zloader | 1267b822cde1edabfc063458232a5ed9ea03652416de96b8d12ecb1058c86e23

Analysis

Target

t.dll
Size

931KB
MD5

d97340776c76a6a02c7195bdc0a856b7
SHA1

330545c5092c3a991bf1612abc228117f8a64b8f
SHA256

1267b822cde1edabfc063458232a5ed9ea03652416de96b8d12ecb1058c86e23
SHA512

1283f2bc82b5875c27641c5a5a216313442cb861608f7e0edb1978a12bf0b63fe68ce9e8303f8038b13a00b0422c128730eb7d034793d6b8518d63bb6ef0598e

Score

10^/10

Family

zloader

Botnet

miguel

Campaign

26/05

https://cripuntisispoi.tk/wp-parser.php

https://unesrafho.cf/wp-parser.php

http://sannyjewelry.ir/wp-parser.php

http://printgenerator.sundaytimes.lk/wp-parser.php

rc4.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
Blacklisted process makes network request 2 IoCs

Processes:

msiexec.exe

flow pid process

25 1288 msiexec.exe
26 1288 msiexec.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 584 set thread context of 1288 584 rundll32.exe msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeSecurityPrivilege 1288 msiexec.exe
Token: SeSecurityPrivilege 1288 msiexec.exe

flow	pid	process
25	1288	msiexec.exe
26	1288	msiexec.exe

description	pid	process	target process
PID 584 set thread context of 1288	584	rundll32.exe	msiexec.exe

description	pid	process
Token: SeSecurityPrivilege	1288	msiexec.exe
Token: SeSecurityPrivilege	1288	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 3988 wrote to memory of 584	3988	rundll32.exe	rundll32.exe
PID 3988 wrote to memory of 584	3988	rundll32.exe	rundll32.exe
PID 3988 wrote to memory of 584	3988	rundll32.exe	rundll32.exe
PID 584 wrote to memory of 1288	584	rundll32.exe	msiexec.exe
PID 584 wrote to memory of 1288	584	rundll32.exe	msiexec.exe
PID 584 wrote to memory of 1288	584	rundll32.exe	msiexec.exe
PID 584 wrote to memory of 1288	584	rundll32.exe	msiexec.exe
PID 584 wrote to memory of 1288	584	rundll32.exe	msiexec.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\t.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3988

memory/584-0-0x0000000000000000-mapping.dmp

Download
memory/1288-1-0x0000000000AB0000-0x0000000000AE5000-memory.dmp

Filesize
212KB

Download
memory/1288-2-0x0000000000000000-mapping.dmp

Download