zloader | 280fedf6fd7e0964222ac9b21bcc289c222c7ea91d7bad6350741bdf8c1f0938

General

Target

rVuj5bF.bin.dll
Size

403KB
MD5

4e9d3907d80cfe903df735b855d5eaeb
SHA1

3fcc74d0b646e8324f0a4cf4708890a8261f3e84
SHA256

280fedf6fd7e0964222ac9b21bcc289c222c7ea91d7bad6350741bdf8c1f0938
SHA512

672b8b0dd776ff156504e55c171fe035e5aac7b1b48ae785973113648717317eb611acbcc6141c5ab6c0096c4f41c24c335d957afbca1fddcf15dfde9750361f

Score

10^/10

spyware trojan botnet zloader

Malware Config

Signatures

Runs net.exe
Discovers systems in the same network 1 TTPs 2 IoCs
discovery

Remote System Discovery
T1018

Processes:

net.exenet.exe

pid process

1880 net.exe
2364 net.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

pid	process
1880	net.exe
2364	net.exe

Suspicious use of WriteProcessMemory 35 IoCs

Processes:

rundll32.exerundll32.exemsiexec.execmd.execmd.exenet.execmd.execmd.exe

description	pid	process	target process
PID 712 wrote to memory of 724	712	rundll32.exe	rundll32.exe
PID 712 wrote to memory of 724	712	rundll32.exe	rundll32.exe
PID 712 wrote to memory of 724	712	rundll32.exe	rundll32.exe
PID 724 wrote to memory of 2040	724	rundll32.exe	msiexec.exe
PID 724 wrote to memory of 2040	724	rundll32.exe	msiexec.exe
PID 724 wrote to memory of 2040	724	rundll32.exe	msiexec.exe
PID 724 wrote to memory of 2040	724	rundll32.exe	msiexec.exe
PID 724 wrote to memory of 2040	724	rundll32.exe	msiexec.exe
PID 2040 wrote to memory of 616	2040	msiexec.exe	cmd.exe
PID 2040 wrote to memory of 616	2040	msiexec.exe	cmd.exe
PID 2040 wrote to memory of 616	2040	msiexec.exe	cmd.exe
PID 616 wrote to memory of 340	616	cmd.exe	ipconfig.exe
PID 616 wrote to memory of 340	616	cmd.exe	ipconfig.exe
PID 616 wrote to memory of 340	616	cmd.exe	ipconfig.exe
PID 2040 wrote to memory of 1160	2040	msiexec.exe	cmd.exe
PID 2040 wrote to memory of 1160	2040	msiexec.exe	cmd.exe
PID 2040 wrote to memory of 1160	2040	msiexec.exe	cmd.exe
PID 1160 wrote to memory of 1364	1160	cmd.exe	net.exe
PID 1160 wrote to memory of 1364	1160	cmd.exe	net.exe
PID 1160 wrote to memory of 1364	1160	cmd.exe	net.exe
PID 1364 wrote to memory of 1484	1364	net.exe	net1.exe
PID 1364 wrote to memory of 1484	1364	net.exe	net1.exe
PID 1364 wrote to memory of 1484	1364	net.exe	net1.exe
PID 2040 wrote to memory of 1664	2040	msiexec.exe	cmd.exe
PID 2040 wrote to memory of 1664	2040	msiexec.exe	cmd.exe
PID 2040 wrote to memory of 1664	2040	msiexec.exe	cmd.exe
PID 1664 wrote to memory of 1880	1664	cmd.exe	net.exe
PID 1664 wrote to memory of 1880	1664	cmd.exe	net.exe
PID 1664 wrote to memory of 1880	1664	cmd.exe	net.exe
PID 2040 wrote to memory of 2036	2040	msiexec.exe	cmd.exe
PID 2040 wrote to memory of 2036	2040	msiexec.exe	cmd.exe
PID 2040 wrote to memory of 2036	2040	msiexec.exe	cmd.exe
PID 2036 wrote to memory of 2364	2036	cmd.exe	net.exe
PID 2036 wrote to memory of 2364	2036	cmd.exe	net.exe
PID 2036 wrote to memory of 2364	2036	cmd.exe	net.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 724 set thread context of 2040 724 rundll32.exe msiexec.exe

description	pid	process	target process
PID 724 set thread context of 2040	724	rundll32.exe	msiexec.exe

Blacklisted process makes network request 19 IoCs

Processes:

msiexec.exe

flow	pid	process
15	2040	msiexec.exe
17	2040	msiexec.exe
18	2040	msiexec.exe
19	2040	msiexec.exe
20	2040	msiexec.exe
21	2040	msiexec.exe
22	2040	msiexec.exe
23	2040	msiexec.exe
24	2040	msiexec.exe
25	2040	msiexec.exe
26	2040	msiexec.exe
27	2040	msiexec.exe
28	2040	msiexec.exe
29	2040	msiexec.exe
30	2040	msiexec.exe
31	2040	msiexec.exe
32	2040	msiexec.exe
33	2040	msiexec.exe
34	2040	msiexec.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeSecurityPrivilege 2040 msiexec.exe
Token: SeSecurityPrivilege 2040 msiexec.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msiexec.exe

pid process

2040 msiexec.exe
2040 msiexec.exe

description	pid	process
Token: SeSecurityPrivilege	2040	msiexec.exe
Token: SeSecurityPrivilege	2040	msiexec.exe

pid	process
2040	msiexec.exe
2040	msiexec.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\rVuj5bF.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:712

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\rVuj5bF.bin.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:724

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
3⤵
- Suspicious use of WriteProcessMemory
- Blacklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:2040

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c ipconfig /all
4⤵
- Suspicious use of WriteProcessMemory
PID:616

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /all
5⤵
PID:340

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net config workstation
4⤵
- Suspicious use of WriteProcessMemory
PID:1160

C:\Windows\SysWOW64\net.exe
net config workstation
5⤵
- Suspicious use of WriteProcessMemory
PID:1364

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 config workstation
6⤵
PID:1484

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net view /all
4⤵
- Suspicious use of WriteProcessMemory
PID:1664

C:\Windows\SysWOW64\net.exe
net view /all
5⤵
- Discovers systems in the same network
PID:1880

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net view /all /domain
4⤵
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\SysWOW64\net.exe
net view /all /domain
5⤵
- Discovers systems in the same network
PID:2364

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/340-12-0x0000000000000000-mapping.dmp

Download
memory/616-11-0x0000000000000000-mapping.dmp

Download
memory/724-0-0x0000000000000000-mapping.dmp

Download
memory/1160-13-0x0000000000000000-mapping.dmp

Download
memory/1364-14-0x0000000000000000-mapping.dmp

Download
memory/1484-15-0x0000000000000000-mapping.dmp

Download
memory/1664-16-0x0000000000000000-mapping.dmp

Download
memory/1880-17-0x0000000000000000-mapping.dmp

Download
memory/2036-18-0x0000000000000000-mapping.dmp

Download
memory/2040-1-0x0000000000170000-0x000000000019B000-memory.dmp

Filesize
172KB

Download
memory/2040-2-0x0000000000000000-mapping.dmp

Download
memory/2364-19-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing