zloader | 385be4267e9aaadfb82815d54dde7fccbd0d1b843aa3c4062ef752a9378ae02e

Analysis

Target

a.dll
Size

970KB
MD5

dd1900c39145034cc7e78e3ef8bfc2a8
SHA1

5597ab4de1ceed30abd713b17ed3ff35c14ea86b
SHA256

385be4267e9aaadfb82815d54dde7fccbd0d1b843aa3c4062ef752a9378ae02e
SHA512

374d4511bde3632a8e875566390e26896bf17e379d4c3a482e07154e1f7536807ac9234f4a25a1b627a7d8603ce722705793f3a868480ef75307712b1d586359

Score

10^/10

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 360 set thread context of 4068 360 rundll32.exe msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeSecurityPrivilege 4068 msiexec.exe
Token: SeSecurityPrivilege 4068 msiexec.exe

description	pid	process	target process
PID 360 set thread context of 4068	360	rundll32.exe	msiexec.exe

description	pid	process
Token: SeSecurityPrivilege	4068	msiexec.exe
Token: SeSecurityPrivilege	4068	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 728 wrote to memory of 360	728	rundll32.exe	rundll32.exe
PID 728 wrote to memory of 360	728	rundll32.exe	rundll32.exe
PID 728 wrote to memory of 360	728	rundll32.exe	rundll32.exe
PID 360 wrote to memory of 4068	360	rundll32.exe	msiexec.exe
PID 360 wrote to memory of 4068	360	rundll32.exe	msiexec.exe
PID 360 wrote to memory of 4068	360	rundll32.exe	msiexec.exe
PID 360 wrote to memory of 4068	360	rundll32.exe	msiexec.exe
PID 360 wrote to memory of 4068	360	rundll32.exe	msiexec.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:728

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4068

memory/360-0-0x0000000000000000-mapping.dmp

Download
memory/4068-1-0x0000000003200000-0x0000000003235000-memory.dmp

Filesize
212KB

Download
memory/4068-2-0x0000000000000000-mapping.dmp

Download