zloader | fa09c9ab2f3fc8d3c6541cb835769792d6bc041ba5aa1d04a22be1608791ad9e

Resubmissions

31-10-2023 10:08

01-08-2020 19:35

Target

SecuriteInfo.com.Trojan.GenericKD.34222957.15631.17502.dll
Size

395KB
MD5

5120008536c0de7bf6030f10377ec8c0
SHA1

778a0fd8c2b307ad1aba4a66fadef2ff3306d5d0
SHA256

fa09c9ab2f3fc8d3c6541cb835769792d6bc041ba5aa1d04a22be1608791ad9e
SHA512

83f151f19a5cada9420040522d21b52943793530e5e43d1e0e47f8b4cc726d4b741663d4c8b8ef03649c1b281cd9c702419cb580abc555317363e7b8d02edb15

Score

10^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3968	rundll32.exe
3968	rundll32.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3968 created 3020	3968	rundll32.exe	56

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3968 set thread context of 416	3968	rundll32.exe	74

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 3968	3100	rundll32.exe	67
PID 3100 wrote to memory of 3968	3100	rundll32.exe	67
PID 3100 wrote to memory of 3968	3100	rundll32.exe	67
PID 3968 wrote to memory of 416	3968	rundll32.exe	74
PID 3968 wrote to memory of 416	3968	rundll32.exe	74
PID 3968 wrote to memory of 416	3968	rundll32.exe	74
PID 3968 wrote to memory of 416	3968	rundll32.exe	74
PID 3968 wrote to memory of 416	3968	rundll32.exe	74

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3020
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.34222957.15631.17502.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3100
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.34222957.15631.17502.dll,#1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    - Suspicious use of AdjustPrivilegeToken
    PID:3968
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:416

memory/416-1-0x0000000003200000-0x000000000322B000-memory.dmp

Filesize
172KB

Download