zloader | dd84bd6db3500e786976d5c10fd2388a46dd5c34f79abd5dff624b9a568637aa

Resubmissions

23-01-2024 11:22

240123-ngnyxaaea7 10

29-06-2020 15:36

200629-evyae4waax 10

Analysis

max time kernel
150s
max time network
147s
platform
windows10_x64
resource
win10
submitted
29-06-2020 15:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

june29.dll
Size

573KB
MD5

33a58437b5bc8f91e08960d2faa5f559
SHA1

f015e16c3847edd004aba53f358fe43b28c4f818
SHA256

dd84bd6db3500e786976d5c10fd2388a46dd5c34f79abd5dff624b9a568637aa
SHA512

0fa6349def8590aafc8badf198d1abc7e9f906eec5852088270e2ba11986a918ad6b620c2a545def82c694f340e05ed3a3ad89deb780cc7a23ead1b3f1930f42

Score

10^/10

spyware trojan botnet zloader

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	412	msiexec.exe
Token: SeSecurityPrivilege	412	msiexec.exe

Blacklisted process makes network request 18 IoCs

flow	pid	Process
7	412	msiexec.exe
8	412	msiexec.exe
9	412	msiexec.exe
10	412	msiexec.exe
11	412	msiexec.exe
12	412	msiexec.exe
13	412	msiexec.exe
14	412	msiexec.exe
15	412	msiexec.exe
16	412	msiexec.exe
17	412	msiexec.exe
18	412	msiexec.exe
19	412	msiexec.exe
20	412	msiexec.exe
21	412	msiexec.exe
22	412	msiexec.exe
23	412	msiexec.exe
24	412	msiexec.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
412	msiexec.exe
412	msiexec.exe
412	msiexec.exe
412	msiexec.exe
412	msiexec.exe
412	msiexec.exe

js 1 IoCs

resource	yara_rule
behavioral2/memory/412-842-0x0000000006D00000-0x0000000006DCB000-memory.dmp	js

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
Runs net.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3896 set thread context of 412	3896	rundll32.exe	74

Discovers systems in the same network 1 TTPs 2 IoCs

discovery

Remote System Discovery

T1018

pid	Process
3104	net.exe
2076	net.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 3896	3068	rundll32.exe	67
PID 3068 wrote to memory of 3896	3068	rundll32.exe	67
PID 3068 wrote to memory of 3896	3068	rundll32.exe	67
PID 3896 wrote to memory of 412	3896	rundll32.exe	74
PID 3896 wrote to memory of 412	3896	rundll32.exe	74
PID 3896 wrote to memory of 412	3896	rundll32.exe	74
PID 3896 wrote to memory of 412	3896	rundll32.exe	74
PID 3896 wrote to memory of 412	3896	rundll32.exe	74
PID 412 wrote to memory of 1168	412	msiexec.exe	75
PID 412 wrote to memory of 1168	412	msiexec.exe	75
PID 412 wrote to memory of 1168	412	msiexec.exe	75
PID 1168 wrote to memory of 1880	1168	cmd.exe	77
PID 1168 wrote to memory of 1880	1168	cmd.exe	77
PID 1168 wrote to memory of 1880	1168	cmd.exe	77
PID 412 wrote to memory of 68	412	msiexec.exe	78
PID 412 wrote to memory of 68	412	msiexec.exe	78
PID 412 wrote to memory of 68	412	msiexec.exe	78
PID 68 wrote to memory of 4036	68	cmd.exe	80
PID 68 wrote to memory of 4036	68	cmd.exe	80
PID 68 wrote to memory of 4036	68	cmd.exe	80
PID 4036 wrote to memory of 4000	4036	net.exe	81
PID 4036 wrote to memory of 4000	4036	net.exe	81
PID 4036 wrote to memory of 4000	4036	net.exe	81
PID 412 wrote to memory of 3480	412	msiexec.exe	82
PID 412 wrote to memory of 3480	412	msiexec.exe	82
PID 412 wrote to memory of 3480	412	msiexec.exe	82
PID 3480 wrote to memory of 3104	3480	cmd.exe	84
PID 3480 wrote to memory of 3104	3480	cmd.exe	84
PID 3480 wrote to memory of 3104	3480	cmd.exe	84
PID 412 wrote to memory of 1644	412	msiexec.exe	85
PID 412 wrote to memory of 1644	412	msiexec.exe	85
PID 412 wrote to memory of 1644	412	msiexec.exe	85
PID 1644 wrote to memory of 2076	1644	cmd.exe	87
PID 1644 wrote to memory of 2076	1644	cmd.exe	87
PID 1644 wrote to memory of 2076	1644	cmd.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\june29.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\june29.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3896
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Blacklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:412
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c ipconfig /all
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1168
    - - C:\Windows\SysWOW64\ipconfig.exe
        
        ipconfig /all
        5⤵
        
        PID:1880
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net config workstation
      4⤵
      Suspicious use of WriteProcessMemory
      PID:68
    - - C:\Windows\SysWOW64\net.exe
        
        net config workstation
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4036
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 config workstation
        6⤵
        
        PID:4000
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net view /all
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3480
    - - C:\Windows\SysWOW64\net.exe
        
        net view /all
        5⤵
        Discovers systems in the same network
        
        PID:3104
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net view /all /domain
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1644
    - - C:\Windows\SysWOW64\net.exe
        
        net view /all /domain
        5⤵
        Discovers systems in the same network
        
        PID:2076

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/412-842-0x0000000006D00000-0x0000000006DCB000-memory.dmp

Filesize
812KB

Download
memory/412-1-0x0000000002FC0000-0x0000000002FEB000-memory.dmp

Filesize
172KB

Download