zloader | d834cc1a1651687b2fa80f1fd0c2c2b2579834f4cec81cb76dae4f28b5cc7c1f

Analysis

Target

Exampleth.dll
Size

452KB
MD5

1c48729a2cfa0b985e36818822858436
SHA1

19d51e298f43c00af96861f1f6ffaf39132a187d
SHA256

f2e73ee6ab0ad79e0cd537bd856d9e694851912283bca7fb73eb3fc335528353
SHA512

538c1ddd8be6c91f99f5579589877031a89f64743678d3f1f6d3a2b10ff861f76768ff7d8bc7d4d2c7826ab820d2c4ff254eacb60a76fdf7c1af43c9bf72d424

Score

10^/10

Family

zloader

Botnet

miguel

Campaign

17/04

https://lgepubbf.icu/wp-config.php

https://ajvwdjtebb.pw/wp-config.php

rc4.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 916 set thread context of 1180 916 rundll32.exe msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeSecurityPrivilege 1180 msiexec.exe
Token: SeSecurityPrivilege 1180 msiexec.exe

description	pid	process	target process
PID 916 set thread context of 1180	916	rundll32.exe	msiexec.exe

description	pid	process
Token: SeSecurityPrivilege	1180	msiexec.exe
Token: SeSecurityPrivilege	1180	msiexec.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1992 wrote to memory of 916	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 916	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 916	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 916	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 916	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 916	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 916	1992	rundll32.exe	rundll32.exe
PID 916 wrote to memory of 1180	916	rundll32.exe	msiexec.exe
PID 916 wrote to memory of 1180	916	rundll32.exe	msiexec.exe
PID 916 wrote to memory of 1180	916	rundll32.exe	msiexec.exe
PID 916 wrote to memory of 1180	916	rundll32.exe	msiexec.exe
PID 916 wrote to memory of 1180	916	rundll32.exe	msiexec.exe
PID 916 wrote to memory of 1180	916	rundll32.exe	msiexec.exe
PID 916 wrote to memory of 1180	916	rundll32.exe	msiexec.exe
PID 916 wrote to memory of 1180	916	rundll32.exe	msiexec.exe
PID 916 wrote to memory of 1180	916	rundll32.exe	msiexec.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Exampleth.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1992

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1180

memory/916-0-0x0000000000000000-mapping.dmp

Download
memory/1180-1-0x0000000000090000-0x00000000000C4000-memory.dmp

Filesize
208KB

Download
memory/1180-2-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/1180-3-0x0000000000090000-0x00000000000C4000-memory.dmp

Filesize
208KB

Download
memory/1180-4-0x0000000000000000-mapping.dmp

Download
memory/1936-5-0x000007FEF7020000-0x000007FEF729A000-memory.dmp

Filesize
2.5MB

Download