zloader | 207465ded4b4538b319e22188fdcfe0f42480386e77be00582192b58dcd7e0ac

Analysis

Target

slk.dll
Size

664KB
MD5

ca726cc5232ba8ea7c241db090e0b659
SHA1

9a68634ee3351317b44ff6a8db0adf1bcd8ee0fb
SHA256

207465ded4b4538b319e22188fdcfe0f42480386e77be00582192b58dcd7e0ac
SHA512

7157f93c91697b7f1603016843340fac170d5b56bd5fc5be7332caff9d7686f9a51a0b13d7f1394c4803fe812517f0b1f0536f6290059c8bcdebdf997b6b656b

Score

10^/10

Family

zloader

Botnet

bot5

Campaign

bot5

https://militanttra.at/owg.php

rc4.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 1716 set thread context of 2544 1716 rundll32.exe msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeSecurityPrivilege 2544 msiexec.exe
Token: SeSecurityPrivilege 2544 msiexec.exe

description	pid	process	target process
PID 1716 set thread context of 2544	1716	rundll32.exe	msiexec.exe

description	pid	process
Token: SeSecurityPrivilege	2544	msiexec.exe
Token: SeSecurityPrivilege	2544	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1304 wrote to memory of 1716	1304	rundll32.exe	rundll32.exe
PID 1304 wrote to memory of 1716	1304	rundll32.exe	rundll32.exe
PID 1304 wrote to memory of 1716	1304	rundll32.exe	rundll32.exe
PID 1716 wrote to memory of 2544	1716	rundll32.exe	msiexec.exe
PID 1716 wrote to memory of 2544	1716	rundll32.exe	msiexec.exe
PID 1716 wrote to memory of 2544	1716	rundll32.exe	msiexec.exe
PID 1716 wrote to memory of 2544	1716	rundll32.exe	msiexec.exe
PID 1716 wrote to memory of 2544	1716	rundll32.exe	msiexec.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\slk.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1304

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2544

memory/1716-0-0x0000000000000000-mapping.dmp

Download
memory/2544-1-0x0000000000320000-0x0000000000357000-memory.dmp

Filesize
220KB

Download
memory/2544-2-0x0000000000000000-mapping.dmp

Download