zloader | b89d80ca3f0a5da24b8b768d2d5eb35ca1322f6bc2b01e265465ac95d7d61279

Analysis

max time kernel
147s
max time network
149s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20-08-2024 03:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

adba2ac8f027946da258155b140c068a_JaffaCakes118.dll
Size

345KB
MD5

adba2ac8f027946da258155b140c068a
SHA1

91b1dceb17403910d7aa9bee1029f11153accff4
SHA256

b89d80ca3f0a5da24b8b768d2d5eb35ca1322f6bc2b01e265465ac95d7d61279
SHA512

356865ecaf00b10af50ec1f7ffdcc89249e1eaf2a1648c970393d7c66359e578ce9d6987f66dc49cb769e36e8ea62c4ff17d6b173bc793b61fa81e11e619229f
SSDEEP

6144:q9xZILKtmfbcPK2U6gRURSxE8efnQe+R+FNHmZ04aR31cdpN0V:q9xZIL1bcPRUrURAOn8gTGCPMwV

Score

10^/10

zloader nut 16/02 botnet discovery trojan

Malware Config

Extracted

Family

zloader

Botnet

nut

Campaign

16/02

https://wewalk.cl/post.php

https://dpack-co.com/post.php

https://dr-mirahmadi.ir/post.php

https://indiaastrologyfoundation.in/post.php

https://metisacademy.ir/post.php

https://lan-samarinda.com/post.php

https://pyouleigorgawimbwans.tk/post.php

Attributes

build_id
351

rc4.plain

rsa_pubkey.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Blocklisted process makes network request 37 IoCs

flow	pid	Process
16	2864	msiexec.exe
17	2864	msiexec.exe
18	2864	msiexec.exe
19	2864	msiexec.exe
20	2864	msiexec.exe
21	2864	msiexec.exe
22	2864	msiexec.exe
23	2864	msiexec.exe
24	2864	msiexec.exe
25	2864	msiexec.exe
26	2864	msiexec.exe
27	2864	msiexec.exe
28	2864	msiexec.exe
29	2864	msiexec.exe
30	2864	msiexec.exe
31	2864	msiexec.exe
32	2864	msiexec.exe
33	2864	msiexec.exe
34	2864	msiexec.exe
35	2864	msiexec.exe
36	2864	msiexec.exe
38	2864	msiexec.exe
39	2864	msiexec.exe
40	2864	msiexec.exe
42	2864	msiexec.exe
44	2864	msiexec.exe
46	2864	msiexec.exe
47	2864	msiexec.exe
48	2864	msiexec.exe
49	2864	msiexec.exe
50	2864	msiexec.exe
51	2864	msiexec.exe
53	2864	msiexec.exe
54	2864	msiexec.exe
56	2864	msiexec.exe
58	2864	msiexec.exe
59	2864	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2844 set thread context of 2864	2844	rundll32.exe	31

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2864	msiexec.exe
Token: SeSecurityPrivilege	2864	msiexec.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2844	2784	rundll32.exe	30
PID 2784 wrote to memory of 2844	2784	rundll32.exe	30
PID 2784 wrote to memory of 2844	2784	rundll32.exe	30
PID 2784 wrote to memory of 2844	2784	rundll32.exe	30
PID 2784 wrote to memory of 2844	2784	rundll32.exe	30
PID 2784 wrote to memory of 2844	2784	rundll32.exe	30
PID 2784 wrote to memory of 2844	2784	rundll32.exe	30
PID 2844 wrote to memory of 2864	2844	rundll32.exe	31
PID 2844 wrote to memory of 2864	2844	rundll32.exe	31
PID 2844 wrote to memory of 2864	2844	rundll32.exe	31
PID 2844 wrote to memory of 2864	2844	rundll32.exe	31
PID 2844 wrote to memory of 2864	2844	rundll32.exe	31
PID 2844 wrote to memory of 2864	2844	rundll32.exe	31
PID 2844 wrote to memory of 2864	2844	rundll32.exe	31
PID 2844 wrote to memory of 2864	2844	rundll32.exe	31
PID 2844 wrote to memory of 2864	2844	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\adba2ac8f027946da258155b140c068a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\adba2ac8f027946da258155b140c068a_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec.exe
    3⤵
    - Blocklisted process makes network request
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4446FC12B68E1A179B3B0CE6496080AE

Filesize
1KB

MD5
2ac72be869168b36fd74e93016e11e3b

SHA1
ff9ceb13c83f15b800e6eff987b2c72e01b4b320

SHA256
129fb5de501e24041cd14a81075fd1cde257408d4a353e636912e38bdda2d3fb

SHA512
691ab3144879b757bb24299bb68a485bcc285ff8f16f590d7bf9ddc930f65cbc99da33f349288ad2242faf26b2af33c2592afc6b65ab6850bffe8dee20274247

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6525274CBC2077D43D7D17A33C868C4F

Filesize
959B

MD5
d5e98140c51869fc462c8975620faa78

SHA1
07e032e020b72c3f192f0628a2593a19a70f069e

SHA256
5c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e

SHA512
9bd164cc4b9ef07386762d3775c6d9528b82d4a9dc508c3040104b8d41cfec52eb0b7e6f8dc47c5021ce2fe3ca542c4ae2b54fd02d76b0eabd9724484621a105

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4446FC12B68E1A179B3B0CE6496080AE

Filesize
198B

MD5
54e0a1e5aded06ef2a03cbb9a2c4f515

SHA1
ac091edab4534a7a4de9816ea537768517e2f6b3

SHA256
30dd337649eee4ccc2b768ef733a8ba08e95a7a758a1d5a5f323d54f638e773f

SHA512
85f29844ca0e4b780c2f2c742b2540b53359dee4c4b993f016d0a4bb3b06b15961453afa41514c7d9c5a9a18f21722318bacff390d7c459b41eb8aafbb8f7025

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6525274CBC2077D43D7D17A33C868C4F

Filesize
192B

MD5
d6b60ad9b2117e78d2c270ac74d73a3f

SHA1
c69e4f76cefdace4827cef7495ad7f21265ab9dc

SHA256
7517bff755a4bf7230b791e7a6ad9dca14ea48702441410cf402d0d70c517b8d

SHA512
e0f9a31a431cbe30812fde2a6b7e203511de830f6936970d167a40fbdcfbc2030fb09bf49ad32c865033c6596f6d074a8c5574ef8d8d3b7e3458a4d95bb6d401

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDC8C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDC9E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
memory/2844-1-0x0000000074E40000-0x0000000074EF5000-memory.dmp

Filesize
724KB

Download
memory/2844-2-0x0000000074E40000-0x0000000074EF5000-memory.dmp

Filesize
724KB

Download
memory/2844-10-0x0000000074E40000-0x0000000074EF5000-memory.dmp

Filesize
724KB

Download
memory/2844-9-0x0000000074E97000-0x0000000074E9B000-memory.dmp

Filesize
16KB

Download
memory/2844-0-0x0000000074E97000-0x0000000074E9B000-memory.dmp

Filesize
16KB

Download
memory/2864-11-0x0000000000090000-0x00000000000B9000-memory.dmp

Filesize
164KB

Download
memory/2864-16-0x0000000000090000-0x00000000000B9000-memory.dmp

Filesize
164KB

Download
memory/2864-15-0x0000000000090000-0x00000000000B9000-memory.dmp

Filesize
164KB

Download
memory/2864-13-0x0000000000090000-0x00000000000B9000-memory.dmp

Filesize
164KB

Download
memory/2864-14-0x0000000000090000-0x00000000000B9000-memory.dmp

Filesize
164KB

Download
memory/2864-7-0x0000000000090000-0x00000000000B9000-memory.dmp

Filesize
164KB

Download
memory/2864-3-0x0000000000090000-0x00000000000B9000-memory.dmp

Filesize
164KB

Download
memory/2864-5-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download