zloader | c1532b3d37ff2ec7d70d7f8037b8cdf843d3cdd24adf860f4251d045ddf9d47c

Resubmissions

15/11/2023, 13:29

231115-qrppascc7z 10

25/07/2020, 00:15

200725-jw6c5c3brx 10

Analysis

max time kernel
148s
max time network
135s
platform
windows10_x64
resource
win10v200722
submitted
25/07/2020, 00:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

july22.dll
Size

395KB
MD5

94fa4ef5c63b688a2813e95138198cb4
SHA1

24695fee9af688864a789b0415c19918870fdff5
SHA256

c1532b3d37ff2ec7d70d7f8037b8cdf843d3cdd24adf860f4251d045ddf9d47c
SHA512

e3d83795765e9e1f6c87f33494894260956b86fc7d8455c7ac0eb23c3f4d9c227c6e0358745eba7a87e9ff367d9a19adc257c75c59278d0f968f94eb408bf85c

Score

10^/10

trojan botnet zloader

Malware Config

Extracted

Family

zloader

Botnet

July20SSL

Campaign

July20SSL

https://vlcafxbdjtlvlcduwhga.com/web/post.php

https://softwareserviceupdater3.com/web/post.php

https://softwareserviceupdater4.com/web/post.php

2b4@jfhu#sd43fd!42d

rc4.plain

Signatures

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 3920	1468	rundll32.exe	66
PID 1468 wrote to memory of 3920	1468	rundll32.exe	66
PID 1468 wrote to memory of 3920	1468	rundll32.exe	66
PID 3920 wrote to memory of 2608	3920	rundll32.exe	73
PID 3920 wrote to memory of 2608	3920	rundll32.exe	73
PID 3920 wrote to memory of 2608	3920	rundll32.exe	73
PID 3920 wrote to memory of 2608	3920	rundll32.exe	73
PID 3920 wrote to memory of 2608	3920	rundll32.exe	73

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3920	rundll32.exe
Token: SeSecurityPrivilege	2608	msiexec.exe
Token: SeSecurityPrivilege	2608	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3920	rundll32.exe
3920	rundll32.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3920 created 2812	3920	rundll32.exe	56

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3920 set thread context of 2608	3920	rundll32.exe	73

Blacklisted process makes network request 3 IoCs

flow	pid	Process
13	2608	msiexec.exe
15	2608	msiexec.exe
17	2608	msiexec.exe

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2812
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\july22.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\july22.dll,#1
    3⤵
    - Suspicious use of WriteProcessMemory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Suspicious use of SetThreadContext
    PID:3920
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Blacklisted process makes network request
  PID:2608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2608-1-0x0000000000E60000-0x0000000000E8B000-memory.dmp

Filesize
172KB

Download