zloader | f28dd082013ee7df2f5956c4e8791e863e575aa64071af9a910826bc12d27acb

General

Target

9TE15.dll
Size

433KB
MD5

89fbc889caf9e9015b1ee438d1e2f907
SHA1

71fac1254ea1757a88f76a589a575b5e7ba011e9
SHA256

f28dd082013ee7df2f5956c4e8791e863e575aa64071af9a910826bc12d27acb
SHA512

3ae5e9896dc732f4fe28bb6dc2fc2410702dd4e80cd72cfda6111bd7b2e6ae9ff3447c9024f15af7a640e538af0eb5aed1733421f1c5cd9aabd640325cfb8af6

Score

10^/10

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 3576 created 2992 3576 rundll32.exe Explorer.EXE
Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

description	pid	process	target process
PID 3576 created 2992	3576	rundll32.exe	Explorer.EXE

Blacklisted process makes network request 37 IoCs

Processes:

msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 3576 set thread context of 2188 3576 rundll32.exe msiexec.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

3576 rundll32.exe
3576 rundll32.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

rundll32.exemsiexec.exe

description pid process

Token: SeDebugPrivilege 3576 rundll32.exe
Token: SeSecurityPrivilege 2188 msiexec.exe
Token: SeSecurityPrivilege 2188 msiexec.exe

description	pid	process	target process
PID 3576 set thread context of 2188	3576	rundll32.exe	msiexec.exe

pid	process
3576	rundll32.exe
3576	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1008 wrote to memory of 3576	1008	rundll32.exe	rundll32.exe
PID 1008 wrote to memory of 3576	1008	rundll32.exe	rundll32.exe
PID 1008 wrote to memory of 3576	1008	rundll32.exe	rundll32.exe
PID 3576 wrote to memory of 2188	3576	rundll32.exe	msiexec.exe
PID 3576 wrote to memory of 2188	3576	rundll32.exe	msiexec.exe
PID 3576 wrote to memory of 2188	3576	rundll32.exe	msiexec.exe
PID 3576 wrote to memory of 2188	3576	rundll32.exe	msiexec.exe
PID 3576 wrote to memory of 2188	3576	rundll32.exe	msiexec.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9TE15.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1008

memory/2188-1-0x0000000003210000-0x000000000323C000-memory.dmp

Filesize
176KB

Download
memory/2188-2-0x0000000000000000-mapping.dmp

Download
memory/3576-0-0x0000000000000000-mapping.dmp

Download