zloader | a97b7b2353dc9012b6cb914f6665d0e93f557859411d2e08b942316c09d7b07f

Target

xiynk.dll
Size

356KB
MD5

e83a8a849188b48e79a6f49dd0c7ae91
SHA1

55a1669550d823104e1452f0e6a0a94c3f7fae12
SHA256

a97b7b2353dc9012b6cb914f6665d0e93f557859411d2e08b942316c09d7b07f
SHA512

b035faff865f72977879322f9d1c08c6f87c96a8805db76a0e5ae4b6118f2b075e58bb1cc6a9cee8ce1c51763301443bab40970ad1f072a1763d7d7727e477f4

Score

10^/10

spyware trojan botnet zloader

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3076 set thread context of 2116	3076	rundll32.exe	74

Blacklisted process makes network request 17 IoCs

flow	pid	Process
10	2116	msiexec.exe
11	2116	msiexec.exe
12	2116	msiexec.exe
13	2116	msiexec.exe
14	2116	msiexec.exe
15	2116	msiexec.exe
16	2116	msiexec.exe
17	2116	msiexec.exe
18	2116	msiexec.exe
19	2116	msiexec.exe
20	2116	msiexec.exe
21	2116	msiexec.exe
22	2116	msiexec.exe
23	2116	msiexec.exe
24	2116	msiexec.exe
25	2116	msiexec.exe
26	2116	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2116	msiexec.exe
2116	msiexec.exe

Runs net.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 3076	2532	rundll32.exe	67
PID 2532 wrote to memory of 3076	2532	rundll32.exe	67
PID 2532 wrote to memory of 3076	2532	rundll32.exe	67
PID 3076 wrote to memory of 2116	3076	rundll32.exe	74
PID 3076 wrote to memory of 2116	3076	rundll32.exe	74
PID 3076 wrote to memory of 2116	3076	rundll32.exe	74
PID 3076 wrote to memory of 2116	3076	rundll32.exe	74
PID 3076 wrote to memory of 2116	3076	rundll32.exe	74
PID 2116 wrote to memory of 492	2116	msiexec.exe	75
PID 2116 wrote to memory of 492	2116	msiexec.exe	75
PID 2116 wrote to memory of 492	2116	msiexec.exe	75
PID 492 wrote to memory of 848	492	cmd.exe	77
PID 492 wrote to memory of 848	492	cmd.exe	77
PID 492 wrote to memory of 848	492	cmd.exe	77
PID 2116 wrote to memory of 608	2116	msiexec.exe	78
PID 2116 wrote to memory of 608	2116	msiexec.exe	78
PID 2116 wrote to memory of 608	2116	msiexec.exe	78
PID 608 wrote to memory of 1168	608	cmd.exe	80
PID 608 wrote to memory of 1168	608	cmd.exe	80
PID 608 wrote to memory of 1168	608	cmd.exe	80
PID 1168 wrote to memory of 1356	1168	net.exe	81
PID 1168 wrote to memory of 1356	1168	net.exe	81
PID 1168 wrote to memory of 1356	1168	net.exe	81
PID 2116 wrote to memory of 1508	2116	msiexec.exe	82
PID 2116 wrote to memory of 1508	2116	msiexec.exe	82
PID 2116 wrote to memory of 1508	2116	msiexec.exe	82
PID 1508 wrote to memory of 1800	1508	cmd.exe	84
PID 1508 wrote to memory of 1800	1508	cmd.exe	84
PID 1508 wrote to memory of 1800	1508	cmd.exe	84
PID 2116 wrote to memory of 1880	2116	msiexec.exe	85
PID 2116 wrote to memory of 1880	2116	msiexec.exe	85
PID 2116 wrote to memory of 1880	2116	msiexec.exe	85
PID 1880 wrote to memory of 2128	1880	cmd.exe	87
PID 1880 wrote to memory of 2128	1880	cmd.exe	87
PID 1880 wrote to memory of 2128	1880	cmd.exe	87

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Discovers systems in the same network 1 TTPs 2 IoCs

discovery

Remote System Discovery

T1018

pid	Process
2128	net.exe
1800	net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2116	msiexec.exe
Token: SeSecurityPrivilege	2116	msiexec.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\xiynk.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\xiynk.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3076
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec.exe
    3⤵
    - Blacklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    - Suspicious use of AdjustPrivilegeToken
    PID:2116
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c ipconfig /all
      4⤵
      Suspicious use of WriteProcessMemory
      PID:492
    - - C:\Windows\SysWOW64\ipconfig.exe
        
        ipconfig /all
        5⤵
        
        PID:848
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net config workstation
      4⤵
      Suspicious use of WriteProcessMemory
      PID:608
    - - C:\Windows\SysWOW64\net.exe
        
        net config workstation
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1168
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 config workstation
        6⤵
        
        PID:1356
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net view /all
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1508
    - - C:\Windows\SysWOW64\net.exe
        
        net view /all
        5⤵
        Discovers systems in the same network
        
        PID:1800
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net view /all /domain
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1880
    - - C:\Windows\SysWOW64\net.exe
        
        net view /all /domain
        5⤵
        Discovers systems in the same network
        
        PID:2128

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2116-1-0x00000000007A0000-0x00000000007CB000-memory.dmp

Filesize
172KB

Download