zloader | 19614f57ed86b1305c8e00443ee49f751a62b19df9f1a72f326d939b0fd69e66

Target

batman1.exe
Size

323KB
MD5

afdf2fbc0756ed304d1a33083a5f2b0f
SHA1

f3a25627f925390097a64a84ef34c952fe8af036
SHA256

a947c216ea52ce23457b3babb1e1eb6275cabe2150d3995553e4de4b8c3d97f4
SHA512

1c49e53b21c6cebc7a070667aaf05bc89e1a434270208fb61e54c8d74b8f4f3c70c021567d65e1ae024b16bdddb6f89989434075b9a422f2582d82c861b6ccf1

Score

10^/10

Malware Config

Family

zloader

Botnet

TelegramCrypt

Campaign

AntiAMSIdoc

http://wmwifbajxxbcxmucxmlc.com/post.php

http://pwkqhdgytsshkoibaake.com/post.php

http://snnmnkxdhflwgthqismb.com/post.php

http://iawfqecrwohcxnhwtofa.com/post.php

http://nlbmfsyplohyaicmxhum.com/post.php

http://fvqlkgedqjiqgapudkgq.com/post.php

http://cmmxhurildiigqghlryq.com/post.php

http://nmqsmbiabjdnuushksas.com/post.php

http://fyratyubvflktyyjiqgq.com/post.php

rc4.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
Blacklisted process makes network request 2 IoCs

Processes:

msiexec.exe

flow pid process

9 1420 msiexec.exe
18 1420 msiexec.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

batman1.exe

description pid process target process

PID 1048 set thread context of 1420 1048 batman1.exe msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeSecurityPrivilege 1420 msiexec.exe
Token: SeSecurityPrivilege 1420 msiexec.exe

flow	pid	process
9	1420	msiexec.exe
18	1420	msiexec.exe

description	pid	process	target process
PID 1048 set thread context of 1420	1048	batman1.exe	msiexec.exe

description	pid	process
Token: SeSecurityPrivilege	1420	msiexec.exe
Token: SeSecurityPrivilege	1420	msiexec.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

batman1.exe

description	pid	process	target process
PID 1048 wrote to memory of 1420	1048	batman1.exe	msiexec.exe
PID 1048 wrote to memory of 1420	1048	batman1.exe	msiexec.exe
PID 1048 wrote to memory of 1420	1048	batman1.exe	msiexec.exe
PID 1048 wrote to memory of 1420	1048	batman1.exe	msiexec.exe
PID 1048 wrote to memory of 1420	1048	batman1.exe	msiexec.exe
PID 1048 wrote to memory of 1420	1048	batman1.exe	msiexec.exe
PID 1048 wrote to memory of 1420	1048	batman1.exe	msiexec.exe
PID 1048 wrote to memory of 1420	1048	batman1.exe	msiexec.exe
PID 1048 wrote to memory of 1420	1048	batman1.exe	msiexec.exe

memory/1048-0-0x000000000095B000-0x000000000095C000-memory.dmp

Filesize
4KB

Download
memory/1048-1-0x0000000001E40000-0x0000000001E51000-memory.dmp

Filesize
68KB

Download
memory/1048-2-0x0000000001E40000-0x0000000001E51000-memory.dmp

Filesize
68KB

Download
memory/1420-5-0x0000000000090000-0x00000000000C4000-memory.dmp

Filesize
208KB

Download
memory/1420-6-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/1420-7-0x0000000000090000-0x00000000000C4000-memory.dmp

Filesize
208KB

Download
memory/1420-8-0x0000000000000000-mapping.dmp

Download
memory/1452-9-0x000007FEF77C0000-0x000007FEF7A3A000-memory.dmp

Filesize
2.5MB

Download