zloader | 21f41071eb31d4b4f2fb1e5d9be035014b1302313804e46077ca23da0dd30bc8

Resubmissions

19-07-2023 11:14

230719-nb99yscg87 10

19-07-2020 19:33

200719-m964m1njqe 10

Analysis

max time kernel
128s
max time network
260s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2023 11:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

zloader 2_1.0.13.0.exe
Size

154KB
MD5

07e6b50724981e0c96f7d23f48d309b5
SHA1

0c012857690e0eebf10eb0ccafcbad9434f99d91
SHA256

21f41071eb31d4b4f2fb1e5d9be035014b1302313804e46077ca23da0dd30bc8
SHA512

e930617c54fee9fbc9cfb37d6a014e808556f55306d50e2b83c81ef9478772ff4be4e86d55f03879ab5d0cba6a796268dbfb9ac06b2350502bbf56286dc83102
SSDEEP

3072:NOgSKE2Om5C3nAnpedwh6cXtoqnDqQ8CrE6mA3b77BJDg:MgSKEhmcQnpSwh6cu0T8CY6mA3/7X

Score

10^/10

zloader vlenie2020 obnova20 botnet persistence trojan

Malware Config

Extracted

Family

zloader

Botnet

vlenie2020

Campaign

obnova20

https://dasifosafjasfhasf.com/gate.php

https://kasfajfsafhasfhaf.com/gate.php

https://fdsjfjdsfjdsjfdjsfh.com/gate.php

https://fdsjfjdsfjdsdsjajjs.com/gate.php

https://idisaudhasdhasdj.com/gate.php

https://dsjdjsjdsadhasdas.com/gate.php

https://dsdjfhdsufudhjas.com/gate.php

Attributes

build_id
1869505135

rc4.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Blocklisted process makes network request 4 IoCs

flow	pid	Process
71	404	msiexec.exe
73	404	msiexec.exe
77	404	msiexec.exe
80	404	msiexec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Windows\CurrentVersion\Run	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bidohu = "C:\\Users\\Admin\\AppData\\Roaming\\Ahbyfu\\ufufohby.exe"	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1828 set thread context of 404	1828	zloader 2_1.0.13.0.exe	101

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	404	msiexec.exe
Token: SeSecurityPrivilege	404	msiexec.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 404	1828	zloader 2_1.0.13.0.exe	101
PID 1828 wrote to memory of 404	1828	zloader 2_1.0.13.0.exe	101
PID 1828 wrote to memory of 404	1828	zloader 2_1.0.13.0.exe	101
PID 1828 wrote to memory of 404	1828	zloader 2_1.0.13.0.exe	101
PID 1828 wrote to memory of 404	1828	zloader 2_1.0.13.0.exe	101

C:\Users\Admin\AppData\Local\Temp\zloader 2_1.0.13.0.exe
"C:\Users\Admin\AppData\Local\Temp\zloader 2_1.0.13.0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe
  2⤵
  - Blocklisted process makes network request
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:404

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/404-144-0x0000000000490000-0x00000000004B5000-memory.dmp

Filesize
148KB

Download
memory/404-150-0x0000000000490000-0x00000000004B5000-memory.dmp

Filesize
148KB

Download
memory/404-149-0x0000000000490000-0x00000000004B5000-memory.dmp

Filesize
148KB

Download
memory/404-148-0x0000000000490000-0x00000000004B5000-memory.dmp

Filesize
148KB

Download
memory/404-146-0x0000000000490000-0x00000000004B5000-memory.dmp

Filesize
148KB

Download
memory/1828-141-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1828-139-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1828-140-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1828-133-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1828-142-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1828-143-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1828-138-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1828-145-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1828-137-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/1828-134-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/1828-136-0x0000000000890000-0x0000000000891000-memory.dmp

Filesize
4KB

Download
memory/1828-135-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download