zloader | f93cb3cd80e276260d8d31bbd91c975749971fcb92f0aa758120e1d0d774851d

Analysis

Target

slk.dll
Size

647KB
MD5

873982df6031467ba2cbdddcc95087b2
SHA1

d9beed9380355cd36901b057d15614178c534c50
SHA256

f93cb3cd80e276260d8d31bbd91c975749971fcb92f0aa758120e1d0d774851d
SHA512

7b451cb04b0ed83a7854f50263c78da3cbf7ccb68a6ff46f625f8f7d7a13372f1769204d10f378e0f5506fc0573d2d625ec14714e9557d743a03d4522bbc6795

Score

10^/10

Family

zloader

Botnet

bot5

Campaign

bot5

https://militanttra.at/owg.php

rc4.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 3068 set thread context of 3660 3068 rundll32.exe msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeSecurityPrivilege 3660 msiexec.exe
Token: SeSecurityPrivilege 3660 msiexec.exe

description	pid	process	target process
PID 3068 set thread context of 3660	3068	rundll32.exe	msiexec.exe

description	pid	process
Token: SeSecurityPrivilege	3660	msiexec.exe
Token: SeSecurityPrivilege	3660	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 4048 wrote to memory of 3068	4048	rundll32.exe	rundll32.exe
PID 4048 wrote to memory of 3068	4048	rundll32.exe	rundll32.exe
PID 4048 wrote to memory of 3068	4048	rundll32.exe	rundll32.exe
PID 3068 wrote to memory of 3660	3068	rundll32.exe	msiexec.exe
PID 3068 wrote to memory of 3660	3068	rundll32.exe	msiexec.exe
PID 3068 wrote to memory of 3660	3068	rundll32.exe	msiexec.exe
PID 3068 wrote to memory of 3660	3068	rundll32.exe	msiexec.exe
PID 3068 wrote to memory of 3660	3068	rundll32.exe	msiexec.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\slk.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4048

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3660

memory/3068-0-0x0000000000000000-mapping.dmp

Download
memory/3660-1-0x0000000000580000-0x00000000005B7000-memory.dmp

Filesize
220KB

Download
memory/3660-2-0x0000000000000000-mapping.dmp

Download