Resubmissions
15/11/2025, 05:01
251115-fnthza1nay1009/10/2025, 11:39
251009-nr9y5axmw81009/10/2025, 11:18
251009-nera9assfy1009/10/2025, 11:02
251009-m43vxa11f11012/01/2024, 16:05
240112-tjpk4sbcbk6Analysis
- max time kernel
789s - max time network
792s - platform
windows11-21h2_x64 - resource
win11-20250610-en - resource tags
- submitted
09/10/2025, 11:18
General
- Target EpsilonApp.exe
- Size 147KB
- Sample251009-nera9assfy
- SHA256 b206695fb128857012fe280555a32bd389502a1b47c8974f4b405ab19921ac93
Malware Config
Extracted
-
zloader
-
Bing_Mod2
-
M1
-
https://adslstickerni.world
Signatures
- Zloader family
- Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c "date 02-07-2106 && C:\Users\Admin\AppData\Local\Temp\EpsilonApp.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\EpsilonApp.exeC:\Users\Admin\AppData\Local\Temp\EpsilonApp.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\msiexec.exe\??\C:\Windows\System32\msiexec.exe3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1856-10-0x000001BC19950000-0x000001BC19980000-memory.dmp
memory/1856-16-0x000001BC19950000-0x000001BC19980000-memory.dmp
memory/1856-15-0x000001BC19950000-0x000001BC19980000-memory.dmp
memory/1856-14-0x000001BC19950000-0x000001BC19980000-memory.dmp
memory/1856-13-0x000001BC19950000-0x000001BC19980000-memory.dmp
memory/1856-12-0x000001BC19950000-0x000001BC19980000-memory.dmp
memory/1856-17-0x000001BC1BB80000-0x000001BC1BD89000-memory.dmp
memory/1856-29-0x000001BC19950000-0x000001BC19980000-memory.dmp
memory/1856-28-0x000001BC19950000-0x000001BC19980000-memory.dmp
memory/1856-31-0x000001BC19950000-0x000001BC19980000-memory.dmp
memory/4248-0-0x0000029F743F0000-0x0000029F745F9000-memory.dmp