zloader | 13509b3f6aeacb569938cc1baa474beac1c0e6d1ce222ca681d9d463889babac

Analysis

Target

3cf5f3676b792e44749030150a0a0f55.dll
Size

504KB
MD5

3cf5f3676b792e44749030150a0a0f55
SHA1

8af704ed880f4a85dc33779a716187f2c3ba8e99
SHA256

13509b3f6aeacb569938cc1baa474beac1c0e6d1ce222ca681d9d463889babac
SHA512

b103583c441d6012969f176603896808eaf4d114be09c992486b0fef7e2c8abaeb899f15c694189317e3b67fa1c4066bfab79d000244ec6ea2f8989f2666b53b

Score

10^/10

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 1476 created 3036 1476 rundll32.exe Explorer.EXE
Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 1476 set thread context of 2748 1476 rundll32.exe msiexec.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1476 rundll32.exe
1476 rundll32.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

rundll32.exemsiexec.exe

description pid process

Token: SeDebugPrivilege 1476 rundll32.exe
Token: SeSecurityPrivilege 2748 msiexec.exe
Token: SeSecurityPrivilege 2748 msiexec.exe

description	pid	process	target process
PID 1476 created 3036	1476	rundll32.exe	Explorer.EXE

description	pid	process	target process
PID 1476 set thread context of 2748	1476	rundll32.exe	msiexec.exe

pid	process
1476	rundll32.exe
1476	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 3288 wrote to memory of 1476	3288	rundll32.exe	rundll32.exe
PID 3288 wrote to memory of 1476	3288	rundll32.exe	rundll32.exe
PID 3288 wrote to memory of 1476	3288	rundll32.exe	rundll32.exe
PID 1476 wrote to memory of 2748	1476	rundll32.exe	msiexec.exe
PID 1476 wrote to memory of 2748	1476	rundll32.exe	msiexec.exe
PID 1476 wrote to memory of 2748	1476	rundll32.exe	msiexec.exe
PID 1476 wrote to memory of 2748	1476	rundll32.exe	msiexec.exe
PID 1476 wrote to memory of 2748	1476	rundll32.exe	msiexec.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3036
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3cf5f3676b792e44749030150a0a0f55.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3288
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\3cf5f3676b792e44749030150a0a0f55.dll,#1
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1476
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2748

memory/1476-0-0x0000000000000000-mapping.dmp

Download
memory/2748-1-0x0000000002D50000-0x0000000002D7C000-memory.dmp

Filesize
176KB

Download
memory/2748-2-0x0000000000000000-mapping.dmp

Download