1964 wrote to memory of 2924	1964	zloader 2_1.0.13.0.exe	30

C:\Users\Admin\AppData\Local\Temp\zloader 2_1.0.13.0.exe
"C:\Users\Admin\AppData\Local\Temp\zloader 2_1.0.13.0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe
  2⤵
  - Blocklisted process makes network request
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:2924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75cfbbfb2d1900f5a8a41eb4d2f32f45

SHA1
50a81568d92e4997028db36d7fa7436d74cb16d3

SHA256
8dfe12cc0049bfb299e74a8ce97ba78cc361ac6a57490d774fc54ef3076198ab

SHA512
6a926071a66ebbd7f859525cb43da4efa9be261ca287274c4cb6aaf9c283fb57863099000b2c6dcc0566c3bbfc71a24132f78e57ef9382d2f1122c1efbd9cc46

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2A2.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar572.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
memory/1964-62-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1964-67-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1964-59-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1964-60-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1964-61-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1964-54-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1964-63-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1964-56-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1964-55-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1964-57-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1964-58-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2924-69-0x00000000000F0000-0x0000000000115000-memory.dmp

Filesize
148KB

Download
memory/2924-70-0x00000000000F0000-0x0000000000115000-memory.dmp

Filesize
148KB

Download
memory/2924-66-0x00000000000F0000-0x0000000000115000-memory.dmp

Filesize
148KB

Download
memory/2924-65-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/2924-64-0x00000000000F0000-0x0000000000115000-memory.dmp

Filesize
148KB

Download