zloader | 1db7ceb7b49279e858080a8bd589773871542d86fcca980365fb20eb1fbbc1bf

General

Target

PSCavX9M.dll
Size

468KB
MD5

f5e5d82309619334c508544cd9a20e63
SHA1

9820fde0873ec93779f619973544d047a8bd8afb
SHA256

1db7ceb7b49279e858080a8bd589773871542d86fcca980365fb20eb1fbbc1bf
SHA512

85bb57c0eca4855db98f5dda944f2788fde758ac3992409a147fb21a334b0db06ce61e294ff528f868f1517d39e41345c315aa5ddcc7f8ccec49d161bdde00b4

Score

10^/10

trojan botnet zloader

Malware Config

Extracted

Family

zloader

Botnet

kev

Campaign

07/07

C2

https://m.ultimatefitnessholiday.com/wp-parsing.php

https://netinup.it/wp-parsing.php

https://oneolimpio.tech/wp-parsing.php

https://adgersandviho.cf/wp-parsing.php

https://paraben-sticks.com/wp-parsing.php

https://tralsiwheepegangcomp.tk/wp-parsing.php

https://parceirosvendaativa.club/wp-parsing.php

rc4.plain

rsa_pubkey.plain

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1228 created 1264	1228	rundll32.exe	20

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Blacklisted process makes network request 28 IoCs

flow	pid	Process
5	1364	msiexec.exe
6	1364	msiexec.exe
7	1364	msiexec.exe
8	1364	msiexec.exe
9	1364	msiexec.exe
10	1364	msiexec.exe
12	1364	msiexec.exe
14	1364	msiexec.exe
16	1364	msiexec.exe
17	1364	msiexec.exe
18	1364	msiexec.exe
19	1364	msiexec.exe
20	1364	msiexec.exe
21	1364	msiexec.exe
22	1364	msiexec.exe
23	1364	msiexec.exe
24	1364	msiexec.exe
25	1364	msiexec.exe
26	1364	msiexec.exe
28	1364	msiexec.exe
30	1364	msiexec.exe
32	1364	msiexec.exe
34	1364	msiexec.exe
36	1364	msiexec.exe
38	1364	msiexec.exe
40	1364	msiexec.exe
42	1364	msiexec.exe
43	1364	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1228 set thread context of 1364	1228	rundll32.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1228	rundll32.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1228	rundll32.exe
Token: SeSecurityPrivilege	1364	msiexec.exe
Token: SeSecurityPrivilege	1364	msiexec.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 1228	1100	rundll32.exe	24
PID 1100 wrote to memory of 1228	1100	rundll32.exe	24
PID 1100 wrote to memory of 1228	1100	rundll32.exe	24
PID 1100 wrote to memory of 1228	1100	rundll32.exe	24
PID 1100 wrote to memory of 1228	1100	rundll32.exe	24
PID 1100 wrote to memory of 1228	1100	rundll32.exe	24
PID 1100 wrote to memory of 1228	1100	rundll32.exe	24
PID 1228 wrote to memory of 1364	1228	rundll32.exe	27
PID 1228 wrote to memory of 1364	1228	rundll32.exe	27
PID 1228 wrote to memory of 1364	1228	rundll32.exe	27
PID 1228 wrote to memory of 1364	1228	rundll32.exe	27
PID 1228 wrote to memory of 1364	1228	rundll32.exe	27
PID 1228 wrote to memory of 1364	1228	rundll32.exe	27
PID 1228 wrote to memory of 1364	1228	rundll32.exe	27
PID 1228 wrote to memory of 1364	1228	rundll32.exe	27
PID 1228 wrote to memory of 1364	1228	rundll32.exe	27

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1264
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\PSCavX9M.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\PSCavX9M.dll,#1
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1228
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe
  2⤵
  - Blacklisted process makes network request
  - Suspicious use of AdjustPrivilegeToken
  PID:1364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1364-1-0x00000000000D0000-0x00000000000FC000-memory.dmp

Filesize
176KB

Download
memory/1364-2-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/1364-3-0x00000000000D0000-0x00000000000FC000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing