zloader | 4480be0491a4e2b03910757fe9ed868736e9b795f07205a66d2bf19253d9b104

Analysis

max time kernel
74s
max time network
102s
platform
windows10_x64
resource
win10v20201028
submitted
10-11-2020 07:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4480be0491a4e2b03910757fe9ed868736e9b795f07205a66d2bf19253d9b104.dll
Size

183KB
MD5

d674bca869b8452501dbe9d467a75c52
SHA1

db637cc185267090764a82a05f16108b9e86f764
SHA256

4480be0491a4e2b03910757fe9ed868736e9b795f07205a66d2bf19253d9b104
SHA512

5aaba2fd5cf4d056fbb65fad52787cc6959b2f037b5de0f173dea96a7ed479193186074c04d6eca05d6252d692e709c4f1d442d6946373a13d4936f741f30c84

Score

10^/10

zloader miguel 08/04 botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

miguel

Campaign

08/04

https://kuaxbdkvbbmivbxkrrev.com/wp-config.php

https://hwbblyyrb.pw/wp-config.php

rc4.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
Suspicious use of SetThreadContext 1 IoCs

Processes:

regsvr32.exe

description pid process target process

PID 2612 set thread context of 1296 2612 regsvr32.exe msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeSecurityPrivilege 1296 msiexec.exe
Token: SeSecurityPrivilege 1296 msiexec.exe

description	pid	process	target process
PID 2612 set thread context of 1296	2612	regsvr32.exe	msiexec.exe

description	pid	process
Token: SeSecurityPrivilege	1296	msiexec.exe
Token: SeSecurityPrivilege	1296	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 1020 wrote to memory of 2612	1020	regsvr32.exe	regsvr32.exe
PID 1020 wrote to memory of 2612	1020	regsvr32.exe	regsvr32.exe
PID 1020 wrote to memory of 2612	1020	regsvr32.exe	regsvr32.exe
PID 2612 wrote to memory of 1296	2612	regsvr32.exe	msiexec.exe
PID 2612 wrote to memory of 1296	2612	regsvr32.exe	msiexec.exe
PID 2612 wrote to memory of 1296	2612	regsvr32.exe	msiexec.exe
PID 2612 wrote to memory of 1296	2612	regsvr32.exe	msiexec.exe
PID 2612 wrote to memory of 1296	2612	regsvr32.exe	msiexec.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4480be0491a4e2b03910757fe9ed868736e9b795f07205a66d2bf19253d9b104.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1020

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\4480be0491a4e2b03910757fe9ed868736e9b795f07205a66d2bf19253d9b104.dll
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2612

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1296

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1296-1-0x0000000000E40000-0x0000000000E73000-memory.dmp

Filesize
204KB

Download
memory/1296-2-0x0000000000000000-mapping.dmp

Download
memory/2612-0-0x0000000000000000-mapping.dmp

Download