zloader | f93cb3cd80e276260d8d31bbd91c975749971fcb92f0aa758120e1d0d774851d

Analysis

Target

slk.dll
Size

647KB
MD5

873982df6031467ba2cbdddcc95087b2
SHA1

d9beed9380355cd36901b057d15614178c534c50
SHA256

f93cb3cd80e276260d8d31bbd91c975749971fcb92f0aa758120e1d0d774851d
SHA512

7b451cb04b0ed83a7854f50263c78da3cbf7ccb68a6ff46f625f8f7d7a13372f1769204d10f378e0f5506fc0573d2d625ec14714e9557d743a03d4522bbc6795

Score

10^/10

Family

zloader

Botnet

bot5

Campaign

bot5

https://militanttra.at/owg.php

rc4.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 1644 set thread context of 1288 1644 rundll32.exe msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeSecurityPrivilege 1288 msiexec.exe
Token: SeSecurityPrivilege 1288 msiexec.exe

description	pid	process	target process
PID 1644 set thread context of 1288	1644	rundll32.exe	msiexec.exe

description	pid	process
Token: SeSecurityPrivilege	1288	msiexec.exe
Token: SeSecurityPrivilege	1288	msiexec.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1004 wrote to memory of 1644	1004	rundll32.exe	rundll32.exe
PID 1004 wrote to memory of 1644	1004	rundll32.exe	rundll32.exe
PID 1004 wrote to memory of 1644	1004	rundll32.exe	rundll32.exe
PID 1004 wrote to memory of 1644	1004	rundll32.exe	rundll32.exe
PID 1004 wrote to memory of 1644	1004	rundll32.exe	rundll32.exe
PID 1004 wrote to memory of 1644	1004	rundll32.exe	rundll32.exe
PID 1004 wrote to memory of 1644	1004	rundll32.exe	rundll32.exe
PID 1644 wrote to memory of 1288	1644	rundll32.exe	msiexec.exe
PID 1644 wrote to memory of 1288	1644	rundll32.exe	msiexec.exe
PID 1644 wrote to memory of 1288	1644	rundll32.exe	msiexec.exe
PID 1644 wrote to memory of 1288	1644	rundll32.exe	msiexec.exe
PID 1644 wrote to memory of 1288	1644	rundll32.exe	msiexec.exe
PID 1644 wrote to memory of 1288	1644	rundll32.exe	msiexec.exe
PID 1644 wrote to memory of 1288	1644	rundll32.exe	msiexec.exe
PID 1644 wrote to memory of 1288	1644	rundll32.exe	msiexec.exe
PID 1644 wrote to memory of 1288	1644	rundll32.exe	msiexec.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\slk.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1004

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1288

memory/1288-1-0x00000000000D0000-0x0000000000107000-memory.dmp

Filesize
220KB

Download
memory/1288-2-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/1288-3-0x00000000000D0000-0x0000000000107000-memory.dmp

Filesize
220KB

Download
memory/1288-4-0x0000000000000000-mapping.dmp

Download
memory/1644-0-0x0000000000000000-mapping.dmp

Download
memory/1708-5-0x000007FEF7160000-0x000007FEF73DA000-memory.dmp

Filesize
2.5MB

Download