zloader | 2716e72ec123a824d9f54565db8609d9c7f5c31c729b7cf8370598195cdc7f01

Analysis

Target

2716e72ec123a824d9f54565db8609d9c7f5c31c729b7cf8370598195cdc7f01.dll
Size

164KB
MD5

960a5736981a42f0c16106da79faffa7
SHA1

b9026bada9a7ae8835799a0144eb38fe37a70981
SHA256

2716e72ec123a824d9f54565db8609d9c7f5c31c729b7cf8370598195cdc7f01
SHA512

9c70cdbf105a4551c53c981a4f84ce0b111e4b0de26ff97ecae83c4e69136d0c8a84bc384c3154ab70b4770e7050bed6044f8f5d11cd9064af089466667ae714

Score

10^/10

Family

zloader

Botnet

kev

Campaign

08/02

https://earfetti.com/post.php

https://evalynews.com/post.php

https://zeistatwalk.tk/post.php

https://spiraninendreamneu.tk/post.php

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
Blocklisted process makes network request 2 IoCs

Processes:

msiexec.exe

flow pid process

6 1164 msiexec.exe
7 1164 msiexec.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 1248 set thread context of 1164 1248 rundll32.exe msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeSecurityPrivilege 1164 msiexec.exe
Token: SeSecurityPrivilege 1164 msiexec.exe

flow	pid	process
6	1164	msiexec.exe
7	1164	msiexec.exe

description	pid	process	target process
PID 1248 set thread context of 1164	1248	rundll32.exe	msiexec.exe

description	pid	process
Token: SeSecurityPrivilege	1164	msiexec.exe
Token: SeSecurityPrivilege	1164	msiexec.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1832 wrote to memory of 1248	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1248	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1248	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1248	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1248	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1248	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1248	1832	rundll32.exe	rundll32.exe
PID 1248 wrote to memory of 1164	1248	rundll32.exe	msiexec.exe
PID 1248 wrote to memory of 1164	1248	rundll32.exe	msiexec.exe
PID 1248 wrote to memory of 1164	1248	rundll32.exe	msiexec.exe
PID 1248 wrote to memory of 1164	1248	rundll32.exe	msiexec.exe
PID 1248 wrote to memory of 1164	1248	rundll32.exe	msiexec.exe
PID 1248 wrote to memory of 1164	1248	rundll32.exe	msiexec.exe
PID 1248 wrote to memory of 1164	1248	rundll32.exe	msiexec.exe
PID 1248 wrote to memory of 1164	1248	rundll32.exe	msiexec.exe
PID 1248 wrote to memory of 1164	1248	rundll32.exe	msiexec.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2716e72ec123a824d9f54565db8609d9c7f5c31c729b7cf8370598195cdc7f01.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1832

memory/1164-4-0x0000000000000000-mapping.dmp

Download
memory/1164-6-0x00000000000D0000-0x00000000000F9000-memory.dmp

Filesize
164KB

Download
memory/1248-2-0x0000000000000000-mapping.dmp

Download
memory/1248-3-0x0000000076191000-0x0000000076193000-memory.dmp

Filesize
8KB

Download
memory/1620-7-0x000007FEF7F80000-0x000007FEF81FA000-memory.dmp

Filesize
2.5MB

Download