zloader | 74c8670a8285e6783e6a5c44b43b7399078c36bd80a386f00f810da0e6a45533

Analysis

max time kernel
128s
max time network
129s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20-08-2024 14:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ExeFile (393).exe
Size

194KB
MD5

09874cbb134851ff3b971960916ce5bb
SHA1

42d32698f9513024f024eb6d1efcd9532ac1f622
SHA256

74c8670a8285e6783e6a5c44b43b7399078c36bd80a386f00f810da0e6a45533
SHA512

502189cc108e8c8034d957a9b6b32c29731f9a4d0811ffd147ab3ff516144521c77234c1d114694b070965c4300f36410b607828cb961c56649e04cdd697ee05
SSDEEP

3072:+ELHCmCilCQ9khN5/empqIDq2mKtku4V6TQX6jk8Z/lFcXqR6U:+ELIZQ9kz5/em/DqxKSgTQY3qtU

Score

10^/10

zloader r1 r1 botnet discovery trojan

Malware Config

Extracted

Family

zloader

Botnet

Campaign

https://notsweets.net/LKhwojehDgwegSDG/gateJKjdsh.php

https://olpons.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://karamelliar.org/LKhwojehDgwegSDG/gateJKjdsh.php

https://dogrunn.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://azoraz.net/LKhwojehDgwegSDG/gateJKjdsh.php

Attributes

build_id
125

rc4.plain

rsa_pubkey.plain

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2528 created 1404	2528	ExeFile (393).exe	20

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2528 set thread context of 2632	2528	ExeFile (393).exe	29

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExeFile (393).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2528	ExeFile (393).exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2528	ExeFile (393).exe
Token: SeSecurityPrivilege	2632	msiexec.exe
Token: SeSecurityPrivilege	2632	msiexec.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2632	2528	ExeFile (393).exe	29
PID 2528 wrote to memory of 2632	2528	ExeFile (393).exe	29
PID 2528 wrote to memory of 2632	2528	ExeFile (393).exe	29
PID 2528 wrote to memory of 2632	2528	ExeFile (393).exe	29
PID 2528 wrote to memory of 2632	2528	ExeFile (393).exe	29
PID 2528 wrote to memory of 2632	2528	ExeFile (393).exe	29
PID 2528 wrote to memory of 2632	2528	ExeFile (393).exe	29
PID 2528 wrote to memory of 2632	2528	ExeFile (393).exe	29
PID 2528 wrote to memory of 2632	2528	ExeFile (393).exe	29

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1404
- C:\Users\Admin\AppData\Local\Temp\ExeFile (393).exe
  "C:\Users\Admin\AppData\Local\Temp\ExeFile (393).exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2528
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\data.txt

Filesize
4B

MD5
f2dd0dedb2c260419ece4a9e03b2e828

SHA1
0aaf76f425c6e0f43a36197de768e67d9e035abb

SHA256
26b25d457597a7b0463f9620f666dd10aa2c4373a505967c7c8d70922a2d6ece

SHA512
fecd7b408089255b3467dc1f7231cc6388c9e1c65dcaa5e50f3b460235d18bc44033b08184018b65ac013fdae68c0088381644a6302b9d89e468f57ff9a005dd

Download Submit
memory/2528-10-0x0000000000400000-0x00000000008CE000-memory.dmp

Filesize
4.8MB

Download
memory/2528-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2528-8-0x00000000009B0000-0x0000000000AB0000-memory.dmp

Filesize
1024KB

Download
memory/2528-68-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2528-67-0x0000000000400000-0x00000000008CE000-memory.dmp

Filesize
4.8MB

Download
memory/2632-63-0x00000000000D0000-0x00000000000F8000-memory.dmp

Filesize
160KB

Download
memory/2632-65-0x00000000000D0000-0x00000000000F8000-memory.dmp

Filesize
160KB

Download
memory/2632-64-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2632-70-0x00000000000D0000-0x00000000000F8000-memory.dmp

Filesize
160KB

Download
memory/2632-71-0x00000000000D0000-0x00000000000F8000-memory.dmp

Filesize
160KB

Download
memory/2632-72-0x00000000000D0000-0x00000000000F8000-memory.dmp

Filesize
160KB

Download