zloader | 783dace9ccb4090a09e4f3a229eeeef14246709e25175b0ce0fe749cd736de55

Target

d9296a8ed1105c0e7908434a76681299.dll
Size

615KB
MD5

d9296a8ed1105c0e7908434a76681299
SHA1

593bd26bdc829c7633096d016012ceda1183d3f9
SHA256

783dace9ccb4090a09e4f3a229eeeef14246709e25175b0ce0fe749cd736de55
SHA512

18cdfff6d26cca2e09513def3800bab8046c1925ab4aff54cd18d6ea604f5f7315a833acbb7c51f9afdb7ebeca4ee6c9b79a0d315f8c23c12fbb4df83407c52d

Score

10^/10

trojan botnet zloader

Malware Config

Extracted

Family

zloader

Botnet

spx138

Campaign

spx138

https://xeemoquo.top/treusparq.php

https://leeephee.top/treusparq.php

https://withifceale.top/treusparq.php

https://wpsnoum.pw/treusparq.php

https://wsaexdig.pw/treusparq.php

rc4.plain

rsa_pubkey.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Blacklisted process makes network request 3 IoCs

flow	pid	Process
9	1672	msiexec.exe
10	1672	msiexec.exe
13	1672	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1552 set thread context of 1672	1552	rundll32.exe	29

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1672	msiexec.exe
Token: SeSecurityPrivilege	1672	msiexec.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 1552	1604	rundll32.exe	24
PID 1604 wrote to memory of 1552	1604	rundll32.exe	24
PID 1604 wrote to memory of 1552	1604	rundll32.exe	24
PID 1604 wrote to memory of 1552	1604	rundll32.exe	24
PID 1604 wrote to memory of 1552	1604	rundll32.exe	24
PID 1604 wrote to memory of 1552	1604	rundll32.exe	24
PID 1604 wrote to memory of 1552	1604	rundll32.exe	24
PID 1552 wrote to memory of 1672	1552	rundll32.exe	29
PID 1552 wrote to memory of 1672	1552	rundll32.exe	29
PID 1552 wrote to memory of 1672	1552	rundll32.exe	29
PID 1552 wrote to memory of 1672	1552	rundll32.exe	29
PID 1552 wrote to memory of 1672	1552	rundll32.exe	29
PID 1552 wrote to memory of 1672	1552	rundll32.exe	29
PID 1552 wrote to memory of 1672	1552	rundll32.exe	29
PID 1552 wrote to memory of 1672	1552	rundll32.exe	29
PID 1552 wrote to memory of 1672	1552	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d9296a8ed1105c0e7908434a76681299.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d9296a8ed1105c0e7908434a76681299.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1552
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec.exe
    3⤵
    - Blacklisted process makes network request
    - Suspicious use of AdjustPrivilegeToken
    PID:1672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1672-2-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/1672-1-0x0000000000150000-0x000000000017C000-memory.dmp

Filesize
176KB

Download
memory/1672-3-0x0000000000150000-0x000000000017C000-memory.dmp

Filesize
176KB

Download
memory/2016-5-0x000007FEF6530000-0x000007FEF67AA000-memory.dmp

Filesize
2.5MB

Download

Resubmissions

Analysis

Sharing

General