zloader | a5e798492ba6892a57c79c635679563eceacb6d1efcc38f5dfc0232518861ca8

General

Target

yn.dll
Size

404KB
MD5

a3d9b510e2e17f4ea08aa9f74b54e6b5
SHA1

78f875eabdca337c3526e52ba324902e7a148ce6
SHA256

a5e798492ba6892a57c79c635679563eceacb6d1efcc38f5dfc0232518861ca8
SHA512

271db785f09d03f33c1931d2482c12ec3a7239125f433caab8c2257c29d7fbd702d9daf1f82c7b5654025a22ee223d92c4140082528ace0412c1b656f0d919c4

Score

10^/10

zloader miguel 03/06 botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

miguel

Campaign

03/06

C2

https://ticlatchmisrato.tk/wp-parser.php

https://gahotimaskever.ga/wp-parser.php

http://cld.kazgau.com/wp-parser.php

https://cmso.med.cmu.ac.th/wp-parser.php

http://veamor.net/wp-parser.php

rc4.plain

rsa_pubkey.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Blacklisted process makes network request 13 IoCs

Processes:

msiexec.exe

flow	pid	process
6	1596	msiexec.exe
7	1596	msiexec.exe
8	1596	msiexec.exe
9	1596	msiexec.exe
10	1596	msiexec.exe
11	1596	msiexec.exe
13	1596	msiexec.exe
14	1596	msiexec.exe
15	1596	msiexec.exe
16	1596	msiexec.exe
17	1596	msiexec.exe
18	1596	msiexec.exe
20	1596	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 2012 set thread context of 1596 2012 rundll32.exe msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeSecurityPrivilege 1596 msiexec.exe
Token: SeSecurityPrivilege 1596 msiexec.exe

description	pid	process	target process
PID 2012 set thread context of 1596	2012	rundll32.exe	msiexec.exe

description	pid	process
Token: SeSecurityPrivilege	1596	msiexec.exe
Token: SeSecurityPrivilege	1596	msiexec.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1584 wrote to memory of 2012	1584	rundll32.exe	rundll32.exe
PID 1584 wrote to memory of 2012	1584	rundll32.exe	rundll32.exe
PID 1584 wrote to memory of 2012	1584	rundll32.exe	rundll32.exe
PID 1584 wrote to memory of 2012	1584	rundll32.exe	rundll32.exe
PID 1584 wrote to memory of 2012	1584	rundll32.exe	rundll32.exe
PID 1584 wrote to memory of 2012	1584	rundll32.exe	rundll32.exe
PID 1584 wrote to memory of 2012	1584	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 1596	2012	rundll32.exe	msiexec.exe
PID 2012 wrote to memory of 1596	2012	rundll32.exe	msiexec.exe
PID 2012 wrote to memory of 1596	2012	rundll32.exe	msiexec.exe
PID 2012 wrote to memory of 1596	2012	rundll32.exe	msiexec.exe
PID 2012 wrote to memory of 1596	2012	rundll32.exe	msiexec.exe
PID 2012 wrote to memory of 1596	2012	rundll32.exe	msiexec.exe
PID 2012 wrote to memory of 1596	2012	rundll32.exe	msiexec.exe
PID 2012 wrote to memory of 1596	2012	rundll32.exe	msiexec.exe
PID 2012 wrote to memory of 1596	2012	rundll32.exe	msiexec.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\yn.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1584

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\yn.dll,#1
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2012

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
3⤵
- Blacklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:1596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1060-5-0x000007FEF7F70000-0x000007FEF81EA000-memory.dmp

Filesize
2.5MB

Download
memory/1596-2-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/1596-1-0x00000000000D0000-0x00000000000FB000-memory.dmp

Filesize
172KB

Download
memory/1596-3-0x00000000000D0000-0x00000000000FB000-memory.dmp

Filesize
172KB

Download
memory/1596-4-0x0000000000000000-mapping.dmp

Download
memory/2012-0-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing