zloader | 023f1ef0cc2c1e055b05ae1ff5bcc6bf2421003dea227aeb6d70c8a525fa3b82

General

Target

023f1ef0cc2c1e055b05ae1ff5bcc6bf2421003dea227aeb6d70c8a525fa3b82.exe
Size

2.6MB
MD5

fb95561e8ed7289d015e945ad470e6db
SHA1

03573bc869701cffd7c96e223633d46b0a23823a
SHA256

023f1ef0cc2c1e055b05ae1ff5bcc6bf2421003dea227aeb6d70c8a525fa3b82
SHA512

2a0bf4048c1a9eca9e13566b1512403b51462c8eb71cfb273225fbc221aa156a3d3eb571fa5328ff2f4e2ef7026b3e8847f0c0a739d8f989ba716efa411821a6
SSDEEP

6144:sTlCgffOYPE99pqcLE9zn0HJGsfb7cwhl7e/:sJfWP9p1Lgzmbgye/

Score

10^/10

zloader pref fpref botnet persistence trojan

Malware Config

Extracted

Family

zloader

Botnet

pref

Campaign

fpref

C2

http://penaz.info/gate.php

http:// advokat-hodonin.info/gate.php

Attributes

build_id
7

rc4.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Zyxiykxe = "C:\\Users\\Admin\\AppData\\Roaming\\Qemuun\\yzheri.exe"	msiexec.exe

Blocklisted process makes network request 47 IoCs

Processes:

msiexec.exe

flow	pid	process
462	4336	msiexec.exe
463	4336	msiexec.exe
465	4336	msiexec.exe
467	4336	msiexec.exe
471	4336	msiexec.exe
472	4336	msiexec.exe
473	4336	msiexec.exe
475	4336	msiexec.exe
476	4336	msiexec.exe
477	4336	msiexec.exe
478	4336	msiexec.exe
479	4336	msiexec.exe
480	4336	msiexec.exe
481	4336	msiexec.exe
482	4336	msiexec.exe
487	4336	msiexec.exe
488	4336	msiexec.exe
489	4336	msiexec.exe
490	4336	msiexec.exe
491	4336	msiexec.exe
492	4336	msiexec.exe
493	4336	msiexec.exe
494	4336	msiexec.exe
495	4336	msiexec.exe
496	4336	msiexec.exe
497	4336	msiexec.exe
498	4336	msiexec.exe
502	4336	msiexec.exe
503	4336	msiexec.exe
504	4336	msiexec.exe
505	4336	msiexec.exe
506	4336	msiexec.exe
507	4336	msiexec.exe
508	4336	msiexec.exe
509	4336	msiexec.exe
510	4336	msiexec.exe
511	4336	msiexec.exe
512	4336	msiexec.exe
513	4336	msiexec.exe
521	4336	msiexec.exe
522	4336	msiexec.exe
524	4336	msiexec.exe
525	4336	msiexec.exe
526	4336	msiexec.exe
527	4336	msiexec.exe
529	4336	msiexec.exe
531	4336	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

023f1ef0cc2c1e055b05ae1ff5bcc6bf2421003dea227aeb6d70c8a525fa3b82.exe

description	pid	process	target process
PID 864 set thread context of 4336	864	023f1ef0cc2c1e055b05ae1ff5bcc6bf2421003dea227aeb6d70c8a525fa3b82.exe	msiexec.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

msiexec.exesvchost.exe

description pid process

Token: SeSecurityPrivilege 4336 msiexec.exe
Token: SeSecurityPrivilege 4336 msiexec.exe
Token: SeManageVolumePrivilege 1656 svchost.exe

description	pid	process
Token: SeSecurityPrivilege	4336	msiexec.exe
Token: SeSecurityPrivilege	4336	msiexec.exe
Token: SeManageVolumePrivilege	1656	svchost.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

023f1ef0cc2c1e055b05ae1ff5bcc6bf2421003dea227aeb6d70c8a525fa3b82.exe

description	pid	process	target process
PID 864 wrote to memory of 4336	864	023f1ef0cc2c1e055b05ae1ff5bcc6bf2421003dea227aeb6d70c8a525fa3b82.exe	msiexec.exe
PID 864 wrote to memory of 4336	864	023f1ef0cc2c1e055b05ae1ff5bcc6bf2421003dea227aeb6d70c8a525fa3b82.exe	msiexec.exe
PID 864 wrote to memory of 4336	864	023f1ef0cc2c1e055b05ae1ff5bcc6bf2421003dea227aeb6d70c8a525fa3b82.exe	msiexec.exe
PID 864 wrote to memory of 4336	864	023f1ef0cc2c1e055b05ae1ff5bcc6bf2421003dea227aeb6d70c8a525fa3b82.exe	msiexec.exe
PID 864 wrote to memory of 4336	864	023f1ef0cc2c1e055b05ae1ff5bcc6bf2421003dea227aeb6d70c8a525fa3b82.exe	msiexec.exe

C:\Users\Admin\AppData\Local\Temp\023f1ef0cc2c1e055b05ae1ff5bcc6bf2421003dea227aeb6d70c8a525fa3b82.exe
"C:\Users\Admin\AppData\Local\Temp\023f1ef0cc2c1e055b05ae1ff5bcc6bf2421003dea227aeb6d70c8a525fa3b82.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:864
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe
  2⤵
  - Adds Run key to start application
  - Blocklisted process makes network request
  - Suspicious use of AdjustPrivilegeToken
  PID:4336

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:2628

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

Filesize
16KB

MD5
c228ca3dafb1bf77b28cc1f095c02d11

SHA1
e50917ef6f7917986b25607e56f07b77bbcb2db4

SHA256
246d8d86cad33ccfac2848b9bbd40d19dd5b4300abefc5c5580b82a27b212d8f

SHA512
4c9cb111bb7e548277f4589dde28915a1fb7c14dd000eefdcbb46f8d28b77870a30c86d65103e9ec6c3ff3ddc4661ecd9522bf7a9b97b31030f8a5359bf5a089

Download Submit
memory/864-0-0x0000000000770000-0x000000000079E000-memory.dmp

Filesize
184KB

Download
memory/864-1-0x0000000000400000-0x000000000069F000-memory.dmp

Filesize
2.6MB

Download
memory/864-5-0x0000000000400000-0x000000000069F000-memory.dmp

Filesize
2.6MB

Download
memory/864-7-0x0000000000400000-0x000000000069F000-memory.dmp

Filesize
2.6MB

Download
memory/1656-48-0x0000028FE7D50000-0x0000028FE7D51000-memory.dmp

Filesize
4KB

Download
memory/1656-52-0x0000028FE7D50000-0x0000028FE7D51000-memory.dmp

Filesize
4KB

Download
memory/1656-11-0x0000028FDF640000-0x0000028FDF650000-memory.dmp

Filesize
64KB

Download
memory/1656-27-0x0000028FDF740000-0x0000028FDF750000-memory.dmp

Filesize
64KB

Download
memory/1656-43-0x0000028FE7D30000-0x0000028FE7D31000-memory.dmp

Filesize
4KB

Download
memory/1656-44-0x0000028FE7D50000-0x0000028FE7D51000-memory.dmp

Filesize
4KB

Download
memory/1656-45-0x0000028FE7D50000-0x0000028FE7D51000-memory.dmp

Filesize
4KB

Download
memory/1656-46-0x0000028FE7D50000-0x0000028FE7D51000-memory.dmp

Filesize
4KB

Download
memory/1656-47-0x0000028FE7D50000-0x0000028FE7D51000-memory.dmp

Filesize
4KB

Download
memory/1656-79-0x0000028FE7BD0000-0x0000028FE7BD1000-memory.dmp

Filesize
4KB

Download
memory/1656-49-0x0000028FE7D50000-0x0000028FE7D51000-memory.dmp

Filesize
4KB

Download
memory/1656-50-0x0000028FE7D50000-0x0000028FE7D51000-memory.dmp

Filesize
4KB

Download
memory/1656-51-0x0000028FE7D50000-0x0000028FE7D51000-memory.dmp

Filesize
4KB

Download
memory/1656-78-0x0000028FE7AC0000-0x0000028FE7AC1000-memory.dmp

Filesize
4KB

Download
memory/1656-53-0x0000028FE7D50000-0x0000028FE7D51000-memory.dmp

Filesize
4KB

Download
memory/1656-54-0x0000028FE7980000-0x0000028FE7981000-memory.dmp

Filesize
4KB

Download
memory/1656-55-0x0000028FE7970000-0x0000028FE7971000-memory.dmp

Filesize
4KB

Download
memory/1656-57-0x0000028FE7980000-0x0000028FE7981000-memory.dmp

Filesize
4KB

Download
memory/1656-60-0x0000028FE7970000-0x0000028FE7971000-memory.dmp

Filesize
4KB

Download
memory/1656-63-0x0000028FE78B0000-0x0000028FE78B1000-memory.dmp

Filesize
4KB

Download
memory/1656-77-0x0000028FE7AC0000-0x0000028FE7AC1000-memory.dmp

Filesize
4KB

Download
memory/1656-75-0x0000028FE7AB0000-0x0000028FE7AB1000-memory.dmp

Filesize
4KB

Download
memory/4336-6-0x0000000000F20000-0x0000000000F52000-memory.dmp

Filesize
200KB

Download
memory/4336-10-0x0000000000F20000-0x0000000000F52000-memory.dmp

Filesize
200KB

Download
memory/4336-8-0x0000000000F20000-0x0000000000F52000-memory.dmp

Filesize
200KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads