Daniel Osei — SOC Lead & Malware Analyst
Key Takeaways
- Zloader employs sophisticated techniques for initial access, leveraging phishing and malicious attachments to execute its payload.
- Once executed, Zloader establishes persistence through various methods, including registry manipulations and service deployments.
- The malware employs a robust command and control infrastructure that utilizes both HTTP/S and DNS for beaconing.
Executive Summary
During our investigation into the Zloader malware, we observed a highly modular and dynamic architecture that allows it to achieve a wide array of objectives, including credential theft and data exfiltration. Zloader represents a continued evolution in malware design, making it especially concerning for organizations looking to protect sensitive information. We analyzed a sample of Zloader captured in the wild, outlining its behavior from initial access to command and control.
Initial Access
Initial access to networks infected with Zloader is predominantly achieved through phishing attacks. The actor often employs malicious email attachments that masquerade as legitimate document files. Our examination of a recent sample reveals that the attachment mimicked an invoice, initiating the infection chain seamlessly. Upon opening the attachment, the victim is prompted to enable macros, which triggers a PowerShell command designed to download the main binary from a remote server.
Execution & Persistence
Executing the Zloader payload involves several TTPs that enhance its likelihood of success. The malware typically writes itself to the following directory: %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\. This specific behavior allows Zloader to ensure its persistence across reboots. Our analysis highlighted how Zloader frequently adds registry entries under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run, enabling it to launch automatically. Additionally, we observed Zloader creating a Windows service as part of its persistence strategy, reinforcing its evasion mechanisms.
Command and Control
Upon successful execution, Zloader establishes a command and control (C2) channel, utilizing a combination of HTTP/S and DNS to communicate with remote servers. The sample we analyzed beaconed to a server hosted under a malicious domain, showcasing the actor’s use of over 200 unique subdomains, likely to evade detection. The malware’s C2 messages often included victim information essential for further exploitation, such as system details and network configuration, making further actions more precise.
Lateral Movement & Discovery
Following the initial compromise, Zloader implements lateral movement techniques to broaden its foothold within the target network. This is executed through a combination of credential dumping and exploiting Windows services. We found evidence of Zloader trying to access remote SMB shares, especially on systems within the same Active Directory domain by utilizing credentials obtained through keylogging or stealing cached credentials. Most notably, the malware utilized the T1075 – Pass the Hash method to facilitate this lateral movement.
Impact & Objectives
The end goals of utilizing Zloader are primarily focused on data theft and credential harvesting. During our investigation, we discovered that it was frequently employed to capture login credentials from browsers and applications, followed by exfiltration to the actor’s C2 server. Furthermore, Zloader is capable of deploying additional payloads after establishing a foothold, allowing the actor to install ransomware or other types of information-stealing malware once inside the network.
MITRE ATT&CK Mapping
- T1566 – Phishing: Used for initial access via malicious attachments.
- T1203 – Exploitation for Client Execution: Exploiting macro functionality in Office documents.
- T1543 – Create or Modify System Process: Creating services for persistence.
- T1075 – Pass the Hash: Lateral movement by leveraging stolen hashed credentials.
Detection Opportunities
- Monitor email attachments for known malicious patterns associated with macro-enabled documents.
- Employ endpoint detection solutions that can identify abnormal registry changes in
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. - Utilize network traffic analysis tools to identify unusual C2 beaconing behaviors, particularly to newly registered domains or unknown subdomains.
Analyst Notes
Zloader’s evolving capabilities are concerning, especially its ability to blend in with normal user activities. It is critical for organizations to enhance their email filtering capabilities, user training on phishing detection, and to ensure that their endpoint protection mechanisms are up to date. Continuous monitoring for behavioral anomalies will be crucial in defending against Zloader and similar threats.
Source: Original Report