zloader | f1987289f7a42f8ef652f6f6504991dbf0cd00a92653c544f67f1f25d4361ffc

Analysis

Target

f1987289f7a42f8ef652f6f6504991dbf0cd00a92653c544f67f1f25d4361ffc.dll
Size

187KB
MD5

561d814286baee1b2e815c06e39d6e4e
SHA1

12defd78c0cd18d77a5ee085684e6e3c26ed42e9
SHA256

f1987289f7a42f8ef652f6f6504991dbf0cd00a92653c544f67f1f25d4361ffc
SHA512

01aa8a343625339321e55b5264a1f7f5c15309eccaaf78964e4e6a37c70416c35f64e874afbbaa5e8481c6687cee7fde3382404a24d920711707b8a5359e420b

Score

10^/10

Family

zloader

Botnet

09/04

https://eoieowo.casa/wp-config.php

https://dcgljuzrb.pw/wp-config.php

rc4.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
Suspicious use of SetThreadContext 1 IoCs

Processes:

regsvr32.exe

description pid process target process

PID 4048 set thread context of 372 4048 regsvr32.exe msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeSecurityPrivilege 372 msiexec.exe
Token: SeSecurityPrivilege 372 msiexec.exe

description	pid	process	target process
PID 4048 set thread context of 372	4048	regsvr32.exe	msiexec.exe

description	pid	process
Token: SeSecurityPrivilege	372	msiexec.exe
Token: SeSecurityPrivilege	372	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 1304 wrote to memory of 4048	1304	regsvr32.exe	regsvr32.exe
PID 1304 wrote to memory of 4048	1304	regsvr32.exe	regsvr32.exe
PID 1304 wrote to memory of 4048	1304	regsvr32.exe	regsvr32.exe
PID 4048 wrote to memory of 372	4048	regsvr32.exe	msiexec.exe
PID 4048 wrote to memory of 372	4048	regsvr32.exe	msiexec.exe
PID 4048 wrote to memory of 372	4048	regsvr32.exe	msiexec.exe
PID 4048 wrote to memory of 372	4048	regsvr32.exe	msiexec.exe
PID 4048 wrote to memory of 372	4048	regsvr32.exe	msiexec.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f1987289f7a42f8ef652f6f6504991dbf0cd00a92653c544f67f1f25d4361ffc.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1304

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:372

memory/372-1-0x0000000000130000-0x0000000000164000-memory.dmp

Filesize
208KB

Download
memory/372-2-0x0000000000000000-mapping.dmp

Download
memory/4048-0-0x0000000000000000-mapping.dmp

Download