zloader | c91229d90c423cd5b5bf870cec714e5c956058c62f4b2036607d44f1767c50d2

General

Target

SecuriteInfo.com.Generic.mg.22c1b894002c6ffd.12583.dll
Size

723KB
MD5

22c1b894002c6ffd1fdc2a75b48ddcda
SHA1

5037543f108882d6a0d5b1907d125d40e4126e32
SHA256

c91229d90c423cd5b5bf870cec714e5c956058c62f4b2036607d44f1767c50d2
SHA512

67fe107a5bf13fa041eed46c4477ced5fd1af826cd6fc7e5b0661f3690d1a1eeeb69973ef9ccb50c13bc38740711ad0070daaa4b23ef49c9f28c164a881c4a67

Score

10^/10

trojan botnet zloader

Malware Config

Extracted

Family

zloader

Botnet

bat1k3

Campaign

bat1k3

C2

http://as9897234135.xyz/LKhwojehDgwegSDG/gateJKjdsh.php

http://as9897234135.org/LKhwojehDgwegSDG/gateJKjdsh.php

http://as9897234135.net/LKhwojehDgwegSDG/gateJKjdsh.php

http://as9897234135.in/LKhwojehDgwegSDG/gateJKjdsh.php

http://as9897234135.com/LKhwojehDgwegSDG/gateJKjdsh.php

rc4.plain

rsa_pubkey.plain

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 740 created 1188 740 rundll32.exe Explorer.EXE
Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 740 set thread context of 1524 740 rundll32.exe msiexec.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

740 rundll32.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

rundll32.exemsiexec.exe

description pid process

Token: SeDebugPrivilege 740 rundll32.exe
Token: SeSecurityPrivilege 1524 msiexec.exe
Token: SeSecurityPrivilege 1524 msiexec.exe

description	pid	process	target process
PID 740 created 1188	740	rundll32.exe	Explorer.EXE

description	pid	process	target process
PID 740 set thread context of 1524	740	rundll32.exe	msiexec.exe

pid	process
740	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	740	rundll32.exe
Token: SeSecurityPrivilege	1524	msiexec.exe
Token: SeSecurityPrivilege	1524	msiexec.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1480 wrote to memory of 740	1480	rundll32.exe	rundll32.exe
PID 1480 wrote to memory of 740	1480	rundll32.exe	rundll32.exe
PID 1480 wrote to memory of 740	1480	rundll32.exe	rundll32.exe
PID 1480 wrote to memory of 740	1480	rundll32.exe	rundll32.exe
PID 1480 wrote to memory of 740	1480	rundll32.exe	rundll32.exe
PID 1480 wrote to memory of 740	1480	rundll32.exe	rundll32.exe
PID 1480 wrote to memory of 740	1480	rundll32.exe	rundll32.exe
PID 740 wrote to memory of 1524	740	rundll32.exe	msiexec.exe
PID 740 wrote to memory of 1524	740	rundll32.exe	msiexec.exe
PID 740 wrote to memory of 1524	740	rundll32.exe	msiexec.exe
PID 740 wrote to memory of 1524	740	rundll32.exe	msiexec.exe
PID 740 wrote to memory of 1524	740	rundll32.exe	msiexec.exe
PID 740 wrote to memory of 1524	740	rundll32.exe	msiexec.exe
PID 740 wrote to memory of 1524	740	rundll32.exe	msiexec.exe
PID 740 wrote to memory of 1524	740	rundll32.exe	msiexec.exe
PID 740 wrote to memory of 1524	740	rundll32.exe	msiexec.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1188
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.22c1b894002c6ffd.12583.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.22c1b894002c6ffd.12583.dll,#1
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:740
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/740-0-0x0000000000000000-mapping.dmp

Download
memory/1524-1-0x0000000000090000-0x00000000000BD000-memory.dmp

Filesize
180KB

Download
memory/1524-2-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/1524-3-0x0000000000090000-0x00000000000BD000-memory.dmp

Filesize
180KB

Download
memory/1524-4-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing