zloader | 19614f57ed86b1305c8e00443ee49f751a62b19df9f1a72f326d939b0fd69e66

Resubmissions

08-12-2023 11:08

231208-m8mdqaba46 10

01-11-2020 09:14

201101-da931xqx5x 10

01-11-2020 08:59

201101-jwsyvmsbls 10

Analysis

max time kernel
1158s
max time network
1164s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
08-12-2023 11:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

batman1.exe
Size

323KB
MD5

afdf2fbc0756ed304d1a33083a5f2b0f
SHA1

f3a25627f925390097a64a84ef34c952fe8af036
SHA256

a947c216ea52ce23457b3babb1e1eb6275cabe2150d3995553e4de4b8c3d97f4
SHA512

1c49e53b21c6cebc7a070667aaf05bc89e1a434270208fb61e54c8d74b8f4f3c70c021567d65e1ae024b16bdddb6f89989434075b9a422f2582d82c861b6ccf1
SSDEEP

6144:vG9T0nIO6C3XwbT5QOIJSeEY7EkvBeC1G:HIO6TTeO8Sw7Ekv8C

Score

10^/10

zloader telegramcrypt antiamsidoc botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

TelegramCrypt

Campaign

AntiAMSIdoc

http://wmwifbajxxbcxmucxmlc.com/post.php

http://pwkqhdgytsshkoibaake.com/post.php

http://snnmnkxdhflwgthqismb.com/post.php

http://iawfqecrwohcxnhwtofa.com/post.php

http://nlbmfsyplohyaicmxhum.com/post.php

http://fvqlkgedqjiqgapudkgq.com/post.php

http://cmmxhurildiigqghlryq.com/post.php

http://nmqsmbiabjdnuushksas.com/post.php

http://fyratyubvflktyyjiqgq.com/post.php

Attributes

build_id
115

rc4.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 632 set thread context of 2492	632	batman1.exe	105

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1272	632	WerFault.exe	19

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2492	msiexec.exe
Token: SeSecurityPrivilege	2492	msiexec.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 2492	632	batman1.exe	105
PID 632 wrote to memory of 2492	632	batman1.exe	105
PID 632 wrote to memory of 2492	632	batman1.exe	105
PID 632 wrote to memory of 2492	632	batman1.exe	105
PID 632 wrote to memory of 2492	632	batman1.exe	105

C:\Users\Admin\AppData\Local\Temp\batman1.exe
"C:\Users\Admin\AppData\Local\Temp\batman1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:632
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 632 -s 476
  2⤵
  - Program crash
  PID:1272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 632 -ip 632
1⤵
PID:4616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/632-1-0x0000000000650000-0x0000000000750000-memory.dmp

Filesize
1024KB

Download
memory/632-2-0x00000000005D0000-0x00000000005FF000-memory.dmp

Filesize
188KB

Download
memory/632-3-0x0000000000400000-0x0000000000500000-memory.dmp

Filesize
1024KB

Download
memory/632-6-0x0000000000650000-0x0000000000750000-memory.dmp

Filesize
1024KB

Download
memory/632-7-0x00000000005D0000-0x00000000005FF000-memory.dmp

Filesize
188KB

Download
memory/632-13-0x0000000000400000-0x0000000000500000-memory.dmp

Filesize
1024KB

Download
memory/2492-12-0x0000000000530000-0x0000000000564000-memory.dmp

Filesize
208KB

Download
memory/2492-15-0x0000000000530000-0x0000000000564000-memory.dmp

Filesize
208KB

Download