ZLoader

The malware is downloaded from a Google advertisement published through Google Adwords... The user clicks on an advertisement shown by Google and is redirected to the fake TeamViewer site under the attacker’s control.

Danabot operators upload other malware to their infrastructure for further spreading.

These access facilitators distribute their backdoors via malicious links and attachments sent via email.

TA577 initially compromised the victim via emails containing malicious Microsoft Office attachments, which, when macros are enabled, download and run IcedID.

This initiates the second stage of the infection chain, downloading the dropper updatescript.bat through the PowerShell cmdlet Invoke-WebRequest... At first, it disables all the Windows Defender modules through the PowerShell cmdlet Set-MpPreference. It then adds exclusions... with the cmdlet Add-MpPreference

It will drop the setup.bat file, triggering the initial infection chain by executing cmd.exe /c setup.bat... The dropper then executes the third stage with the command cmd /c updatescript.bat.

This snippet creates the VBScript getadmin.vbs, runs it and deletes it. Using a VBScript eases the interaction with COM objects.

Annotations ID Technique Tactic T1204.002 Malicious File Execution Exploitation Installation

The nsudo.bat script also completely disables UAC by setting the following registry key to 0: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA

It then adds a new registry key in HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run... This ensures that the attacker’s implant survives machine reboots... The script downloads the file autorun100.bat... and places it in the startup folder

It first creates a new process as a host for the unpacked DLL, and for this sample it uses a new instance of msiexec.exe. Then it allocates and writes 2 RWX memory regions inside the target process.

Then it starts the unpacking by leveraging a process injection technique known as Thread Hijacking... VirtualAllocEx() -> WriteProcessMemory() -> GetThreadContext() -> SetThreadContext() -> ResumeThread()

It then adds a new registry key in HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run... This ensures that the attacker’s implant survives machine reboots... The script downloads the file autorun100.bat... and places it in the startup folder

The attacker leverages this utility in order to spawn a process with “TrustedInstaller” privileges. This can be abused by the attacker to disable the Windows Defender service even if it runs as a Protected Process Light.

This part of the script implements an auto elevation VBScript that aims to run an elevated process in order to make system changes... it instantiates a Shell.Application object and calls the function ShellExecute() to trigger the UAC elevation

Apart from the common dynamic loading of Windows API functions and encrypted strings, Bazar Loader relies on arithmetic substitution via identities to obfuscate the code... There are many other samples that have additional reverse engineering counter measures such as junk code, but a quick comparison revealed no functional differences.

The user is tricked into downloading the fake software in a signed MSI format... these other samples suggest that the attackers had multiple campaigns ongoing beyond TeamViewer and which included fakes such as JavaPlug-in.mis, Zoom.mis, and discord.msi.

It first creates a new process as a host for the unpacked DLL, and for this sample it uses a new instance of msiexec.exe. Then it allocates and writes 2 RWX memory regions inside the target process.

Then it starts the unpacking by leveraging a process injection technique known as Thread Hijacking... VirtualAllocEx() -> WriteProcessMemory() -> GetThreadContext() -> SetThreadContext() -> ResumeThread()

The execution of tim.exe is done through the LOLBAS command explorer.exe tim.exe. This allows the attacker to break the parent/child correlation often used by EDRs for detection.

The tim.bat file is a very short script that downloads the final ZLoader DLL payload with the name tim.dll... and executes it through the LOLBAS command regsvr32 tim.dll... It is executed through the system signed binary regsvr32.exe.

The nsudo.bat script also completely disables UAC by setting the following registry key to 0: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA

Annotations ID Technique Tactic T1553.005 Mark-of-the-Web Bypass Defense Evasion

ZLoader is a typical banking trojan which implements web injection to steal cookies, passwords and any sensitive information.

SentinelLabs identified the entire infrastructure of the ‘Tim’ botnet, composed of more than 350 recently-registered C2 domains... Some domains implement the gate.php component, which is a fingerprint of the ZLoader botnet.

“…Zloader variant linked to Black Basta ransomware, employing Domain Name System (DNS) tunneling for stealthy command and control…”

This analytic story addresses the increasing trend of adversaries leveraging MSIX installers to deliver malware... multiple threat actors have been observed abusing MSIX files to deliver various malware payloads.

Newer versions implement a VNC module which permits users to open a hidden channel that gives the operators remote access to victim systems.

The story we are writing here will try to explain how, from a simple mistake made by an operator, we managed to collect and exploit a lot of precious information from a “Fast Flux” network called BraZZZerS Fast Flux between end of 2018 and 2022.

Deploying ransomware through which cyber actors remove victim access to data (usually via encryption), potentially causing significant disruption to operations.

In order to have these changes take effect, the computer is forced to restart. The nsudo.bat script does this with shutdown.exe /r /f /t 00.

At first, it disables all the Windows Defender modules through the PowerShell cmdlet Set-MpPreference. It then adds exclusions, such as regsvr32, *.exe, *.dll, with the cmdlet Add-MpPreference... The script aims to further impair defenses of the machine.