zloader | 903c3b246b516395e8aaca0c647d496005d9d6609107f7f67a061b5390608010

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 11:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8a46f0c4be8a91b533142a112618a885_JaffaCakes118.dll
Size 448KB
Sample240601-m7bktsbe95
SHA256 903c3b246b516395e8aaca0c647d496005d9d6609107f7f67a061b5390608010
MD5 8a46f0c4be8a91b533142a112618a885
SHA1 32a765a9a32ec7065087b172607e0f9a8119fc20
SHA512 54a9c56d0b18779fc6d7c54f5b01bdf8cb2d830f7b035de2817950b90c1f363f1ad0a6a46db66fc0470c0e7b5c221d35cbe69752afbfb56560caaa42f06e7e5e
SSDEEP 6144:BQ1QeQc5RzXzT6eSWDCSsMcW7QN1ZlFdaAMy+mBcv7uuHhPUStrRS:BQ1pQYRzXy1WDCQcW8fZlF7MWWuuH9a
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

zloader bat1k3 bat1k3 botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

bat1k3

Campaign

bat1k3

http://ad123234234.in/LKhwojehDgwegSDG/gateJKjdsh.php
http://ad123234234.info/LKhwojehDgwegSDG/gateJKjdsh.php
http://ad123234234.net/LKhwojehDgwegSDG/gateJKjdsh.php
http://ad123234234.org/LKhwojehDgwegSDG/gateJKjdsh.php
http://ad123234234.xyz/LKhwojehDgwegSDG/gateJKjdsh.php

Attributes

build_id
29

rc4.plain

rsa_pubkey.plain

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4748 created 3188	4748	regsvr32.exe	57

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4748 set thread context of 2524	4748	regsvr32.exe	100

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4748	regsvr32.exe
4748	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4748	regsvr32.exe
Token: SeSecurityPrivilege	2524	msiexec.exe
Token: SeSecurityPrivilege	2524	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 4748	4848	regsvr32.exe	90
PID 4848 wrote to memory of 4748	4848	regsvr32.exe	90
PID 4848 wrote to memory of 4748	4848	regsvr32.exe	90
PID 4748 wrote to memory of 2524	4748	regsvr32.exe	100
PID 4748 wrote to memory of 2524	4748	regsvr32.exe	100
PID 4748 wrote to memory of 2524	4748	regsvr32.exe	100
PID 4748 wrote to memory of 2524	4748	regsvr32.exe	100
PID 4748 wrote to memory of 2524	4748	regsvr32.exe	100

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3188
- C:\Windows\system32\regsvr32.exe
  regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8a46f0c4be8a91b533142a112618a885_JaffaCakes118.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4848
- - C:\Windows\SysWOW64\regsvr32.exe
    /s C:\Users\Admin\AppData\Local\Temp\8a46f0c4be8a91b533142a112618a885_JaffaCakes118.dll
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4748
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:1444

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2524-11-0x0000000001250000-0x000000000127D000-memory.dmp

Download

memory/2524-16-0x0000000001250000-0x000000000127D000-memory.dmp

Download

memory/2524-15-0x0000000001250000-0x000000000127D000-memory.dmp

Download

memory/4748-1-0x00000000750F0000-0x00000000750F3000-memory.dmp

Download

memory/4748-0-0x0000000075080000-0x0000000075100000-memory.dmp

Download

memory/4748-2-0x0000000075080000-0x0000000075100000-memory.dmp

Download

memory/4748-13-0x0000000075080000-0x0000000075100000-memory.dmp

Download