zloader | 385be4267e9aaadfb82815d54dde7fccbd0d1b843aa3c4062ef752a9378ae02e

Analysis

max time kernel
106s
max time network
8s
platform
windows7_x64
resource
win7v20201028
submitted
09-11-2020 20:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a.dll
Size

970KB
MD5

dd1900c39145034cc7e78e3ef8bfc2a8
SHA1

5597ab4de1ceed30abd713b17ed3ff35c14ea86b
SHA256

385be4267e9aaadfb82815d54dde7fccbd0d1b843aa3c4062ef752a9378ae02e
SHA512

374d4511bde3632a8e875566390e26896bf17e379d4c3a482e07154e1f7536807ac9234f4a25a1b627a7d8603ce722705793f3a868480ef75307712b1d586359

Score

10^/10

zloader miguel 25/05 botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

miguel

Campaign

25/05

https://tentrhetarav.gq/wp-parser.php

https://slidirinisprec.ml/wp-parser.php

https://iedison.vip/wp-parser.php

https://financiallifecoaching.com/wp-parser.php

https://fly2go.cn/wp-parser.php

rc4.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 1656 set thread context of 2012 1656 rundll32.exe msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeSecurityPrivilege 2012 msiexec.exe
Token: SeSecurityPrivilege 2012 msiexec.exe

description	pid	process	target process
PID 1656 set thread context of 2012	1656	rundll32.exe	msiexec.exe

description	pid	process
Token: SeSecurityPrivilege	2012	msiexec.exe
Token: SeSecurityPrivilege	2012	msiexec.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1668 wrote to memory of 1656	1668	rundll32.exe	rundll32.exe
PID 1668 wrote to memory of 1656	1668	rundll32.exe	rundll32.exe
PID 1668 wrote to memory of 1656	1668	rundll32.exe	rundll32.exe
PID 1668 wrote to memory of 1656	1668	rundll32.exe	rundll32.exe
PID 1668 wrote to memory of 1656	1668	rundll32.exe	rundll32.exe
PID 1668 wrote to memory of 1656	1668	rundll32.exe	rundll32.exe
PID 1668 wrote to memory of 1656	1668	rundll32.exe	rundll32.exe
PID 1656 wrote to memory of 2012	1656	rundll32.exe	msiexec.exe
PID 1656 wrote to memory of 2012	1656	rundll32.exe	msiexec.exe
PID 1656 wrote to memory of 2012	1656	rundll32.exe	msiexec.exe
PID 1656 wrote to memory of 2012	1656	rundll32.exe	msiexec.exe
PID 1656 wrote to memory of 2012	1656	rundll32.exe	msiexec.exe
PID 1656 wrote to memory of 2012	1656	rundll32.exe	msiexec.exe
PID 1656 wrote to memory of 2012	1656	rundll32.exe	msiexec.exe
PID 1656 wrote to memory of 2012	1656	rundll32.exe	msiexec.exe
PID 1656 wrote to memory of 2012	1656	rundll32.exe	msiexec.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1668

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a.dll,#1
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1656

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2012

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1656-0-0x0000000000000000-mapping.dmp

Download
memory/2012-2-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download
memory/2012-1-0x0000000000090000-0x00000000000C5000-memory.dmp

Filesize
212KB

Download
memory/2012-3-0x0000000000090000-0x00000000000C5000-memory.dmp

Filesize
212KB

Download
memory/2012-4-0x0000000000000000-mapping.dmp

Download