zloader | 0573d56a84aac658edac1e93d08390c1a8378ed2d801b2460ac89a8ef643eb7d

Analysis

Target

SecuriteInfo.com.Variant.Zusy.307926.22904.26447.dll
Size

579KB
MD5

1bd992ee2bddba2ac275719624e52c05
SHA1

97cb4429abb8825772a52edebcbaf06a8f9b5308
SHA256

0573d56a84aac658edac1e93d08390c1a8378ed2d801b2460ac89a8ef643eb7d
SHA512

0d50462d485bad5d62bfc0d4304dfc7fd33621d6546b387c8cd501c9605b49a80c4bc4f3e888592daa359c056ad98553554d6f19382ea9ac3f7efda2406893a5

Score

10^/10

Blacklisted process makes network request 16 IoCs

Processes:

msiexec.exe

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 3656 wrote to memory of 3768	3656	rundll32.exe	rundll32.exe
PID 3656 wrote to memory of 3768	3656	rundll32.exe	rundll32.exe
PID 3656 wrote to memory of 3768	3656	rundll32.exe	rundll32.exe
PID 3768 wrote to memory of 2512	3768	rundll32.exe	msiexec.exe
PID 3768 wrote to memory of 2512	3768	rundll32.exe	msiexec.exe
PID 3768 wrote to memory of 2512	3768	rundll32.exe	msiexec.exe
PID 3768 wrote to memory of 2512	3768	rundll32.exe	msiexec.exe
PID 3768 wrote to memory of 2512	3768	rundll32.exe	msiexec.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

rundll32.exemsiexec.exe

description pid process

Token: SeDebugPrivilege 3768 rundll32.exe
Token: SeSecurityPrivilege 2512 msiexec.exe
Token: SeSecurityPrivilege 2512 msiexec.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

3768 rundll32.exe
3768 rundll32.exe
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 3768 created 3012 3768 rundll32.exe Explorer.EXE
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 3768 set thread context of 2512 3768 rundll32.exe msiexec.exe

pid	process
3768	rundll32.exe
3768	rundll32.exe

description	pid	process	target process
PID 3768 created 3012	3768	rundll32.exe	Explorer.EXE

description	pid	process	target process
PID 3768 set thread context of 2512	3768	rundll32.exe	msiexec.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Zusy.307926.22904.26447.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:3656

memory/2512-1-0x0000000002900000-0x000000000292C000-memory.dmp

Filesize
176KB

Download
memory/2512-2-0x0000000000000000-mapping.dmp

Download
memory/3768-0-0x0000000000000000-mapping.dmp

Download