zloader | 21587aadce40fc29bdf220e3ad7b63e87f9210dcc3742cf77dc7544438b8db32

Analysis

max time kernel
144s
max time network
148s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23-08-2024 18:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bcb6960b9f204fe1a299e44d011964c3_JaffaCakes118.dll
Size

155KB
MD5

bcb6960b9f204fe1a299e44d011964c3
SHA1

9463ef0923c751223a676fd962d90345edf198ac
SHA256

21587aadce40fc29bdf220e3ad7b63e87f9210dcc3742cf77dc7544438b8db32
SHA512

1b075f1ae357e8d1af4a86c687a674a58991e108b2a7c2d45dda9119bc3d1f111c491176e034266efd741f687e203d4ee91d2a13d3f7ad74a06ebb69cd14dae1
SSDEEP

3072:h35KkzBoJJ9DGW4tJ80rV81TSFtIWzepbhfm4OPdvl7h8iCP:edDGpJ8+V8CtIauh+4udkiC

Score

10^/10

zloader nut 16/02 botnet discovery trojan

Malware Config

Extracted

Family

zloader

Botnet

nut

Campaign

16/02

https://wewalk.cl/post.php

https://dpack-co.com/post.php

https://dr-mirahmadi.ir/post.php

https://indiaastrologyfoundation.in/post.php

https://metisacademy.ir/post.php

https://lan-samarinda.com/post.php

https://pyouleigorgawimbwans.tk/post.php

Attributes

build_id
351

rc4.plain

rsa_pubkey.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Blocklisted process makes network request 57 IoCs

flow	pid	Process
16	1280	msiexec.exe
17	1280	msiexec.exe
18	1280	msiexec.exe
19	1280	msiexec.exe
20	1280	msiexec.exe
21	1280	msiexec.exe
22	1280	msiexec.exe
23	1280	msiexec.exe
24	1280	msiexec.exe
25	1280	msiexec.exe
26	1280	msiexec.exe
27	1280	msiexec.exe
28	1280	msiexec.exe
29	1280	msiexec.exe
30	1280	msiexec.exe
31	1280	msiexec.exe
32	1280	msiexec.exe
33	1280	msiexec.exe
34	1280	msiexec.exe
35	1280	msiexec.exe
36	1280	msiexec.exe
38	1280	msiexec.exe
39	1280	msiexec.exe
40	1280	msiexec.exe
42	1280	msiexec.exe
44	1280	msiexec.exe
46	1280	msiexec.exe
47	1280	msiexec.exe
48	1280	msiexec.exe
49	1280	msiexec.exe
50	1280	msiexec.exe
51	1280	msiexec.exe
53	1280	msiexec.exe
54	1280	msiexec.exe
55	1280	msiexec.exe
56	1280	msiexec.exe
57	1280	msiexec.exe
58	1280	msiexec.exe
59	1280	msiexec.exe
60	1280	msiexec.exe
61	1280	msiexec.exe
62	1280	msiexec.exe
63	1280	msiexec.exe
64	1280	msiexec.exe
65	1280	msiexec.exe
66	1280	msiexec.exe
67	1280	msiexec.exe
68	1280	msiexec.exe
69	1280	msiexec.exe
70	1280	msiexec.exe
71	1280	msiexec.exe
72	1280	msiexec.exe
73	1280	msiexec.exe
74	1280	msiexec.exe
75	1280	msiexec.exe
76	1280	msiexec.exe
78	1280	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1792 set thread context of 1280	1792	rundll32.exe	31

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1280	msiexec.exe
Token: SeSecurityPrivilege	1280	msiexec.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 1792	1676	rundll32.exe	30
PID 1676 wrote to memory of 1792	1676	rundll32.exe	30
PID 1676 wrote to memory of 1792	1676	rundll32.exe	30
PID 1676 wrote to memory of 1792	1676	rundll32.exe	30
PID 1676 wrote to memory of 1792	1676	rundll32.exe	30
PID 1676 wrote to memory of 1792	1676	rundll32.exe	30
PID 1676 wrote to memory of 1792	1676	rundll32.exe	30
PID 1792 wrote to memory of 1280	1792	rundll32.exe	31
PID 1792 wrote to memory of 1280	1792	rundll32.exe	31
PID 1792 wrote to memory of 1280	1792	rundll32.exe	31
PID 1792 wrote to memory of 1280	1792	rundll32.exe	31
PID 1792 wrote to memory of 1280	1792	rundll32.exe	31
PID 1792 wrote to memory of 1280	1792	rundll32.exe	31
PID 1792 wrote to memory of 1280	1792	rundll32.exe	31
PID 1792 wrote to memory of 1280	1792	rundll32.exe	31
PID 1792 wrote to memory of 1280	1792	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bcb6960b9f204fe1a299e44d011964c3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bcb6960b9f204fe1a299e44d011964c3_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec.exe
    3⤵
    - Blocklisted process makes network request
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4446FC12B68E1A179B3B0CE6496080AE

Filesize
1KB

MD5
2ac72be869168b36fd74e93016e11e3b

SHA1
ff9ceb13c83f15b800e6eff987b2c72e01b4b320

SHA256
129fb5de501e24041cd14a81075fd1cde257408d4a353e636912e38bdda2d3fb

SHA512
691ab3144879b757bb24299bb68a485bcc285ff8f16f590d7bf9ddc930f65cbc99da33f349288ad2242faf26b2af33c2592afc6b65ab6850bffe8dee20274247

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6525274CBC2077D43D7D17A33C868C4F

Filesize
959B

MD5
d5e98140c51869fc462c8975620faa78

SHA1
07e032e020b72c3f192f0628a2593a19a70f069e

SHA256
5c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e

SHA512
9bd164cc4b9ef07386762d3775c6d9528b82d4a9dc508c3040104b8d41cfec52eb0b7e6f8dc47c5021ce2fe3ca542c4ae2b54fd02d76b0eabd9724484621a105

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4446FC12B68E1A179B3B0CE6496080AE

Filesize
198B

MD5
189e801f7ac9a5165f8b0d379e40115c

SHA1
556dfb7ba82a6509a455520c241f35a0dc69dc6b

SHA256
ec3eed1f8b6964615775eda71e3e15cfef91f51cf4dae17951b517673009f6ab

SHA512
eba39475ff10dd35ab49fd0d7d14cb8742b3a78c5a3e1f63524e764ba29c881d183aaf142d58959ba8ce8da4374027aa6579eb1114aee7c8fe8767067a666208

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6525274CBC2077D43D7D17A33C868C4F

Filesize
192B

MD5
ec6cab14996285ef84f6bdeed496de8d

SHA1
b6a35e25bbbbed6fb1c0c94945f64937b134e65a

SHA256
dcbbbe6722aa9cb0495ebb5ad79f274b0f38bd3e7ea1ab478436cf4f69edd44d

SHA512
942833c65951070461954b74b4281e631f11c8cff325026ea3967f6700c5d79cb747adc1444f07c15b0a79d3b3bbd21e49b1dd2bdd7cbc1918ddc55c0f205c39

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab34F7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar350A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
memory/1280-4-0x0000000000090000-0x00000000000B9000-memory.dmp

Filesize
164KB

Download
memory/1280-9-0x0000000000090000-0x00000000000B9000-memory.dmp

Filesize
164KB

Download
memory/1280-8-0x0000000000090000-0x00000000000B9000-memory.dmp

Filesize
164KB

Download
memory/1280-6-0x0000000000090000-0x00000000000B9000-memory.dmp

Filesize
164KB

Download
memory/1280-7-0x0000000000090000-0x00000000000B9000-memory.dmp

Filesize
164KB

Download
memory/1280-2-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/1280-3-0x0000000000090000-0x00000000000B9000-memory.dmp

Filesize
164KB

Download
memory/1280-0-0x0000000000090000-0x00000000000B9000-memory.dmp

Filesize
164KB

Download