zloader | 19614f57ed86b1305c8e00443ee49f751a62b19df9f1a72f326d939b0fd69e66

Analysis

max time kernel
1158s
max time network
1164s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
08/12/2023, 11:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
batman1.exe
Size 323KB
Sample231208-m8mdqaba46
SHA256 a947c216ea52ce23457b3babb1e1eb6275cabe2150d3995553e4de4b8c3d97f4
MD5 afdf2fbc0756ed304d1a33083a5f2b0f
SHA1 f3a25627f925390097a64a84ef34c952fe8af036
SHA512 1c49e53b21c6cebc7a070667aaf05bc89e1a434270208fb61e54c8d74b8f4f3c70c021567d65e1ae024b16bdddb6f89989434075b9a422f2582d82c861b6ccf1
SSDEEP 6144:vG9T0nIO6C3XwbT5QOIJSeEY7EkvBeC1G:HIO6TTeO8Sw7Ekv8C
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

zloader telegramcrypt antiamsidoc botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

TelegramCrypt

Campaign

AntiAMSIdoc

http://wmwifbajxxbcxmucxmlc.com/post.php
http://pwkqhdgytsshkoibaake.com/post.php
http://snnmnkxdhflwgthqismb.com/post.php
http://iawfqecrwohcxnhwtofa.com/post.php
http://nlbmfsyplohyaicmxhum.com/post.php
http://fvqlkgedqjiqgapudkgq.com/post.php
http://cmmxhurildiigqghlryq.com/post.php
http://nmqsmbiabjdnuushksas.com/post.php
http://fyratyubvflktyyjiqgq.com/post.php

Attributes

build_id
115

rc4.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 632 set thread context of 2492	632	batman1.exe	105

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1272	632	WerFault.exe	19

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2492	msiexec.exe
Token: SeSecurityPrivilege	2492	msiexec.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 2492	632	batman1.exe	105
PID 632 wrote to memory of 2492	632	batman1.exe	105
PID 632 wrote to memory of 2492	632	batman1.exe	105
PID 632 wrote to memory of 2492	632	batman1.exe	105
PID 632 wrote to memory of 2492	632	batman1.exe	105

C:\Users\Admin\AppData\Local\Temp\batman1.exe
"C:\Users\Admin\AppData\Local\Temp\batman1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:632
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 632 -s 476
  2⤵
  - Program crash
  PID:1272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 632 -ip 632
1⤵
PID:4616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/632-1-0x0000000000650000-0x0000000000750000-memory.dmp

Download

memory/632-2-0x00000000005D0000-0x00000000005FF000-memory.dmp

Download

memory/632-3-0x0000000000400000-0x0000000000500000-memory.dmp

Download

memory/632-6-0x0000000000650000-0x0000000000750000-memory.dmp

Download

memory/632-7-0x00000000005D0000-0x00000000005FF000-memory.dmp

Download

memory/632-13-0x0000000000400000-0x0000000000500000-memory.dmp

Download

memory/2492-12-0x0000000000530000-0x0000000000564000-memory.dmp

Download

memory/2492-15-0x0000000000530000-0x0000000000564000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads