zloader | 1db7ceb7b49279e858080a8bd589773871542d86fcca980365fb20eb1fbbc1bf

Analysis

max time kernel
142s
max time network
150s
platform
windows10_x64
resource
win10v200430
submitted
08/07/2020, 13:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PSCavX9M.dll
Size

468KB
MD5

f5e5d82309619334c508544cd9a20e63
SHA1

9820fde0873ec93779f619973544d047a8bd8afb
SHA256

1db7ceb7b49279e858080a8bd589773871542d86fcca980365fb20eb1fbbc1bf
SHA512

85bb57c0eca4855db98f5dda944f2788fde758ac3992409a147fb21a334b0db06ce61e294ff528f868f1517d39e41345c315aa5ddcc7f8ccec49d161bdde00b4

Score

10^/10

trojan botnet zloader

Malware Config

Extracted

Family

zloader

Botnet

kev

Campaign

07/07

https://m.ultimatefitnessholiday.com/wp-parsing.php

https://netinup.it/wp-parsing.php

https://oneolimpio.tech/wp-parsing.php

https://adgersandviho.cf/wp-parsing.php

https://paraben-sticks.com/wp-parsing.php

https://tralsiwheepegangcomp.tk/wp-parsing.php

https://parceirosvendaativa.club/wp-parsing.php

rc4.plain

rsa_pubkey.plain

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1684 created 2952	1684	rundll32.exe	56

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Blacklisted process makes network request 21 IoCs

flow	pid	Process
6	2532	msiexec.exe
7	2532	msiexec.exe
8	2532	msiexec.exe
9	2532	msiexec.exe
10	2532	msiexec.exe
11	2532	msiexec.exe
13	2532	msiexec.exe
15	2532	msiexec.exe
17	2532	msiexec.exe
19	2532	msiexec.exe
21	2532	msiexec.exe
23	2532	msiexec.exe
25	2532	msiexec.exe
27	2532	msiexec.exe
29	2532	msiexec.exe
31	2532	msiexec.exe
33	2532	msiexec.exe
35	2532	msiexec.exe
37	2532	msiexec.exe
38	2532	msiexec.exe
40	2532	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1684 set thread context of 2532	1684	rundll32.exe	73

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1684	rundll32.exe
1684	rundll32.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1684	rundll32.exe
Token: SeSecurityPrivilege	2532	msiexec.exe
Token: SeSecurityPrivilege	2532	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 1684	1612	rundll32.exe	68
PID 1612 wrote to memory of 1684	1612	rundll32.exe	68
PID 1612 wrote to memory of 1684	1612	rundll32.exe	68
PID 1684 wrote to memory of 2532	1684	rundll32.exe	73
PID 1684 wrote to memory of 2532	1684	rundll32.exe	73
PID 1684 wrote to memory of 2532	1684	rundll32.exe	73
PID 1684 wrote to memory of 2532	1684	rundll32.exe	73
PID 1684 wrote to memory of 2532	1684	rundll32.exe	73

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2952
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\PSCavX9M.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1612
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\PSCavX9M.dll,#1
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1684
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe
  2⤵
  - Blacklisted process makes network request
  - Suspicious use of AdjustPrivilegeToken
  PID:2532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2532-1-0x0000000000760000-0x000000000078C000-memory.dmp

Filesize
176KB

Download