zloader | 28834f3eb57c18ad25c9b65a3fb5b242207a1b92e06c6d721a6c16f7009c326a | Triage

Sharing

General

Target

GenesisLoader Setup 1.0.0.exe
Size

76.9MB
Sample

240921-ljpxwavhrq
MD5

e1c1b8a1d76e93fc226a6f756d722fc2
SHA1

cbf54abec6f29bbdb17dfaa06c8442a0a1feaa03
SHA256

28834f3eb57c18ad25c9b65a3fb5b242207a1b92e06c6d721a6c16f7009c326a
SHA512

b7cc02efa2434ddcd1578e161422a330c4375a542cc99b9843dff0e5daee51c61ba9f182e8dddcc40de65521f7b0582bb9d4c3c994676a40b7298428f4a20d3a
SSDEEP

1572864:4M/xlZ1DRhZ04pONinTIXK7hqs+RfibhiB7XLVjvaTI:4yTzO4nsaYIb0B7XL/

Score

10^/10

zloader discovery execution

Malware Config

Targets

- Target
  
  GenesisLoader Setup 1.0.0.exe
- Size
  
  76.9MB
- MD5
  
  e1c1b8a1d76e93fc226a6f756d722fc2
- SHA1
  
  cbf54abec6f29bbdb17dfaa06c8442a0a1feaa03
- SHA256
  
  28834f3eb57c18ad25c9b65a3fb5b242207a1b92e06c6d721a6c16f7009c326a
- SHA512
  
  b7cc02efa2434ddcd1578e161422a330c4375a542cc99b9843dff0e5daee51c61ba9f182e8dddcc40de65521f7b0582bb9d4c3c994676a40b7298428f4a20d3a
- SSDEEP
  
  1572864:4M/xlZ1DRhZ04pONinTIXK7hqs+RfibhiB7XLVjvaTI:4yTzO4nsaYIb0B7XL/
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/SpiderBanner.dll
- Size
  
  9KB
- MD5
  
  17309e33b596ba3a5693b4d3e85cf8d7
- SHA1
  
  7d361836cf53df42021c7f2b148aec9458818c01
- SHA256
  
  996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- SHA512
  
  1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP
  
  192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  100KB
- MD5
  
  c6a6e03f77c313b267498515488c5740
- SHA1
  
  3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA256
  
  b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- SHA512
  
  9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP
  
  3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/WinShell.dll
- Size
  
  3KB
- MD5
  
  1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1
  
  0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA256
  
  9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- SHA512
  
  7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  
  GenesisLoader.exe
- Size
  
  177.5MB
- MD5
  
  0bf04247bbef6d43600ae79d51ee0dd9
- SHA1
  
  4716c7fdcdd18aeffe12b7febb75fdb75ae573b3
- SHA256
  
  0f15adf631964c14dcf9afdcd28086e584ce002ffd7705ceff934ad18e9bec95
- SHA512
  
  6aed1c9fb0d8ca1a9b876b5887def2318bd9565a35caf31c80ef4228fc5b8d226c9ff3fb649241031483195bd8be7d84b5cc90a89e142095ff95cfd40d7931a2
- SSDEEP
  
  1572864:z+vbimZ3RqPfrrW/GDt+wy2tXgJdtEaxMz6lMp1rJ/Gk/QeF/anRq9A4CGdhVnau:zA5kyGScXQT
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates processes with tasklist
  discovery
behavioral11
- Target
  
  LICENSES.chromium.html
- Size
  
  9.0MB
- MD5
  
  f017c462d59fd22271a2c5e7f38327f9
- SHA1
  
  7e1bbeea6ac2599bd0f08877aa5811d32f1aceb9
- SHA256
  
  40f314c778851106918aae749d75b2d913984327602a1bfb7ef0cc6443ff2a37
- SHA512
  
  72177281486f6ec26ccc743b43481c31470c7dd53f17b0a67ac087dded190c2e3dde5570260150c2e9650186a515740af7f81e31965c95bb762340f9ac100c07
- SSDEEP
  
  24576:G8QQf6Ox6j1newR6Xe1Vmf86k6T6W6r656+eGj7dOp+:fG6eGd
Score

3^/10

discovery
behavioral12 behavioral13
- Target
  
  d3dcompiler_47.dll
- Size
  
  4.7MB
- MD5
  
  a7b7470c347f84365ffe1b2072b4f95c
- SHA1
  
  57a96f6fb326ba65b7f7016242132b3f9464c7a3
- SHA256
  
  af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
- SHA512
  
  83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
- SSDEEP
  
  49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
Score

1^/10
behavioral14
- Target
  
  ffmpeg.dll
- Size
  
  2.8MB
- MD5
  
  ed10fd2777a030b2895d2f555207f1b3
- SHA1
  
  81448e7a72e49eff746abbedea503139b7eadbdd
- SHA256
  
  996aed5bb751d70e215bcc3e5be2ed28fb54412af05031c592df101b51232e0c
- SHA512
  
  435f33fd11fc25a495726401211ed87771c831eab8916b8bb9520bf0f799646f911b22716f090849bfc85e2372cd28aa1c9de46f9d613929993ef009955173e9
- SSDEEP
  
  49152:nFjQnjfFEokq/eG+xqIiyxU6b+rq+X6CfUBXY/JBY6:nFjE/CxqnyKk+r1/H
Score

1^/10
behavioral15
- Target
  
  libEGL.dll
- Size
  
  473KB
- MD5
  
  e3f6c7b1316f7ca06ee178377ce16ff7
- SHA1
  
  f546da89ec0d3ef238892be8f2dd697d411518bb
- SHA256
  
  ff6d4f18492a704b4b9d853abdcc73a4fa561b0c685619508e25afaf4e4800b9
- SHA512
  
  cad4026efc48192c4904a4b0ec583d2e24b94f8a5f91824716eddb32477512799b10a4f9cc7a2976a25ca0d333bb1c68bb98b1d0f9bd7020e0e31be7d950720b
- SSDEEP
  
  6144:7TQILNFetxbb8J6AGrIKLD0Rf8KRWAwi+u7fS41stlu9:4IDq58JFGrIKLDWNW2+u7fS41f
Score

1^/10
behavioral16
- Target
  
  libGLESv2.dll
- Size
  
  8.0MB
- MD5
  
  ac216b22cb7ca21d9803ae6b111792e5
- SHA1
  
  f6678626aa522628110315889ca744572549bb73
- SHA256
  
  3cd10952ba73ba4a36f5ec92dcbb0893092bfc8d77a381f6f9f3090b0ecfbb50
- SHA512
  
  df344f79ff5d4e38b451bea948c234b63af0402565097082a082b44a4efb9e0ed367884875cbc817237b7ae7ac126fc7de0e8615504923b8db553c1a3a985a90
- SSDEEP
  
  98304:dAb24VjbjUkC/f5031ZIXytRt1lK6XC3a:dAb24VjbIk2sEol/ma
Score

1^/10
behavioral17
- Target
  
  resources/app.asar
- Size
  
  476KB
- MD5
  
  8df09ddb5b31a8fa0af894f7d42d7422
- SHA1
  
  5042c6fdc26392e867cd379c8d2d571d6ba7a4eb
- SHA256
  
  56918c11f3c552bdeb664e574e210d80a17838105f669d1769c80f90556f8a08
- SHA512
  
  749a13c28b9d7f3675e3e78f45b374d6c1a85df8b851461b9669c1e355842dbf7cf4f2e3f9040f0f04e0537e57efefa00802ac913eef4c912ca184e79e081150
- SSDEEP
  
  12288:7eAqTpFiHnyDXK8wuwIVKgVReqwjAE9sf1gLQoD:7qVK6p+F9uPoD
Score

3^/10

execution
behavioral18 behavioral19
- Target
  
  resources/elevate.exe
- Size
  
  105KB
- MD5
  
  792b92c8ad13c46f27c7ced0810694df
- SHA1
  
  d8d449b92de20a57df722df46435ba4553ecc802
- SHA256
  
  9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- SHA512
  
  6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP
  
  3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
Score

3^/10

discovery
behavioral20 behavioral21
- Target
  
  vk_swiftshader.dll
- Size
  
  5.2MB
- MD5
  
  ed0ffde1854aa8b1dc64835b48833d32
- SHA1
  
  5aa09092b982e8ae1ca73f713d6f51a30248b64a
- SHA256
  
  1a24356be288e742549a20c62de9259b2e1cf8bd560151ff7a24d4ae1a4652a2
- SHA512
  
  59fd3b9153b2d777a707c7f2aedf2b7be701c18fb1b9e79d32381dacca22768c6461c575271aee960d7c41fadeba75f8cde41fc8a229c2e49823bbb5853b69a1
- SSDEEP
  
  49152:nCGM4oeoplNc2pKVnr3AvCCLOySISecKTBMqIxDu99Frv/TJgcs10ZxkWidfOvky:t7oeop/7ZjrXtxsZBVK2
Score

1^/10
behavioral22
- Target
  
  vulkan-1.dll
- Size
  
  874KB
- MD5
  
  8f939b8bbffc7e1083e938adc4b5aea7
- SHA1
  
  ce03fd0ec3c11fbbc51b6fef044bea7915991aa9
- SHA256
  
  7d411fa0a615d0f67099fc3978b3f07e28565b9877cce02ec239eb228fa4d485
- SHA512
  
  bed9ac52e82dcf3e8233d90f1f0986ce6371338299a7efc490d89955d869e2b16874cd2258b4217971269f19fb1589530fe2d870d65610a878f2633f0cf4e0af
- SSDEEP
  
  24576:0vBtBPI5xicAl7igP7O6Z5W1DYsHq6g3P0zAk7/BoxMKqz:0ZQ3Adn7O6Z5W1DYsHq6g3P0zAk7+
Score

1^/10
behavioral23
- Target
  
  $PLUGINSDIR/nsExec.dll
- Size
  
  6KB
- MD5
  
  ec0504e6b8a11d5aad43b296beeb84b2
- SHA1
  
  91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA256
  
  5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- SHA512
  
  3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP
  
  96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
Score

3^/10

discovery
behavioral24 behavioral25
- Target
  
  $PLUGINSDIR/nsis7z.dll
- Size
  
  424KB
- MD5
  
  80e44ce4895304c6a3a831310fbf8cd0
- SHA1
  
  36bd49ae21c460be5753a904b4501f1abca53508
- SHA256
  
  b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- SHA512
  
  c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP
  
  6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
Score

3^/10

discovery
behavioral26 behavioral27
- Target
  
  $R0/Uninstall GenesisLoader.exe
- Size
  
  348KB
- MD5
  
  4fff7b059155e4ef42acbb96bf031c01
- SHA1
  
  168b219d7e716374af7f71d9f6b31ccd7a5f7613
- SHA256
  
  667f3631149bf909af520f1b6250b991d2e9e3cc7e08072027a75f37fc655fff
- SHA512
  
  a711c63d9061cfb04e89b1b38cb92425026afeab0594b779e4c43ad7fa5f5e574f402d9ec2f9185f6711d9fc406f9c7925ca99295526f21ea4dd9612e90a4280
- SSDEEP
  
  6144:g740IrgY8QxBBmlZ6O/0JEcAEffWKqsgEOiKUZPwngm3q+5A/Ecn/9s2t0EyL+yj:6IgLQotAE9sftqwwyV4i/Ecn+RKJU
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Enumerates processes with tasklist
  discovery
behavioral28 behavioral29
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  100KB
- MD5
  
  c6a6e03f77c313b267498515488c5740
- SHA1
  
  3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA256
  
  b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- SHA512
  
  9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP
  
  3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score

3^/10

discovery
behavioral30 behavioral31
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Browser Information Discovery

Process Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32