zloader | bd5bee906d87632d7f2ee9417e295e27b8a188d8c709d9eeeccca57c906c6cc9

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 05:37 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d131c83e02079eb401b06efa61f24f64_JaffaCakes118.exe
Size

255KB
MD5

d131c83e02079eb401b06efa61f24f64
SHA1

c287863877b16a7fc3298dedb45f2cb0b0e206b7
SHA256

bd5bee906d87632d7f2ee9417e295e27b8a188d8c709d9eeeccca57c906c6cc9
SHA512

50846a00c57d7c162c6c1ec989f556b20562318556af7d29cdb57064be2a084a0350de06c041749be734d077b956c94ae1ccffa084d5f32279f6575102fcbca6
SSDEEP

3072:+RZNj7at07LnZO1NR002TccraB0yrrZ2PNMxFE7PQuF4amDHU+PV5hdm3Wwp6VsS:9t07LnZOa02Tviz1qNM47hgUn3Wwtfq

Score

10^/10

zloader canadaloads nerino botnet discovery persistence trojan

Malware Config

Extracted

Family

zloader

Botnet

CanadaLoads

Campaign

Nerino

https://rrspmlsd1.com/bFnF0y1r/7QKpXmV3Pz.php

https://reservationsffrec.com/bFnF0y1r/7QKpXmV3Pz.php

https://tempmailsin112.com/bFnF0y1r/7QKpXmV3Pz.php

https://roadonroadonroad.com/bFnF0y1r/7QKpXmV3Pz.php

https://roadtocaliss.com/bFnF0y1r/7QKpXmV3Pz.php

https://referrer222.com/bFnF0y1r/7QKpXmV3Pz.php

https://makeitrainfordee.com/bFnF0y1r/7QKpXmV3Pz.php

https://makeitrainforffeer.com/bFnF0y1r/7QKpXmV3Pz.php

Attributes

build_id
66

rc4.plain

1
hZRk7754w3VPlf

rsa_pubkey.plain

1
-----BEGIN PUBLIC KEY-----
2
MIGeMA0GCSqGSIb3DQEBAQUAA4GMADCBiAKBgHMNHczOSKEDO/Q4lCuOplrf3/dw
3
NwzuJPAVGcDdkQoh/g/gnSOBClNfxTPH3osxy8ThacGNiVmuGBZTQSA9/5DieRnO
4
zIoJaf5DdiQU7fwjWdPvz4zPO80tG/T/eoYLaBldbt4JAtb4pu/ax9Y97RXrqjIV
5
dE4XFWuRZKDofEqXAgMBAAE=
6
-----END PUBLIC KEY-----

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\Vida = "C:\\Users\\Admin\\AppData\\Roaming\\Gufo\\veykommi.exe"	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1796 set thread context of 2656	1796	d131c83e02079eb401b06efa61f24f64_JaffaCakes118.exe	31

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d131c83e02079eb401b06efa61f24f64_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2656	msiexec.exe
Token: SeSecurityPrivilege	2656	msiexec.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 2656	1796	d131c83e02079eb401b06efa61f24f64_JaffaCakes118.exe	31
PID 1796 wrote to memory of 2656	1796	d131c83e02079eb401b06efa61f24f64_JaffaCakes118.exe	31
PID 1796 wrote to memory of 2656	1796	d131c83e02079eb401b06efa61f24f64_JaffaCakes118.exe	31
PID 1796 wrote to memory of 2656	1796	d131c83e02079eb401b06efa61f24f64_JaffaCakes118.exe	31
PID 1796 wrote to memory of 2656	1796	d131c83e02079eb401b06efa61f24f64_JaffaCakes118.exe	31
PID 1796 wrote to memory of 2656	1796	d131c83e02079eb401b06efa61f24f64_JaffaCakes118.exe	31
PID 1796 wrote to memory of 2656	1796	d131c83e02079eb401b06efa61f24f64_JaffaCakes118.exe	31
PID 1796 wrote to memory of 2656	1796	d131c83e02079eb401b06efa61f24f64_JaffaCakes118.exe	31
PID 1796 wrote to memory of 2656	1796	d131c83e02079eb401b06efa61f24f64_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\d131c83e02079eb401b06efa61f24f64_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d131c83e02079eb401b06efa61f24f64_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2656

Network

DNS

rrspmlsd1.com

msiexec.exe

Remote address:

8.8.8.8:53

Request

rrspmlsd1.com

IN A

Response
DNS

reservationsffrec.com

msiexec.exe

Remote address:

8.8.8.8:53

Request

reservationsffrec.com

IN A

Response
DNS

reservationsffrec.com

msiexec.exe

Remote address:

8.8.8.8:53

Request

reservationsffrec.com

IN A
DNS

tempmailsin112.com

msiexec.exe

Remote address:

8.8.8.8:53

Request

tempmailsin112.com

IN A

Response
DNS

roadonroadonroad.com

msiexec.exe

Remote address:

8.8.8.8:53

Request

roadonroadonroad.com

IN A

Response
DNS

roadtocaliss.com

msiexec.exe

Remote address:

8.8.8.8:53

Request

roadtocaliss.com

IN A

Response
DNS

referrer222.com

msiexec.exe

Remote address:

8.8.8.8:53

Request

referrer222.com

IN A

Response
DNS

makeitrainfordee.com

msiexec.exe

Remote address:

8.8.8.8:53

Request

makeitrainfordee.com

IN A

Response
DNS

makeitrainfordee.com

msiexec.exe

Remote address:

8.8.8.8:53

Request

makeitrainfordee.com

IN A
DNS

makeitrainforffeer.com

msiexec.exe

Remote address:

8.8.8.8:53

Request

makeitrainforffeer.com

IN A

Response

No results found

8.8.8.8:53

rrspmlsd1.com

dns

msiexec.exe

59 B
132 B
1
1

DNS Request

rrspmlsd1.com
8.8.8.8:53

reservationsffrec.com

dns

msiexec.exe

134 B
140 B
2
1

DNS Request

reservationsffrec.com

DNS Request

reservationsffrec.com
8.8.8.8:53

tempmailsin112.com

dns

msiexec.exe

64 B
137 B
1
1

DNS Request

tempmailsin112.com
8.8.8.8:53

roadonroadonroad.com

dns

msiexec.exe

66 B
139 B
1
1

DNS Request

roadonroadonroad.com
8.8.8.8:53

roadtocaliss.com

dns

msiexec.exe

62 B
135 B
1
1

DNS Request

roadtocaliss.com
8.8.8.8:53

referrer222.com

dns

msiexec.exe

61 B
134 B
1
1

DNS Request

referrer222.com
8.8.8.8:53

makeitrainfordee.com

dns

msiexec.exe

132 B
139 B
2
1

DNS Request

makeitrainfordee.com

DNS Request

makeitrainfordee.com
8.8.8.8:53

makeitrainforffeer.com

dns

msiexec.exe

68 B
141 B
1
1

DNS Request

makeitrainforffeer.com

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1796-7-0x0000000000400000-0x0000000004DBB000-memory.dmp

Filesize
73.7MB

Download
memory/1796-8-0x0000000000400000-0x0000000004DBB000-memory.dmp

Filesize
73.7MB

Download
memory/1796-3-0x0000000000400000-0x0000000004DBB000-memory.dmp

Filesize
73.7MB

Download
memory/1796-4-0x0000000004EE0000-0x0000000004FE0000-memory.dmp

Filesize
1024KB

Download
memory/1796-6-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1796-5-0x0000000000400000-0x0000000004DBB000-memory.dmp

Filesize
73.7MB

Download
memory/1796-1-0x0000000004EE0000-0x0000000004FE0000-memory.dmp

Filesize
1024KB

Download
memory/1796-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1796-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1796-13-0x0000000000400000-0x0000000004DBB000-memory.dmp

Filesize
73.7MB

Download
memory/2656-10-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/2656-9-0x00000000000B0000-0x00000000000D9000-memory.dmp

Filesize
164KB

Download
memory/2656-12-0x00000000000B0000-0x00000000000D9000-memory.dmp

Filesize
164KB

Download
memory/2656-17-0x00000000000B0000-0x00000000000D9000-memory.dmp

Filesize
164KB

Download
memory/2656-16-0x00000000000B0000-0x00000000000D9000-memory.dmp

Filesize
164KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.