zloader | d45d3d2fa8833b85608b6afa7b29e82675fd50e9701b0418d1c359c61829bdb1

Analysis

Target

778b9b70005df81ab976c71250ebe587f0eeb017c380e69405dc86692a3a4495.dll
Size

133KB
MD5

b2c855b1dd828feaff561c702ad1152c
SHA1

0bc01ddc1f202ec9310bba17b616cba27b01ade6
SHA256

778b9b70005df81ab976c71250ebe587f0eeb017c380e69405dc86692a3a4495
SHA512

260e0738aeca6c24762d4f9131e1998a7479ff57f3bacf4a26633fa0ba257eb72d0376bbfcab8ae72fcb5dd39cab5e98ef7678fff3de3f8748de11b5362412e4

Score

10^/10

Family

zloader

Botnet

kev

Campaign

26/01

https://gadgetswolf.com/post.php

https://homesoapmolds.com/post.php

https://govemedico.tk/post.php

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Blocklisted process makes network request 18 IoCs

Processes:

msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 1472 set thread context of 3464 1472 rundll32.exe msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeSecurityPrivilege 3464 msiexec.exe
Token: SeSecurityPrivilege 3464 msiexec.exe

description	pid	process	target process
PID 1472 set thread context of 3464	1472	rundll32.exe	msiexec.exe

description	pid	process
Token: SeSecurityPrivilege	3464	msiexec.exe
Token: SeSecurityPrivilege	3464	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 880 wrote to memory of 1472	880	rundll32.exe	rundll32.exe
PID 880 wrote to memory of 1472	880	rundll32.exe	rundll32.exe
PID 880 wrote to memory of 1472	880	rundll32.exe	rundll32.exe
PID 1472 wrote to memory of 3464	1472	rundll32.exe	msiexec.exe
PID 1472 wrote to memory of 3464	1472	rundll32.exe	msiexec.exe
PID 1472 wrote to memory of 3464	1472	rundll32.exe	msiexec.exe
PID 1472 wrote to memory of 3464	1472	rundll32.exe	msiexec.exe
PID 1472 wrote to memory of 3464	1472	rundll32.exe	msiexec.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\778b9b70005df81ab976c71250ebe587f0eeb017c380e69405dc86692a3a4495.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:880

memory/1472-2-0x0000000000000000-mapping.dmp

Download
memory/3464-3-0x0000000000000000-mapping.dmp

Download
memory/3464-4-0x0000000000640000-0x0000000000666000-memory.dmp

Filesize
152KB

Download