zloader | 9d8763451c2bd900dbf10e3cdb16132ec706b8e13dbd563aa15835d5b2d8cc4d | Triage

Sharing

General

Target

Battly-Launcher-Windows1.exe
Size

112.1MB
Sample

240818-n33zyssfrc
MD5

03696da629e834c395f699847326448a
SHA1

3529afa76451ed5beeeb0bb4a31f7cc8bc463aa6
SHA256

9d8763451c2bd900dbf10e3cdb16132ec706b8e13dbd563aa15835d5b2d8cc4d
SHA512

fca0ef778b3ab13cf01e3d39d4c7eb4a587f600ed8d5ab10a03a3061178609dc13a75f6cc736ec27ed9f40a2a554030217cc91a8bf982d42f460585102f1969b
SSDEEP

3145728:SJcuNt6i+X0MdTUPo+YFawtU4odzp7emMT:qcuN7+QYFjmPztemE

Score

10^/10

zloader discovery execution

Malware Config

Targets

- Target
  
  Battly-Launcher-Windows1.exe
- Size
  
  112.1MB
- MD5
  
  03696da629e834c395f699847326448a
- SHA1
  
  3529afa76451ed5beeeb0bb4a31f7cc8bc463aa6
- SHA256
  
  9d8763451c2bd900dbf10e3cdb16132ec706b8e13dbd563aa15835d5b2d8cc4d
- SHA512
  
  fca0ef778b3ab13cf01e3d39d4c7eb4a587f600ed8d5ab10a03a3061178609dc13a75f6cc736ec27ed9f40a2a554030217cc91a8bf982d42f460585102f1969b
- SSDEEP
  
  3145728:SJcuNt6i+X0MdTUPo+YFawtU4odzp7emMT:qcuN7+QYFjmPztemE
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/BgImage.dll
- Size
  
  7KB
- MD5
  
  487368e6fce9ab9c5ea053af0990c5ef
- SHA1
  
  b538e37c87d4b9a7645dcbbd9e93025a31849702
- SHA256
  
  e27efa5dfde875bd6b826fafb4c7698db6b6e30e68715a1c03eb018e3170fc04
- SHA512
  
  bb3ed4c0d17a11365b72653112b48c8c63ab10590dda3dfd90aa453f0d64203000e4571c73998063352240e1671d14da5ee394439899aaa31054fa2e9b722ea7
- SSDEEP
  
  96:8efk1LFJaO1/radJEaYtv1Zs4lkL8y3A2EN8Cmy3uT24j7J3kWyy/:tcTJa2roqJyA2EN8diuTHje
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  100KB
- MD5
  
  c6a6e03f77c313b267498515488c5740
- SHA1
  
  3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA256
  
  b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- SHA512
  
  9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP
  
  3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  
  Battly Launcher.exe
- Size
  
  168.1MB
- MD5
  
  cf0daf7c7befec7beda4e24c7805c05c
- SHA1
  
  bb0644bc24081142c559e930e032720a80e88009
- SHA256
  
  e799120b79693d6467e75a1f3a47696b1c4dba12b66a0efc82d5e5ff779ed8f3
- SHA512
  
  82215a85b35770d9f74519df25569d3afd7d4a865937ddf52a6cbd92f084edd9c98d1b43b18082e5d0af2afc2537ebb76f8c157ba137243b6496fb5e4b3e8521
- SSDEEP
  
  1572864:SQqT4eFUirK1e2zSQ5Rcw/N5cae/bHhrPdacyodvcPSBoHESUlyAzl/:kBKRcAMyAzB
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral10 behavioral9
- Target
  
  LICENSES.chromium.html
- Size
  
  8.7MB
- MD5
  
  bd0ced1bc275f592b03bafac4b301a93
- SHA1
  
  68776b7d9139588c71fbc51fe15243c9835acb67
- SHA256
  
  ad35e72893910d6f6ed20f4916457417af05b94ab5204c435c35f66a058d156b
- SHA512
  
  5052ae32dae0705cc29ea170bcc5210b48e4af91d4ecec380cb4a57ce1c56bc1d834fc2d96e2a0f5f640fcac8cafe4a4fdd0542f26ca430d76aa8b9212ba77aa
- SSDEEP
  
  24576:KPQQ/6MP6P5d1n+wRcXe1Lmfpm6k626D6b6+eGnkywBIpv:Cy8OeG8k
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  
  d3dcompiler_47.dll
- Size
  
  4.7MB
- MD5
  
  2191e768cc2e19009dad20dc999135a3
- SHA1
  
  f49a46ba0e954e657aaed1c9019a53d194272b6a
- SHA256
  
  7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
- SHA512
  
  5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
- SSDEEP
  
  49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
Score

1^/10
behavioral13
- Target
  
  ffmpeg.dll
- Size
  
  2.7MB
- MD5
  
  bf09deeeb497aeddaf6194e695776b8b
- SHA1
  
  e7d8719d6d0664b8746581b88eb03a486f588844
- SHA256
  
  450d5e6a11dc31dc6e1a7af472cd08b7e7a78976b1f0aa1c62055a0a720f5080
- SHA512
  
  38d3cac922634df85ddfd8d070b38cf4973bba8f37d3246453377f30165cc4377b4e67c4e0bca0ffe3c3fa0e024b23a31ec009e16d0ab3042593b5a6e164669f
- SSDEEP
  
  49152:2gUBJTIe17EwJvr3OXtgTyFBcCen6yfUvUUP/bkLmV:ZY1vreXOuFePUP/bay
Score

1^/10
behavioral14 behavioral15
- Target
  
  libEGL.dll
- Size
  
  467KB
- MD5
  
  3a5cbf0ce848ec30a2f8fe1760564515
- SHA1
  
  31bf9312cd1beaedaa91766e5cde13406d6ea219
- SHA256
  
  afef052c621f72ba986d917a9e090d23a13f4ab6bc09f158eeb73fd671b94219
- SHA512
  
  bd5713e1d22145b4cc52f4e46b464f443aad6f783a5793268e7d9dca969f27b70e706eecd54cb01be1c94256e6a95864c6b7e50027cef7fa870cdb16820ad602
- SSDEEP
  
  6144:FaEXc0Izd+rYvqNUMbh9L8OgKcG4BEFATaxlI/:/dIZ+rwqNUMbFL2BE6W8/
Score

1^/10
behavioral16 behavioral17
- Target
  
  libGLESv2.dll
- Size
  
  7.3MB
- MD5
  
  c783045e4b7f00c847678d43a77367f7
- SHA1
  
  7f9192ce0b23ac93561aeec9d9c38daa3136c146
- SHA256
  
  3a39137dcee6cb6663ae9cca424b6b05cf56c0ad7e32fb72cb94549ea9dbcae8
- SHA512
  
  64e6d4fc84f1217ceef05a22ad63a6618ffdc470b1faf4ad9e2d7bab59e9285527b9c5fd7ea4be673a08b9466434e3c098e839bf6955597e3d8aa0e80589f4a3
- SSDEEP
  
  98304:A99bSJY8juRSvODN1uVZ5U7NJhbXm3fP:Aeu8iEOx73hzCfP
Score

1^/10
behavioral18 behavioral19
- Target
  
  resources/app/node_modules/adm-zip/adm-zip.js
- Size
  
  30KB
- MD5
  
  9b6da3cd4a4ce0963e80d0e6dc1a11f1
- SHA1
  
  fce6550c2231f60425661f2f7db99efff491cdff
- SHA256
  
  cb49867d6ffe8e7c08ad0e6466c86450b0f81910069ed1ad9d5b7b9c27367929
- SHA512
  
  38f325ced4315f7fd39f9ec885e1a35f8d5c49bfe9721c3ae0b54d040c76e7df3e6d557f76bb5783594b0fe5c15f9e73f8c7a21fee373ecbd97ed9220d3127ba
- SSDEEP
  
  384:T4XzvHf944AOOLlPHWuFz5AjHxLPVzVbAB1kfVeHW3W5SqdCLFWYi82et/2Ktvbe:UzvF4DPHzFn11IqdCpoFaU
Score

3^/10

execution
behavioral20 behavioral21
- Target
  
  resources/app/node_modules/adm-zip/headers/entryHeader.js
- Size
  
  11KB
- MD5
  
  db0294dd88cf4922e3cbb5e45d087287
- SHA1
  
  f46ea2a1a7e9cb0c6c25fc436743b78d95da1841
- SHA256
  
  d3ca0adfd642be6287daf5a7cc8d3959332f31ba52b6ef1a53e4520bf4175f3f
- SHA512
  
  2f77a248db215a4d7287dfe7227adc1bbd4239d31731a743994dd4a4e4f0aa061dacb3fc9d79f22364d3771ac3b36d41dca5788b34892c94f8cb8d2d95a6b661
- SSDEEP
  
  192:ybVz3fxOy27Ad1mMcyfPrzq638jfhDq5YoYfXSlAHhDQf:y5fxOv7VMcyfPXqm8jfhD+
Score

3^/10

execution
behavioral22 behavioral23
- Target
  
  resources/app/node_modules/adm-zip/headers/index.js
- Size
  
  94B
- MD5
  
  64bc889b89f1c8a04a698a8f74e24e5b
- SHA1
  
  68781da04cf1ebc4f03434ea5b2b65f10cca07e6
- SHA256
  
  536e4b5bf009a3d9f6eccfbbc4157cb6de663d889e0826ea5f6e5fa17aaeb8bf
- SHA512
  
  9eb207fa61862aebd9cc5a89f85757313c7f163ea0f5a15c16250f79845b9caa1d8109bc3e634a9ed3fb0616c71aed3005ace48eff0941518c778c3063613975
Score

3^/10

execution
behavioral24 behavioral25
- Target
  
  resources/app/node_modules/adm-zip/headers/mainHeader.js
- Size
  
  4KB
- MD5
  
  1d35f59aece6922da87e6183e7f8379b
- SHA1
  
  b772c6b2285d6f7c099bfd7ace005e730bd12c78
- SHA256
  
  3269b558fd8990df8ae1f500268e0512854c04bffefcaa0e584360de1809b84a
- SHA512
  
  3cb59c8fb586a89936ad4fbd4d29c54cfe8e0ae9abcc4ff70ef03a3cdbefff9b4a5d91658da79e6746ab01af9cfc57dd908b8e478ee4aee5848e0252a1f68603
- SSDEEP
  
  96:riWDe6p2ciGztwfWH7gNJzaI2mhUJfPok1:rFDe6pPyEp1
Score

3^/10

execution
behavioral26 behavioral27
- Target
  
  resources/app/node_modules/adm-zip/methods/deflater.js
- Size
  
  1021B
- MD5
  
  41fd6791497f7d74ee56a7753e08da66
- SHA1
  
  bd62d07bfe703da89172fcfeaa8848d6ba5c68b4
- SHA256
  
  6dc41b2460594cfa5136b797653c166b2f7403820a40f2fca17cca35a5de1b5f
- SHA512
  
  5f16aeb477321470986a8c9807ebf3b75e979e5fb34156028ef56f44f38c4f4d72d9d086784e9dfedeffa61f91f973b6ac7e7ba1730eebd86bb549de2dbb4761
Score

3^/10

execution
behavioral28 behavioral29
- Target
  
  resources/app/node_modules/adm-zip/methods/index.js
- Size
  
  128B
- MD5
  
  74d54dda1e050cad9b31da325f92fb01
- SHA1
  
  683b0412f3bdb3ae54cd809e37f456dade4d046a
- SHA256
  
  d67714f1a04be942f90be77069af3ff4214aa8ee84b26edeff3a87eb0d8e2dc0
- SHA512
  
  88ff974e69207c427ce1c9161489a275c4328ba392da65b268614fd5c66ef9feb10dafe1464dcc5873221de61bdb045dcf47092760c973ec06825158978df3e6
Score

3^/10

execution
behavioral30 behavioral31
- Target
  
  resources/app/node_modules/adm-zip/methods/inflater.js
- Size
  
  936B
- MD5
  
  ddf58fccf9d270a32d6fe17fe86a26f9
- SHA1
  
  c720d51c923aa71bce2a27a3d081af09de0e2a67
- SHA256
  
  ac2c664bd94fe9daee76174aa00d149d60bbbe6ae5d5865b14bd76e9b7d2d612
- SHA512
  
  bc5914af2950f7e87b0071d54f885b7ef494cee1f036e9fe2e31365506ab78a6327dd25d2c565c09b0ecd465ddc79bb8fc5ff7b6c3a9b15a4d4f044fe816d610
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32