zloader | de7da2ce5f2d7e5415bc3256cc5b7f97878ae9436497660b9add78829a8650cf

Resubmissions

15-11-2023 12:50

22-07-2020 17:01

Target

cYNhXOc.dll
Size

395KB
MD5

4aaf7ca556de0be48d9bb5bed405fa88
SHA1

b85f9bf19e02f7756ee4aeb32c41d4b117a75045
SHA256

de7da2ce5f2d7e5415bc3256cc5b7f97878ae9436497660b9add78829a8650cf
SHA512

31911b68c382f04ca332c55274a31a20822b444f51a4ff407901deb686b035e209cf209ab997c03a40341de0ec868e83e701ae0950d577c7aac6f5f654e74c22

Score

10^/10

Family

zloader

Botnet

July20SSL

Campaign

July20SSL

https://vlcafxbdjtlvlcduwhga.com/web/post.php

https://softwareserviceupdater3.com/web/post.php

https://softwareserviceupdater4.com/web/post.php

2b4@jfhu#sd43fd!42d

rc4.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 1064	1072	rundll32.exe	24
PID 1072 wrote to memory of 1064	1072	rundll32.exe	24
PID 1072 wrote to memory of 1064	1072	rundll32.exe	24
PID 1072 wrote to memory of 1064	1072	rundll32.exe	24
PID 1072 wrote to memory of 1064	1072	rundll32.exe	24
PID 1072 wrote to memory of 1064	1072	rundll32.exe	24
PID 1072 wrote to memory of 1064	1072	rundll32.exe	24
PID 1064 wrote to memory of 1528	1064	rundll32.exe	27
PID 1064 wrote to memory of 1528	1064	rundll32.exe	27
PID 1064 wrote to memory of 1528	1064	rundll32.exe	27
PID 1064 wrote to memory of 1528	1064	rundll32.exe	27
PID 1064 wrote to memory of 1528	1064	rundll32.exe	27
PID 1064 wrote to memory of 1528	1064	rundll32.exe	27
PID 1064 wrote to memory of 1528	1064	rundll32.exe	27
PID 1064 wrote to memory of 1528	1064	rundll32.exe	27
PID 1064 wrote to memory of 1528	1064	rundll32.exe	27

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1064	rundll32.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1064 created 1324	1064	rundll32.exe	20

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1064 set thread context of 1528	1064	rundll32.exe	27

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1324
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cYNhXOc.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\cYNhXOc.dll,#1
    3⤵
    - Suspicious use of WriteProcessMemory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Suspicious use of SetThreadContext
    PID:1064
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1528

memory/1528-1-0x00000000000D0000-0x00000000000FB000-memory.dmp

Filesize
172KB

Download
memory/1528-2-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/1528-3-0x00000000000D0000-0x00000000000FB000-memory.dmp

Filesize
172KB

Download