zloader | 45f3f5d22895889574eb220c91242129153c6d85374d08665348c3bbe3414543

General

Target

e4a088773d56d0f6e7d1582f100b5137_JaffaCakes118.dll
Size

485KB
MD5

e4a088773d56d0f6e7d1582f100b5137
SHA1

5cf878a09b2de0b664467b928ad03453e5c1491e
SHA256

45f3f5d22895889574eb220c91242129153c6d85374d08665348c3bbe3414543
SHA512

eea5d926f100f5ae136e2ea5c71530ff087349ed89aa069b1cc4490ca8bb0432e1013e953de6c56befd660acd673d388aeef3e9db0ced7cbd4dd71ed432f0f6d
SSDEEP

6144:2GZEvCrxV4BFoLncn4XAVTDLg3z7uM5ecKsNuDQB0UHziTC8LFHPdqBp:veKrxuTsc/jazf5RKpEHT4Bdcp

Score

10^/10

zloader r1 r1 botnet discovery trojan

Malware Config

Extracted

Family

zloader

Botnet

r1

Campaign

r1

C2

http://bsraotpeiimmrnchcqvr.com/LKhwojehDgwegSDG/gateJKjdsh.php

http://exqnbgauiphxqdeecitw.com/LKhwojehDgwegSDG/gateJKjdsh.php

http://fpbkvirfkfvufpbkvgty.com/LKhwojehDgwegSDG/gateJKjdsh.php

http://hikowojacckxccgglhvy.com/LKhwojehDgwegSDG/gateJKjdsh.php

http://kdrowkrjhrdmbxkthljt.com/LKhwojehDgwegSDG/gateJKjdsh.php

http://nvlmtlisfmcfgimicstx.com/LKhwojehDgwegSDG/gateJKjdsh.php

http://syohvyctqfcgakxepsou.com/LKhwojehDgwegSDG/gateJKjdsh.php

http://wdwrhikolxfwyyhwwfut.com/LKhwojehDgwegSDG/gateJKjdsh.php

Attributes

build_id
17

rc4.plain

rsa_pubkey.plain

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2672 created 1200	2672	regsvr32.exe	21

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2672 set thread context of 1500	2672	regsvr32.exe	33

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2672	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2672	regsvr32.exe
Token: SeSecurityPrivilege	1500	msiexec.exe
Token: SeSecurityPrivilege	1500	msiexec.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2672	2240	regsvr32.exe	31
PID 2240 wrote to memory of 2672	2240	regsvr32.exe	31
PID 2240 wrote to memory of 2672	2240	regsvr32.exe	31
PID 2240 wrote to memory of 2672	2240	regsvr32.exe	31
PID 2240 wrote to memory of 2672	2240	regsvr32.exe	31
PID 2240 wrote to memory of 2672	2240	regsvr32.exe	31
PID 2240 wrote to memory of 2672	2240	regsvr32.exe	31
PID 2672 wrote to memory of 1500	2672	regsvr32.exe	33
PID 2672 wrote to memory of 1500	2672	regsvr32.exe	33
PID 2672 wrote to memory of 1500	2672	regsvr32.exe	33
PID 2672 wrote to memory of 1500	2672	regsvr32.exe	33
PID 2672 wrote to memory of 1500	2672	regsvr32.exe	33
PID 2672 wrote to memory of 1500	2672	regsvr32.exe	33
PID 2672 wrote to memory of 1500	2672	regsvr32.exe	33
PID 2672 wrote to memory of 1500	2672	regsvr32.exe	33
PID 2672 wrote to memory of 1500	2672	regsvr32.exe	33

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1200
- C:\Windows\system32\regsvr32.exe
  regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e4a088773d56d0f6e7d1582f100b5137_JaffaCakes118.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Windows\SysWOW64\regsvr32.exe
    /s C:\Users\Admin\AppData\Local\Temp\e4a088773d56d0f6e7d1582f100b5137_JaffaCakes118.dll
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2672
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1500-7-0x0000000000090000-0x00000000000BD000-memory.dmp

Filesize
180KB

Download
memory/1500-9-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/1500-11-0x0000000000090000-0x00000000000BD000-memory.dmp

Filesize
180KB

Download
memory/1500-13-0x00000000743F0000-0x0000000074608000-memory.dmp

Filesize
2.1MB

Download
memory/1500-16-0x0000000000090000-0x00000000000BD000-memory.dmp

Filesize
180KB

Download
memory/1500-15-0x0000000000090000-0x00000000000BD000-memory.dmp

Filesize
180KB

Download
memory/1500-18-0x00000000743F0000-0x0000000074608000-memory.dmp

Filesize
2.1MB

Download
memory/2672-0-0x0000000074558000-0x000000007455B000-memory.dmp

Filesize
12KB

Download
memory/2672-1-0x00000000744E0000-0x000000007456B000-memory.dmp

Filesize
556KB

Download
memory/2672-2-0x00000000744E0000-0x000000007456B000-memory.dmp

Filesize
556KB

Download
memory/2672-3-0x0000000074558000-0x000000007455B000-memory.dmp

Filesize
12KB

Download
memory/2672-12-0x00000000744E0000-0x000000007456B000-memory.dmp

Filesize
556KB

Download

Analysis

Sharing