zloader | fa09c9ab2f3fc8d3c6541cb835769792d6bc041ba5aa1d04a22be1608791ad9e

Resubmissions

31-10-2023 10:08

01-08-2020 19:35

Target

SecuriteInfo.com.Trojan.GenericKD.34222957.15631.17502.dll
Size

395KB
MD5

5120008536c0de7bf6030f10377ec8c0
SHA1

778a0fd8c2b307ad1aba4a66fadef2ff3306d5d0
SHA256

fa09c9ab2f3fc8d3c6541cb835769792d6bc041ba5aa1d04a22be1608791ad9e
SHA512

83f151f19a5cada9420040522d21b52943793530e5e43d1e0e47f8b4cc726d4b741663d4c8b8ef03649c1b281cd9c702419cb580abc555317363e7b8d02edb15

Score

10^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

3968 rundll32.exe
3968 rundll32.exe
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 3968 created 3020 3968 rundll32.exe Explorer.EXE
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 3968 set thread context of 416 3968 rundll32.exe msiexec.exe
Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

pid	process
3968	rundll32.exe
3968	rundll32.exe

description	pid	process	target process
PID 3968 created 3020	3968	rundll32.exe	Explorer.EXE

description	pid	process	target process
PID 3968 set thread context of 416	3968	rundll32.exe	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 3100 wrote to memory of 3968	3100	rundll32.exe	rundll32.exe
PID 3100 wrote to memory of 3968	3100	rundll32.exe	rundll32.exe
PID 3100 wrote to memory of 3968	3100	rundll32.exe	rundll32.exe
PID 3968 wrote to memory of 416	3968	rundll32.exe	msiexec.exe
PID 3968 wrote to memory of 416	3968	rundll32.exe	msiexec.exe
PID 3968 wrote to memory of 416	3968	rundll32.exe	msiexec.exe
PID 3968 wrote to memory of 416	3968	rundll32.exe	msiexec.exe
PID 3968 wrote to memory of 416	3968	rundll32.exe	msiexec.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

rundll32.exemsiexec.exe

description pid process

Token: SeDebugPrivilege 3968 rundll32.exe
Token: SeSecurityPrivilege 416 msiexec.exe
Token: SeSecurityPrivilege 416 msiexec.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.34222957.15631.17502.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:3100

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:416

memory/416-1-0x0000000003200000-0x000000000322B000-memory.dmp

Filesize
172KB

Download
memory/416-2-0x0000000000000000-mapping.dmp

Download
memory/3968-0-0x0000000000000000-mapping.dmp

Download