zloader | addc39012bef78e54cb55e815b64c3ff93688e9925554b412a9247179faec943

General

Target

addc39012bef78e54cb55e815b64c3ff93688e9925554b412a9247179faec943.bin.dll
Size

421KB
MD5

0ecf9c3eefec1f74a8530c5e5ca6e830
SHA1

966a5296db721f09dac820506200e7086526c09f
SHA256

addc39012bef78e54cb55e815b64c3ff93688e9925554b412a9247179faec943
SHA512

b0ffa1ff13850759b98eb68cc9429e9f0e13eccc2ebfb70ad670ab591f8c8b25315247ae7bf3f866cd134a35901eb03e57304beb402af019995a74c78dc66792

Score

10^/10

trojan botnet zloader

Malware Config

Extracted

Family

zloader

Botnet

vek

Campaign

07/09

C2

https://hepgul.net/wp-parsing.php

https://jggourmet.com.br/wp-parsing.php

https://kokono.vn/wp-parsing.php

https://lacylisute.cf/wp-parsing.php

https://liftmais.com.br/wp-parsing.php

https://lightsourcegp.com/wp-parsing.php

https://livrosaborbrasil.com/wp-parsing.php

https://flatetinsirosearch.cf/wp-parsing.php

https://maiscroche.online/wp-parsing.php

rc4.plain

rsa_pubkey.plain

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 3292 created 2972 3292 rundll32.exe Explorer.EXE
Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
Blacklisted process makes network request 7 IoCs

Processes:

msiexec.exe

flow pid process

15 1672 msiexec.exe
17 1672 msiexec.exe
19 1672 msiexec.exe
21 1672 msiexec.exe
22 1672 msiexec.exe
23 1672 msiexec.exe
24 1672 msiexec.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 3292 set thread context of 1672 3292 rundll32.exe msiexec.exe
Drops file in Windows directory 1 IoCs

Processes:

svchost.exe

description ioc process

File opened for modification C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat svchost.exe

description	pid	process	target process
PID 3292 created 2972	3292	rundll32.exe	Explorer.EXE

flow	pid	process
15	1672	msiexec.exe
17	1672	msiexec.exe
19	1672	msiexec.exe
21	1672	msiexec.exe
22	1672	msiexec.exe
23	1672	msiexec.exe
24	1672	msiexec.exe

description	pid	process	target process
PID 3292 set thread context of 1672	3292	rundll32.exe	msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

Modifies data under HKEY_USERS 6 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = cd3c30c07e86d601	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = f06a98117f86d601	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

3292 rundll32.exe
3292 rundll32.exe

pid	process
3292	rundll32.exe
3292	rundll32.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

svchost.exerundll32.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	1960	svchost.exe
Token: SeCreatePagefilePrivilege	1960	svchost.exe
Token: SeDebugPrivilege	3292	rundll32.exe
Token: SeSecurityPrivilege	1672	msiexec.exe
Token: SeSecurityPrivilege	1672	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 3840 wrote to memory of 3292	3840	rundll32.exe	rundll32.exe
PID 3840 wrote to memory of 3292	3840	rundll32.exe	rundll32.exe
PID 3840 wrote to memory of 3292	3840	rundll32.exe	rundll32.exe
PID 3292 wrote to memory of 1672	3292	rundll32.exe	msiexec.exe
PID 3292 wrote to memory of 1672	3292	rundll32.exe	msiexec.exe
PID 3292 wrote to memory of 1672	3292	rundll32.exe	msiexec.exe
PID 3292 wrote to memory of 1672	3292	rundll32.exe	msiexec.exe
PID 3292 wrote to memory of 1672	3292	rundll32.exe	msiexec.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2972

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\addc39012bef78e54cb55e815b64c3ff93688e9925554b412a9247179faec943.bin.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:3840

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\addc39012bef78e54cb55e815b64c3ff93688e9925554b412a9247179faec943.bin.dll,#1
3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3292

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
2⤵
- Blacklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:1672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1672-1-0x0000000000130000-0x000000000015C000-memory.dmp

Filesize
176KB

Download
memory/1672-2-0x0000000000000000-mapping.dmp

Download
memory/3292-0-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads