zloader | 13509b3f6aeacb569938cc1baa474beac1c0e6d1ce222ca681d9d463889babac

Analysis

Target
3cf5f3676b792e44749030150a0a0f55.dll
Size 504KB
Sample200814-pblknxnw66
SHA256 13509b3f6aeacb569938cc1baa474beac1c0e6d1ce222ca681d9d463889babac
MD5 3cf5f3676b792e44749030150a0a0f55
SHA1 8af704ed880f4a85dc33779a716187f2c3ba8e99
SHA512 b103583c441d6012969f176603896808eaf4d114be09c992486b0fef7e2c8abaeb899f15c694189317e3b67fa1c4066bfab79d000244ec6ea2f8989f2666b53b
MD5 SHA1 SHA512

Score

10^/10

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1476 created 3036	1476	rundll32.exe	56

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1476 set thread context of 2748	1476	rundll32.exe	73

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1476	rundll32.exe
1476	rundll32.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 1476	3288	rundll32.exe	66
PID 3288 wrote to memory of 1476	3288	rundll32.exe	66
PID 3288 wrote to memory of 1476	3288	rundll32.exe	66
PID 1476 wrote to memory of 2748	1476	rundll32.exe	73
PID 1476 wrote to memory of 2748	1476	rundll32.exe	73
PID 1476 wrote to memory of 2748	1476	rundll32.exe	73
PID 1476 wrote to memory of 2748	1476	rundll32.exe	73
PID 1476 wrote to memory of 2748	1476	rundll32.exe	73

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3036
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3cf5f3676b792e44749030150a0a0f55.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3288
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\3cf5f3676b792e44749030150a0a0f55.dll,#1
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1476
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2748

memory/2748-1-0x0000000002D50000-0x0000000002D7C000-memory.dmp

Download