Overview

overview

10

Static

static

yn.dll

windows7_x64

10

yn.dll

windows10_x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    09-11-2020 20:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    yn.dll

  • Size

    404KB

  • MD5

    a3d9b510e2e17f4ea08aa9f74b54e6b5

  • SHA1

    78f875eabdca337c3526e52ba324902e7a148ce6

  • SHA256

    a5e798492ba6892a57c79c635679563eceacb6d1efcc38f5dfc0232518861ca8

  • SHA512

    271db785f09d03f33c1931d2482c12ec3a7239125f433caab8c2257c29d7fbd702d9daf1f82c7b5654025a22ee223d92c4140082528ace0412c1b656f0d919c4

Score
10/10
zloadermiguel03/06botnettrojan

Malware Config

Extracted

Family

zloader

Botnet

miguel

Campaign

03/06

C2

https://ticlatchmisrato.tk/wp-parser.php

https://gahotimaskever.ga/wp-parser.php

http://cld.kazgau.com/wp-parser.php

https://cmso.med.cmu.ac.th/wp-parser.php

http://veamor.net/wp-parser.php
rc4.plain
rsa_pubkey.plain

Signatures

  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

    trojanbotnetzloader
  • Blacklisted process makes network request 15 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\yn.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:732
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\yn.dll,#1
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1188
      • C:\Windows\SysWOW64\msiexec.exe
        msiexec.exe
        3⤵
        • Blacklisted process makes network request
        • Suspicious use of AdjustPrivilegeToken
        PID:2024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1188-0-0x0000000000000000-mapping.dmp
    Download
  • memory/2024-1-0x0000000000D10000-0x0000000000D3B000-memory.dmp
    Filesize

    172KB

    Download
  • memory/2024-2-0x0000000000000000-mapping.dmp
    Download