zloader | 73f45ee75d9554d86f8c65d3b1d47910c1fac7e230c848c9c8907d8cc72f1675

Analysis

max time kernel
77s
max time network
124s
platform
windows10_x64
resource
win10v20201028
submitted
16-12-2020 23:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e70968a9326d7abc103c04b4c355649c837c69c92b83af9ac4e2c1c123f0948.dll
Size

520KB
MD5

976a3e1f72f6d0e32e5eaab7db1c93b4
SHA1

77aff7c16b978445d7b4b7a9d2b1eaef0592b439
SHA256

0e70968a9326d7abc103c04b4c355649c837c69c92b83af9ac4e2c1c123f0948
SHA512

a29993ba569f5ef123054c8dd8a0ed71c04c5dfb573dd2c9917deed7f1c870732c24bfd2c387a93c539a09d635dde4d89dc048179e3dfc7e5edc9da679d54e0e

Score

10^/10

zloader nut 11/12 botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

nut

Campaign

11/12

https://www.businessinsurancelaw.com/wp-punch.php

https://squire.ae/wp-punch.php

https://lamun.pk/wp-punch.php

https://www.rcclabbd.com/wp-punch.php

https://thecype.com/wp-punch.php

https://theterteboltallbrow.tk/wp-smarts.php

rc4.plain

rsa_pubkey.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Blocklisted process makes network request 20 IoCs

Processes:

msiexec.exe

flow	pid	process
22	3860	msiexec.exe
24	3860	msiexec.exe
25	3860	msiexec.exe
26	3860	msiexec.exe
27	3860	msiexec.exe
28	3860	msiexec.exe
29	3860	msiexec.exe
31	3860	msiexec.exe
32	3860	msiexec.exe
33	3860	msiexec.exe
34	3860	msiexec.exe
35	3860	msiexec.exe
36	3860	msiexec.exe
38	3860	msiexec.exe
39	3860	msiexec.exe
40	3860	msiexec.exe
41	3860	msiexec.exe
44	3860	msiexec.exe
45	3860	msiexec.exe
47	3860	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 4696 set thread context of 3860 4696 rundll32.exe msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeSecurityPrivilege 3860 msiexec.exe
Token: SeSecurityPrivilege 3860 msiexec.exe

description	pid	process	target process
PID 4696 set thread context of 3860	4696	rundll32.exe	msiexec.exe

description	pid	process
Token: SeSecurityPrivilege	3860	msiexec.exe
Token: SeSecurityPrivilege	3860	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 4680 wrote to memory of 4696	4680	rundll32.exe	rundll32.exe
PID 4680 wrote to memory of 4696	4680	rundll32.exe	rundll32.exe
PID 4680 wrote to memory of 4696	4680	rundll32.exe	rundll32.exe
PID 4696 wrote to memory of 3860	4696	rundll32.exe	msiexec.exe
PID 4696 wrote to memory of 3860	4696	rundll32.exe	msiexec.exe
PID 4696 wrote to memory of 3860	4696	rundll32.exe	msiexec.exe
PID 4696 wrote to memory of 3860	4696	rundll32.exe	msiexec.exe
PID 4696 wrote to memory of 3860	4696	rundll32.exe	msiexec.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e70968a9326d7abc103c04b4c355649c837c69c92b83af9ac4e2c1c123f0948.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4680

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e70968a9326d7abc103c04b4c355649c837c69c92b83af9ac4e2c1c123f0948.dll,#1
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4696

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
3⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:3860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3860-3-0x0000000000BD0000-0x0000000000BF6000-memory.dmp

Filesize
152KB

Download
memory/3860-4-0x0000000000000000-mapping.dmp

Download
memory/4696-2-0x0000000000000000-mapping.dmp

Download