zloader | 13509b3f6aeacb569938cc1baa474beac1c0e6d1ce222ca681d9d463889babac

General

Target

3cf5f3676b792e44749030150a0a0f55.dll
Size

504KB
MD5

3cf5f3676b792e44749030150a0a0f55
SHA1

8af704ed880f4a85dc33779a716187f2c3ba8e99
SHA256

13509b3f6aeacb569938cc1baa474beac1c0e6d1ce222ca681d9d463889babac
SHA512

b103583c441d6012969f176603896808eaf4d114be09c992486b0fef7e2c8abaeb899f15c694189317e3b67fa1c4066bfab79d000244ec6ea2f8989f2666b53b

Score

10^/10

trojan botnet zloader

Malware Config

Extracted

Family

zloader

Botnet

nut

Campaign

14/08

C2

https://girldowcahohorme.tk/wp-parsing.php

http://thegamegolfmagazine.com/wp-parsing.php

http://truvaluconsulting.com/wp-parsing.php

https://blog2.textbookrush.com/wp-parsing.php

https://curiosidadez.com.br/wp-parsing.php

https://nonchothetohear.cf/wp-parsing.php

https://sicupira8.com.br/wp-parsing.php

https://titaniumgamers.com/wp-parsing.php

rc4.plain

rsa_pubkey.plain

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 364 created 1256 364 rundll32.exe Explorer.EXE
Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 364 set thread context of 1964 364 rundll32.exe msiexec.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

364 rundll32.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

rundll32.exemsiexec.exe

description pid process

Token: SeDebugPrivilege 364 rundll32.exe
Token: SeSecurityPrivilege 1964 msiexec.exe
Token: SeSecurityPrivilege 1964 msiexec.exe

description	pid	process	target process
PID 364 created 1256	364	rundll32.exe	Explorer.EXE

description	pid	process	target process
PID 364 set thread context of 1964	364	rundll32.exe	msiexec.exe

pid	process
364	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	364	rundll32.exe
Token: SeSecurityPrivilege	1964	msiexec.exe
Token: SeSecurityPrivilege	1964	msiexec.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1612 wrote to memory of 364	1612	rundll32.exe	rundll32.exe
PID 1612 wrote to memory of 364	1612	rundll32.exe	rundll32.exe
PID 1612 wrote to memory of 364	1612	rundll32.exe	rundll32.exe
PID 1612 wrote to memory of 364	1612	rundll32.exe	rundll32.exe
PID 1612 wrote to memory of 364	1612	rundll32.exe	rundll32.exe
PID 1612 wrote to memory of 364	1612	rundll32.exe	rundll32.exe
PID 1612 wrote to memory of 364	1612	rundll32.exe	rundll32.exe
PID 364 wrote to memory of 1964	364	rundll32.exe	msiexec.exe
PID 364 wrote to memory of 1964	364	rundll32.exe	msiexec.exe
PID 364 wrote to memory of 1964	364	rundll32.exe	msiexec.exe
PID 364 wrote to memory of 1964	364	rundll32.exe	msiexec.exe
PID 364 wrote to memory of 1964	364	rundll32.exe	msiexec.exe
PID 364 wrote to memory of 1964	364	rundll32.exe	msiexec.exe
PID 364 wrote to memory of 1964	364	rundll32.exe	msiexec.exe
PID 364 wrote to memory of 1964	364	rundll32.exe	msiexec.exe
PID 364 wrote to memory of 1964	364	rundll32.exe	msiexec.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1256
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3cf5f3676b792e44749030150a0a0f55.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1612
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\3cf5f3676b792e44749030150a0a0f55.dll,#1
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:364
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/364-0-0x0000000000000000-mapping.dmp

Download
memory/1964-1-0x00000000000D0000-0x00000000000FC000-memory.dmp

Filesize
176KB

Download
memory/1964-2-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/1964-3-0x00000000000D0000-0x00000000000FC000-memory.dmp

Filesize
176KB

Download
memory/1964-4-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing