zloader | 818d03cd6f348268d6609954eb3b4f9cd3ddc5e16165cacbb8fd416feb2d3d1c | Triage

Sharing

General

Target

Netron-Setup-7.8.6.exe
Size

145.3MB
Sample

240907-da2w3s1dqr
MD5

5874b6f6a197cb02207ad01a4f686283
SHA1

813754951d1198541480aa1168c593c9dafd972a
SHA256

818d03cd6f348268d6609954eb3b4f9cd3ddc5e16165cacbb8fd416feb2d3d1c
SHA512

ec2cbd750b8e1a03edda5d625ef4f86f0e56793afac411cf7e162314e3b89823ec9eac9b8f09625e220254985c32134eb17fa6c9d21800648dfa02eacb996d4e
SSDEEP

3145728:w4eyKlglpfQaYFeyK8Tc3g0hoIVIoDPYrwYRX:peIBQa2ecf0hpZEsy

Score

10^/10

zloader discovery

Malware Config

Targets

- Target
  
  Netron-Setup-7.8.6.exe
- Size
  
  145.3MB
- MD5
  
  5874b6f6a197cb02207ad01a4f686283
- SHA1
  
  813754951d1198541480aa1168c593c9dafd972a
- SHA256
  
  818d03cd6f348268d6609954eb3b4f9cd3ddc5e16165cacbb8fd416feb2d3d1c
- SHA512
  
  ec2cbd750b8e1a03edda5d625ef4f86f0e56793afac411cf7e162314e3b89823ec9eac9b8f09625e220254985c32134eb17fa6c9d21800648dfa02eacb996d4e
- SSDEEP
  
  3145728:w4eyKlglpfQaYFeyK8Tc3g0hoIVIoDPYrwYRX:peIBQa2ecf0hpZEsy
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/SpiderBanner.dll
- Size
  
  9KB
- MD5
  
  17309e33b596ba3a5693b4d3e85cf8d7
- SHA1
  
  7d361836cf53df42021c7f2b148aec9458818c01
- SHA256
  
  996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- SHA512
  
  1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP
  
  192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  100KB
- MD5
  
  c6a6e03f77c313b267498515488c5740
- SHA1
  
  3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA256
  
  b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- SHA512
  
  9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP
  
  3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/WinShell.dll
- Size
  
  3KB
- MD5
  
  1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1
  
  0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA256
  
  9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- SHA512
  
  7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  
  LICENSES.chromium.html
- Size
  
  9.0MB
- MD5
  
  f017c462d59fd22271a2c5e7f38327f9
- SHA1
  
  7e1bbeea6ac2599bd0f08877aa5811d32f1aceb9
- SHA256
  
  40f314c778851106918aae749d75b2d913984327602a1bfb7ef0cc6443ff2a37
- SHA512
  
  72177281486f6ec26ccc743b43481c31470c7dd53f17b0a67ac087dded190c2e3dde5570260150c2e9650186a515740af7f81e31965c95bb762340f9ac100c07
- SSDEEP
  
  24576:G8QQf6Ox6j1newR6Xe1Vmf86k6T6W6r656+eGj7dOp+:fG6eGd
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  
  Netron.exe
- Size
  
  177.4MB
- MD5
  
  28c990f895c9a93b77d869763060374b
- SHA1
  
  51354e111e2a4bf9c625580ab26bbd2cce41da4f
- SHA256
  
  23fd2a12093d151f5e761b657852153937e3e72ac4e6b6385dc2aeaf7af0210c
- SHA512
  
  3f9982e94b8c526808cab62e489eae2467ca162b7afee40df05f9e1ffbfc97a3e1a2785ed8858e7b416066f488235659b633eb185cdcc3f7f2fc92d6ebb5020a
- SSDEEP
  
  1572864:L+vbimZ3RqPfrrW/GDt+wy2tXgJdtEaxMz6lMp1rJ/Gk/QeF/anRq9A4CGdhVnaN:LA5kyGScXQTb
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral13
- Target
  
  d3dcompiler_47.dll
- Size
  
  4.7MB
- MD5
  
  a7b7470c347f84365ffe1b2072b4f95c
- SHA1
  
  57a96f6fb326ba65b7f7016242132b3f9464c7a3
- SHA256
  
  af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
- SHA512
  
  83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
- SSDEEP
  
  49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
Score

1^/10
behavioral14
- Target
  
  ffmpeg.dll
- Size
  
  2.8MB
- MD5
  
  ed10fd2777a030b2895d2f555207f1b3
- SHA1
  
  81448e7a72e49eff746abbedea503139b7eadbdd
- SHA256
  
  996aed5bb751d70e215bcc3e5be2ed28fb54412af05031c592df101b51232e0c
- SHA512
  
  435f33fd11fc25a495726401211ed87771c831eab8916b8bb9520bf0f799646f911b22716f090849bfc85e2372cd28aa1c9de46f9d613929993ef009955173e9
- SSDEEP
  
  49152:nFjQnjfFEokq/eG+xqIiyxU6b+rq+X6CfUBXY/JBY6:nFjE/CxqnyKk+r1/H
Score

1^/10
behavioral15
- Target
  
  libEGL.dll
- Size
  
  473KB
- MD5
  
  e3f6c7b1316f7ca06ee178377ce16ff7
- SHA1
  
  f546da89ec0d3ef238892be8f2dd697d411518bb
- SHA256
  
  ff6d4f18492a704b4b9d853abdcc73a4fa561b0c685619508e25afaf4e4800b9
- SHA512
  
  cad4026efc48192c4904a4b0ec583d2e24b94f8a5f91824716eddb32477512799b10a4f9cc7a2976a25ca0d333bb1c68bb98b1d0f9bd7020e0e31be7d950720b
- SSDEEP
  
  6144:7TQILNFetxbb8J6AGrIKLD0Rf8KRWAwi+u7fS41stlu9:4IDq58JFGrIKLDWNW2+u7fS41f
Score

1^/10
behavioral16
- Target
  
  libGLESv2.dll
- Size
  
  8.0MB
- MD5
  
  ac216b22cb7ca21d9803ae6b111792e5
- SHA1
  
  f6678626aa522628110315889ca744572549bb73
- SHA256
  
  3cd10952ba73ba4a36f5ec92dcbb0893092bfc8d77a381f6f9f3090b0ecfbb50
- SHA512
  
  df344f79ff5d4e38b451bea948c234b63af0402565097082a082b44a4efb9e0ed367884875cbc817237b7ae7ac126fc7de0e8615504923b8db553c1a3a985a90
- SSDEEP
  
  98304:dAb24VjbjUkC/f5031ZIXytRt1lK6XC3a:dAb24VjbIk2sEol/ma
Score

1^/10
behavioral17
- Target
  
  resources/elevate.exe
- Size
  
  114KB
- MD5
  
  da2393135ecaaf42ca963f6823b76b3a
- SHA1
  
  da9923620a06f79db447ee00374682eeea55e267
- SHA256
  
  c0647826e2acd22951ce7ce1d7df9ac460948909520771140f629639df378421
- SHA512
  
  4826d6274641423a8851ec5e30963f19e7c8a6322b82e95219340601befd43e102ae4d89794d11f533f5d9bb36118f111ca8d2fbf5fafec4abcc86ed7effa7b1
- SSDEEP
  
  3072:AbbLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWlomO0:yPrwRhte1XsE1lb
Score

3^/10

discovery
behavioral18 behavioral19
- Target
  
  vk_swiftshader.dll
- Size
  
  5.2MB
- MD5
  
  ed0ffde1854aa8b1dc64835b48833d32
- SHA1
  
  5aa09092b982e8ae1ca73f713d6f51a30248b64a
- SHA256
  
  1a24356be288e742549a20c62de9259b2e1cf8bd560151ff7a24d4ae1a4652a2
- SHA512
  
  59fd3b9153b2d777a707c7f2aedf2b7be701c18fb1b9e79d32381dacca22768c6461c575271aee960d7c41fadeba75f8cde41fc8a229c2e49823bbb5853b69a1
- SSDEEP
  
  49152:nCGM4oeoplNc2pKVnr3AvCCLOySISecKTBMqIxDu99Frv/TJgcs10ZxkWidfOvky:t7oeop/7ZjrXtxsZBVK2
Score

1^/10
behavioral20
- Target
  
  vulkan-1.dll
- Size
  
  874KB
- MD5
  
  8f939b8bbffc7e1083e938adc4b5aea7
- SHA1
  
  ce03fd0ec3c11fbbc51b6fef044bea7915991aa9
- SHA256
  
  7d411fa0a615d0f67099fc3978b3f07e28565b9877cce02ec239eb228fa4d485
- SHA512
  
  bed9ac52e82dcf3e8233d90f1f0986ce6371338299a7efc490d89955d869e2b16874cd2258b4217971269f19fb1589530fe2d870d65610a878f2633f0cf4e0af
- SSDEEP
  
  24576:0vBtBPI5xicAl7igP7O6Z5W1DYsHq6g3P0zAk7/BoxMKqz:0ZQ3Adn7O6Z5W1DYsHq6g3P0zAk7+
Score

1^/10
behavioral21
- Target
  
  $PLUGINSDIR/nsExec.dll
- Size
  
  6KB
- MD5
  
  ec0504e6b8a11d5aad43b296beeb84b2
- SHA1
  
  91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA256
  
  5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- SHA512
  
  3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP
  
  96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
Score

3^/10

discovery
behavioral22 behavioral23
- Target
  
  $PLUGINSDIR/nsis7z.dll
- Size
  
  424KB
- MD5
  
  80e44ce4895304c6a3a831310fbf8cd0
- SHA1
  
  36bd49ae21c460be5753a904b4501f1abca53508
- SHA256
  
  b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- SHA512
  
  c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP
  
  6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
Score

3^/10

discovery
behavioral24 behavioral25
- Target
  
  $R0/Uninstall Netron.exe
- Size
  
  284KB
- MD5
  
  59a7e0b1cf6e2a958ea10b60733c09e3
- SHA1
  
  73baebb0432ab8e350f8057245ca496415bd0b9a
- SHA256
  
  c530b575259b7e727629996250900336eca08bfad95e972cf5a07a0dfc867eb3
- SHA512
  
  bc4bdd86727a9a5abffd5111468f2197693e7b2a10a69060840b6932f592d8fefa32f315d885132868235ad39771372969393e497169cdbdcfa0c812f4bb50d3
- SSDEEP
  
  6144:M740I8rKtttttttttttt+//+/t6+t+ttttttt+t+t+qwv7mXFtttttMtttcXuVCR:u9yvEX2BRKJz
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Enumerates processes with tasklist
  discovery
behavioral26 behavioral27

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Browser Information Discovery

Process Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27