zloader | 6fee95a3e283d9ad09a399e99b086ef70c3679eb8ad548161bdfababe3da68fb

Resubmissions

18-05-2024 14:39

240518-r1dttsgc3s 6

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-05-2024 22:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d68507752275a8607502b0ae14ef9a1_JaffaCakes118.exe
Size

268KB
MD5

4d68507752275a8607502b0ae14ef9a1
SHA1

4e13b8267ca39e41b9dbf88dc3123fed37e409c0
SHA256

6fee95a3e283d9ad09a399e99b086ef70c3679eb8ad548161bdfababe3da68fb
SHA512

bbebbd027af9e953141efecbfde31137735d58e54ff26966475570c7414ddc03ee53636011fad404d60c8df0031a79d5f2b858819ded59428ead93a5d9732849
SSDEEP

6144:dI4M7nO35HbqtMFurLa8BqUlv8TqE4TvLOJ5tEpo6LlE7:aj6qsE8UVk4TotEpNLlE

Score

10^/10

zloader saca adw2 botnet persistence trojan

Malware Config

Extracted

Family

zloader

Botnet

saca

Campaign

adw2

https://thoughtlibrary.top/library/topikpost.php

https://islacangrejo.fun/library/topikpost.php

Attributes

build_id
1970759022

rc4.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Icobcey = "C:\\Users\\Admin\\AppData\\Roaming\\Ygoda\\fedu.exe"	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

4d68507752275a8607502b0ae14ef9a1_JaffaCakes118.exe

description pid process target process

PID 2888 set thread context of 2568 2888 4d68507752275a8607502b0ae14ef9a1_JaffaCakes118.exe msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeSecurityPrivilege 2568 msiexec.exe
Token: SeSecurityPrivilege 2568 msiexec.exe

description	pid	process	target process
PID 2888 set thread context of 2568	2888	4d68507752275a8607502b0ae14ef9a1_JaffaCakes118.exe	msiexec.exe

description	pid	process
Token: SeSecurityPrivilege	2568	msiexec.exe
Token: SeSecurityPrivilege	2568	msiexec.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

4d68507752275a8607502b0ae14ef9a1_JaffaCakes118.exe

description	pid	process	target process
PID 2888 wrote to memory of 2568	2888	4d68507752275a8607502b0ae14ef9a1_JaffaCakes118.exe	msiexec.exe
PID 2888 wrote to memory of 2568	2888	4d68507752275a8607502b0ae14ef9a1_JaffaCakes118.exe	msiexec.exe
PID 2888 wrote to memory of 2568	2888	4d68507752275a8607502b0ae14ef9a1_JaffaCakes118.exe	msiexec.exe
PID 2888 wrote to memory of 2568	2888	4d68507752275a8607502b0ae14ef9a1_JaffaCakes118.exe	msiexec.exe
PID 2888 wrote to memory of 2568	2888	4d68507752275a8607502b0ae14ef9a1_JaffaCakes118.exe	msiexec.exe
PID 2888 wrote to memory of 2568	2888	4d68507752275a8607502b0ae14ef9a1_JaffaCakes118.exe	msiexec.exe
PID 2888 wrote to memory of 2568	2888	4d68507752275a8607502b0ae14ef9a1_JaffaCakes118.exe	msiexec.exe
PID 2888 wrote to memory of 2568	2888	4d68507752275a8607502b0ae14ef9a1_JaffaCakes118.exe	msiexec.exe
PID 2888 wrote to memory of 2568	2888	4d68507752275a8607502b0ae14ef9a1_JaffaCakes118.exe	msiexec.exe

C:\Users\Admin\AppData\Local\Temp\4d68507752275a8607502b0ae14ef9a1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4d68507752275a8607502b0ae14ef9a1_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2888

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
2⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:2568

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2568-2-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/2568-4-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/2568-6-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/2568-7-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/2568-9-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/2888-0-0x00000000013F0000-0x00000000013F1000-memory.dmp

Filesize
4KB

Download
memory/2888-1-0x00000000013D0000-0x0000000001416000-memory.dmp

Filesize
280KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads