zloader | d0bef870592d1095d72178c27b2ce81dc94163aa30fa0742d6d428a1485ae459

Target

n4.exe
Size

285KB
MD5

bcdae9f51c056a8bdfda1ab7dd9291f9
SHA1

e25e061296177376ffb63a8679dab6294609d436
SHA256

d0bef870592d1095d72178c27b2ce81dc94163aa30fa0742d6d428a1485ae459
SHA512

06e2843889fdc5106af1e92047f14b49c01b1d6601225083f370fee355d58d7ea1d180ade81fde03d10b752fba0a4096193edfae5360473af5dcd930b67109b9

Score

10^/10

Malware Config

Family

zloader

Botnet

Campaign

https://notsweets.net/LKhwojehDgwegSDG/gateJKjdsh.php

https://olpons.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://karamelliar.org/LKhwojehDgwegSDG/gateJKjdsh.php

https://dogrunn.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://azoraz.net/LKhwojehDgwegSDG/gateJKjdsh.php

rc4.plain

rsa_pubkey.plain

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

n4.exe

description pid process target process

PID 1704 created 1220 1704 n4.exe Explorer.EXE
Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
Blacklisted process makes network request 3 IoCs

Processes:

msiexec.exe

flow pid process

6 1236 msiexec.exe
8 1236 msiexec.exe
9 1236 msiexec.exe
Suspicious use of SetThreadContext 2 IoCs

Processes:

n4.exen4.exe

description pid process target process

PID 288 set thread context of 1704 288 n4.exe n4.exe
PID 1704 set thread context of 1236 1704 n4.exe msiexec.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

n4.exe

pid process

1704 n4.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

n4.exemsiexec.exe

description pid process

Token: SeDebugPrivilege 1704 n4.exe
Token: SeSecurityPrivilege 1236 msiexec.exe
Token: SeSecurityPrivilege 1236 msiexec.exe

description	pid	process	target process
PID 1704 created 1220	1704	n4.exe	Explorer.EXE

description	pid	process	target process
PID 288 set thread context of 1704	288	n4.exe	n4.exe
PID 1704 set thread context of 1236	1704	n4.exe	msiexec.exe

pid	process
1704	n4.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

n4.exen4.exe

description	pid	process	target process
PID 288 wrote to memory of 1704	288	n4.exe	n4.exe
PID 288 wrote to memory of 1704	288	n4.exe	n4.exe
PID 288 wrote to memory of 1704	288	n4.exe	n4.exe
PID 288 wrote to memory of 1704	288	n4.exe	n4.exe
PID 288 wrote to memory of 1704	288	n4.exe	n4.exe
PID 288 wrote to memory of 1704	288	n4.exe	n4.exe
PID 288 wrote to memory of 1704	288	n4.exe	n4.exe
PID 288 wrote to memory of 1704	288	n4.exe	n4.exe
PID 288 wrote to memory of 1704	288	n4.exe	n4.exe
PID 288 wrote to memory of 1704	288	n4.exe	n4.exe
PID 1704 wrote to memory of 1236	1704	n4.exe	msiexec.exe
PID 1704 wrote to memory of 1236	1704	n4.exe	msiexec.exe
PID 1704 wrote to memory of 1236	1704	n4.exe	msiexec.exe
PID 1704 wrote to memory of 1236	1704	n4.exe	msiexec.exe
PID 1704 wrote to memory of 1236	1704	n4.exe	msiexec.exe
PID 1704 wrote to memory of 1236	1704	n4.exe	msiexec.exe
PID 1704 wrote to memory of 1236	1704	n4.exe	msiexec.exe
PID 1704 wrote to memory of 1236	1704	n4.exe	msiexec.exe
PID 1704 wrote to memory of 1236	1704	n4.exe	msiexec.exe

memory/288-0-0x000000000026C000-0x000000000026D000-memory.dmp

Filesize
4KB

Download
memory/288-1-0x0000000002010000-0x0000000002021000-memory.dmp

Filesize
68KB

Download
memory/1236-6-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/1236-5-0x00000000000E0000-0x0000000000106000-memory.dmp

Filesize
152KB

Download
memory/1236-7-0x00000000000E0000-0x0000000000106000-memory.dmp

Filesize
152KB

Download
memory/1236-8-0x0000000000000000-mapping.dmp

Download
memory/1368-9-0x000007FEF7140000-0x000007FEF73BA000-memory.dmp

Filesize
2.5MB

Download
memory/1704-2-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1704-3-0x000000000040FAE0-mapping.dmp

Download
memory/1704-4-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download