zloader | c1532b3d37ff2ec7d70d7f8037b8cdf843d3cdd24adf860f4251d045ddf9d47c

Resubmissions

15/11/2023, 13:29

25/07/2020, 00:15

Target

july22.dll
Size

395KB
MD5

94fa4ef5c63b688a2813e95138198cb4
SHA1

24695fee9af688864a789b0415c19918870fdff5
SHA256

c1532b3d37ff2ec7d70d7f8037b8cdf843d3cdd24adf860f4251d045ddf9d47c
SHA512

e3d83795765e9e1f6c87f33494894260956b86fc7d8455c7ac0eb23c3f4d9c227c6e0358745eba7a87e9ff367d9a19adc257c75c59278d0f968f94eb408bf85c

Score

10^/10

Family

zloader

Botnet

July20SSL

Campaign

July20SSL

https://vlcafxbdjtlvlcduwhga.com/web/post.php

https://softwareserviceupdater3.com/web/post.php

https://softwareserviceupdater4.com/web/post.php

2b4@jfhu#sd43fd!42d

rc4.plain

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 836	900	rundll32.exe	24
PID 900 wrote to memory of 836	900	rundll32.exe	24
PID 900 wrote to memory of 836	900	rundll32.exe	24
PID 900 wrote to memory of 836	900	rundll32.exe	24
PID 900 wrote to memory of 836	900	rundll32.exe	24
PID 900 wrote to memory of 836	900	rundll32.exe	24
PID 900 wrote to memory of 836	900	rundll32.exe	24
PID 836 wrote to memory of 1844	836	rundll32.exe	27
PID 836 wrote to memory of 1844	836	rundll32.exe	27
PID 836 wrote to memory of 1844	836	rundll32.exe	27
PID 836 wrote to memory of 1844	836	rundll32.exe	27
PID 836 wrote to memory of 1844	836	rundll32.exe	27
PID 836 wrote to memory of 1844	836	rundll32.exe	27
PID 836 wrote to memory of 1844	836	rundll32.exe	27
PID 836 wrote to memory of 1844	836	rundll32.exe	27
PID 836 wrote to memory of 1844	836	rundll32.exe	27

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
836	rundll32.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 836 created 1292	836	rundll32.exe	20

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 836 set thread context of 1844	836	rundll32.exe	27

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1292
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\july22.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:900
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\july22.dll,#1
    3⤵
    - Suspicious use of WriteProcessMemory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Suspicious use of SetThreadContext
    PID:836
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1844

memory/1844-1-0x0000000000090000-0x00000000000BB000-memory.dmp

Filesize
172KB

Download
memory/1844-2-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/1844-3-0x0000000000090000-0x00000000000BB000-memory.dmp

Filesize
172KB

Download