zloader | f28dd082013ee7df2f5956c4e8791e863e575aa64071af9a910826bc12d27acb

General

Target

9TE15.dll
Size

433KB
MD5

89fbc889caf9e9015b1ee438d1e2f907
SHA1

71fac1254ea1757a88f76a589a575b5e7ba011e9
SHA256

f28dd082013ee7df2f5956c4e8791e863e575aa64071af9a910826bc12d27acb
SHA512

3ae5e9896dc732f4fe28bb6dc2fc2410702dd4e80cd72cfda6111bd7b2e6ae9ff3447c9024f15af7a640e538af0eb5aed1733421f1c5cd9aabd640325cfb8af6

Score

10^/10

trojan botnet zloader

Malware Config

Extracted

Family

zloader

Botnet

nut

Campaign

06/07

C2

https://acrilicossp.com.br/wp-parsing.php

https://neterscunverssuf.gq/wp-parsing.php

https://afdah2.com/wp-parsing.php

https://ajacademys.com/wp-parsing.php

https://aydninsaat.com/wp-parsing.php

https://bludelego.it/wp-parsing.php

https://chwasinsvolanrosti.gq/wp-parsing.php

https://bnegg.vn/wp-parsing.php

rc4.plain

rsa_pubkey.plain

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 1328 created 1336 1328 rundll32.exe Explorer.EXE
Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

description	pid	process	target process
PID 1328 created 1336	1328	rundll32.exe	Explorer.EXE

Blacklisted process makes network request 24 IoCs

Processes:

msiexec.exe

flow	pid	process
6	1828	msiexec.exe
7	1828	msiexec.exe
8	1828	msiexec.exe
9	1828	msiexec.exe
10	1828	msiexec.exe
11	1828	msiexec.exe
14	1828	msiexec.exe
15	1828	msiexec.exe
16	1828	msiexec.exe
17	1828	msiexec.exe
18	1828	msiexec.exe
19	1828	msiexec.exe
21	1828	msiexec.exe
22	1828	msiexec.exe
23	1828	msiexec.exe
24	1828	msiexec.exe
25	1828	msiexec.exe
26	1828	msiexec.exe
28	1828	msiexec.exe
30	1828	msiexec.exe
33	1828	msiexec.exe
35	1828	msiexec.exe
36	1828	msiexec.exe
37	1828	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 1328 set thread context of 1828 1328 rundll32.exe msiexec.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

1328 rundll32.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

rundll32.exemsiexec.exe

description pid process

Token: SeDebugPrivilege 1328 rundll32.exe
Token: SeSecurityPrivilege 1828 msiexec.exe
Token: SeSecurityPrivilege 1828 msiexec.exe

description	pid	process	target process
PID 1328 set thread context of 1828	1328	rundll32.exe	msiexec.exe

pid	process
1328	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	1328	rundll32.exe
Token: SeSecurityPrivilege	1828	msiexec.exe
Token: SeSecurityPrivilege	1828	msiexec.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1164 wrote to memory of 1328	1164	rundll32.exe	rundll32.exe
PID 1164 wrote to memory of 1328	1164	rundll32.exe	rundll32.exe
PID 1164 wrote to memory of 1328	1164	rundll32.exe	rundll32.exe
PID 1164 wrote to memory of 1328	1164	rundll32.exe	rundll32.exe
PID 1164 wrote to memory of 1328	1164	rundll32.exe	rundll32.exe
PID 1164 wrote to memory of 1328	1164	rundll32.exe	rundll32.exe
PID 1164 wrote to memory of 1328	1164	rundll32.exe	rundll32.exe
PID 1328 wrote to memory of 1828	1328	rundll32.exe	msiexec.exe
PID 1328 wrote to memory of 1828	1328	rundll32.exe	msiexec.exe
PID 1328 wrote to memory of 1828	1328	rundll32.exe	msiexec.exe
PID 1328 wrote to memory of 1828	1328	rundll32.exe	msiexec.exe
PID 1328 wrote to memory of 1828	1328	rundll32.exe	msiexec.exe
PID 1328 wrote to memory of 1828	1328	rundll32.exe	msiexec.exe
PID 1328 wrote to memory of 1828	1328	rundll32.exe	msiexec.exe
PID 1328 wrote to memory of 1828	1328	rundll32.exe	msiexec.exe
PID 1328 wrote to memory of 1828	1328	rundll32.exe	msiexec.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1336

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9TE15.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1164

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9TE15.dll,#1
3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1328

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
2⤵
- Blacklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:1828

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1328-0-0x0000000000000000-mapping.dmp

Download
memory/1828-1-0x0000000000090000-0x00000000000BC000-memory.dmp

Filesize
176KB

Download
memory/1828-2-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/1828-3-0x0000000000090000-0x00000000000BC000-memory.dmp

Filesize
176KB

Download
memory/1828-4-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing