zloader | 903c3b246b516395e8aaca0c647d496005d9d6609107f7f67a061b5390608010

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
01-06-2024 11:05

Target

8a46f0c4be8a91b533142a112618a885_JaffaCakes118.dll
Size

448KB
MD5

8a46f0c4be8a91b533142a112618a885
SHA1

32a765a9a32ec7065087b172607e0f9a8119fc20
SHA256

903c3b246b516395e8aaca0c647d496005d9d6609107f7f67a061b5390608010
SHA512

54a9c56d0b18779fc6d7c54f5b01bdf8cb2d830f7b035de2817950b90c1f363f1ad0a6a46db66fc0470c0e7b5c221d35cbe69752afbfb56560caaa42f06e7e5e
SSDEEP

6144:BQ1QeQc5RzXzT6eSWDCSsMcW7QN1ZlFdaAMy+mBcv7uuHhPUStrRS:BQ1pQYRzXy1WDCQcW8fZlF7MWWuuH9a

Score

10^/10

Family

zloader

Botnet

bat1k3

Campaign

bat1k3

http://ad123234234.in/LKhwojehDgwegSDG/gateJKjdsh.php

http://ad123234234.info/LKhwojehDgwegSDG/gateJKjdsh.php

http://ad123234234.net/LKhwojehDgwegSDG/gateJKjdsh.php

http://ad123234234.org/LKhwojehDgwegSDG/gateJKjdsh.php

http://ad123234234.xyz/LKhwojehDgwegSDG/gateJKjdsh.php

Attributes

rc4.plain

rsa_pubkey.plain

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2144 created 1240	2144	regsvr32.exe	21

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2144 set thread context of 2740	2144	regsvr32.exe	29

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2144	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 2144	844	regsvr32.exe	28
PID 844 wrote to memory of 2144	844	regsvr32.exe	28
PID 844 wrote to memory of 2144	844	regsvr32.exe	28
PID 844 wrote to memory of 2144	844	regsvr32.exe	28
PID 844 wrote to memory of 2144	844	regsvr32.exe	28
PID 844 wrote to memory of 2144	844	regsvr32.exe	28
PID 844 wrote to memory of 2144	844	regsvr32.exe	28
PID 2144 wrote to memory of 2740	2144	regsvr32.exe	29
PID 2144 wrote to memory of 2740	2144	regsvr32.exe	29
PID 2144 wrote to memory of 2740	2144	regsvr32.exe	29
PID 2144 wrote to memory of 2740	2144	regsvr32.exe	29
PID 2144 wrote to memory of 2740	2144	regsvr32.exe	29
PID 2144 wrote to memory of 2740	2144	regsvr32.exe	29
PID 2144 wrote to memory of 2740	2144	regsvr32.exe	29
PID 2144 wrote to memory of 2740	2144	regsvr32.exe	29
PID 2144 wrote to memory of 2740	2144	regsvr32.exe	29

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1240
- C:\Windows\system32\regsvr32.exe
  regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8a46f0c4be8a91b533142a112618a885_JaffaCakes118.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:844
- - C:\Windows\SysWOW64\regsvr32.exe
    /s C:\Users\Admin\AppData\Local\Temp\8a46f0c4be8a91b533142a112618a885_JaffaCakes118.dll
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2144
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2740

memory/2144-0-0x00000000748C0000-0x0000000074940000-memory.dmp

Filesize
512KB

Download
memory/2144-1-0x0000000074930000-0x0000000074933000-memory.dmp

Filesize
12KB

Download
memory/2144-2-0x00000000748C0000-0x0000000074940000-memory.dmp

Filesize
512KB

Download
memory/2144-10-0x00000000748C0000-0x0000000074940000-memory.dmp

Filesize
512KB

Download
memory/2740-8-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2740-6-0x00000000000D0000-0x00000000000FD000-memory.dmp

Filesize
180KB

Download
memory/2740-9-0x00000000000D0000-0x00000000000FD000-memory.dmp

Filesize
180KB

Download
memory/2740-11-0x00000000000D0000-0x00000000000FD000-memory.dmp

Filesize
180KB

Download
memory/2740-14-0x00000000000D0000-0x00000000000FD000-memory.dmp

Filesize
180KB

Download
memory/2740-13-0x00000000000D0000-0x00000000000FD000-memory.dmp

Filesize
180KB

Download
memory/2740-16-0x00000000000D0000-0x00000000000FD000-memory.dmp

Filesize
180KB

Download