zloader | ccb110232bfb55812730ce5fa2b1f1a6e56fba5c2ed593ae9c5ce0087aaf97fc

Analysis

Target

zxeed.dll
Size

586KB
MD5

c0a63eb0dc02d6bbab35b94555721ad3
SHA1

ab29a3706e4019bd21c7a487a2e4f2d292cc869b
SHA256

ccb110232bfb55812730ce5fa2b1f1a6e56fba5c2ed593ae9c5ce0087aaf97fc
SHA512

de279b0a60aacafec1d7743625e07fcadfaf892d403c562d727b89912c154aecf9e17da6d80ba847cd44d27c436514a27a5fbaec827fd0a138646a58974fb75c

Score

10^/10

Family

zloader

Botnet

kiv

Campaign

09/02

https://earfetti.com/post.php

https://evalynews.com/post.php

https://sanciacinfofoothe.tk/post.php

https://enriwetmiti.tk/post.php

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
Blocklisted process makes network request 4 IoCs

Processes:

msiexec.exe

flow pid process

15 3684 msiexec.exe
17 3684 msiexec.exe
19 3684 msiexec.exe
21 3684 msiexec.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 1136 set thread context of 3684 1136 rundll32.exe msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeSecurityPrivilege 3684 msiexec.exe
Token: SeSecurityPrivilege 3684 msiexec.exe

description	pid	process	target process
PID 1136 set thread context of 3684	1136	rundll32.exe	msiexec.exe

description	pid	process
Token: SeSecurityPrivilege	3684	msiexec.exe
Token: SeSecurityPrivilege	3684	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1020 wrote to memory of 1136	1020	rundll32.exe	rundll32.exe
PID 1020 wrote to memory of 1136	1020	rundll32.exe	rundll32.exe
PID 1020 wrote to memory of 1136	1020	rundll32.exe	rundll32.exe
PID 1136 wrote to memory of 3684	1136	rundll32.exe	msiexec.exe
PID 1136 wrote to memory of 3684	1136	rundll32.exe	msiexec.exe
PID 1136 wrote to memory of 3684	1136	rundll32.exe	msiexec.exe
PID 1136 wrote to memory of 3684	1136	rundll32.exe	msiexec.exe
PID 1136 wrote to memory of 3684	1136	rundll32.exe	msiexec.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\zxeed.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1020

memory/1136-2-0x0000000000000000-mapping.dmp

Download
memory/1136-3-0x0000000073D30000-0x0000000073D59000-memory.dmp

Filesize
164KB

Download
memory/1136-4-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/3684-5-0x0000000000000000-mapping.dmp

Download
memory/3684-6-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download