zloader | ccb110232bfb55812730ce5fa2b1f1a6e56fba5c2ed593ae9c5ce0087aaf97fc

General

Target

zxeed.dll
Size

586KB
MD5

c0a63eb0dc02d6bbab35b94555721ad3
SHA1

ab29a3706e4019bd21c7a487a2e4f2d292cc869b
SHA256

ccb110232bfb55812730ce5fa2b1f1a6e56fba5c2ed593ae9c5ce0087aaf97fc
SHA512

de279b0a60aacafec1d7743625e07fcadfaf892d403c562d727b89912c154aecf9e17da6d80ba847cd44d27c436514a27a5fbaec827fd0a138646a58974fb75c

Score

10^/10

zloader kiv 09/02 botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

kiv

Campaign

09/02

C2

https://earfetti.com/post.php

https://evalynews.com/post.php

https://sanciacinfofoothe.tk/post.php

https://enriwetmiti.tk/post.php

rc4.plain

rsa_pubkey.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
Blocklisted process makes network request 4 IoCs

Processes:

msiexec.exe

flow pid process

7 616 msiexec.exe
9 616 msiexec.exe
11 616 msiexec.exe
13 616 msiexec.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 1256 set thread context of 616 1256 rundll32.exe msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeSecurityPrivilege 616 msiexec.exe
Token: SeSecurityPrivilege 616 msiexec.exe

flow	pid	process
7	616	msiexec.exe
9	616	msiexec.exe
11	616	msiexec.exe
13	616	msiexec.exe

description	pid	process	target process
PID 1256 set thread context of 616	1256	rundll32.exe	msiexec.exe

description	pid	process
Token: SeSecurityPrivilege	616	msiexec.exe
Token: SeSecurityPrivilege	616	msiexec.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1596 wrote to memory of 1256	1596	rundll32.exe	rundll32.exe
PID 1596 wrote to memory of 1256	1596	rundll32.exe	rundll32.exe
PID 1596 wrote to memory of 1256	1596	rundll32.exe	rundll32.exe
PID 1596 wrote to memory of 1256	1596	rundll32.exe	rundll32.exe
PID 1596 wrote to memory of 1256	1596	rundll32.exe	rundll32.exe
PID 1596 wrote to memory of 1256	1596	rundll32.exe	rundll32.exe
PID 1596 wrote to memory of 1256	1596	rundll32.exe	rundll32.exe
PID 1256 wrote to memory of 616	1256	rundll32.exe	msiexec.exe
PID 1256 wrote to memory of 616	1256	rundll32.exe	msiexec.exe
PID 1256 wrote to memory of 616	1256	rundll32.exe	msiexec.exe
PID 1256 wrote to memory of 616	1256	rundll32.exe	msiexec.exe
PID 1256 wrote to memory of 616	1256	rundll32.exe	msiexec.exe
PID 1256 wrote to memory of 616	1256	rundll32.exe	msiexec.exe
PID 1256 wrote to memory of 616	1256	rundll32.exe	msiexec.exe
PID 1256 wrote to memory of 616	1256	rundll32.exe	msiexec.exe
PID 1256 wrote to memory of 616	1256	rundll32.exe	msiexec.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\zxeed.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1596

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\zxeed.dll,#1
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1256

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
3⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/616-6-0x0000000000000000-mapping.dmp

Download
memory/616-8-0x00000000000E0000-0x0000000000109000-memory.dmp

Filesize
164KB

Download
memory/1256-2-0x0000000000000000-mapping.dmp

Download
memory/1256-3-0x0000000076241000-0x0000000076243000-memory.dmp

Filesize
8KB

Download
memory/1256-4-0x00000000749E0000-0x0000000074A09000-memory.dmp

Filesize
164KB

Download
memory/1256-5-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/1524-9-0x000007FEF79D0000-0x000007FEF7C4A000-memory.dmp

Filesize
2.5MB

Download

Analysis

Sharing