zloader | 7b2991d5d1494b1dce30f7a7bab92db0fb5c39ec498239b91ee0c928f9b19fdb

General

Target

34aa0bd4dc61cca23b7950282df26ce2e16a339b2895add65d46e6d317a11fe1.dll
Size

320KB
MD5

ce8ac0e4da0c1d4406a4a17215db37cf
SHA1

f2df1a5863044e5d6b4ab7d2a2b1ebee9f96d228
SHA256

34aa0bd4dc61cca23b7950282df26ce2e16a339b2895add65d46e6d317a11fe1
SHA512

fcfff47b9074b9013fc00acb9b4a9aee13f820e6369e78a354a3b8d545a8ebf1560f910d6a49edff53384c6e37d61a0b075eb44c6ab89267a0a532f58fbbe7f1

Score

10^/10

zloader nut 27/11 botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

nut

Campaign

27/11

C2

https://hac3r.com/wp-punch.php

https://womtools.com/wp-punch.php

https://valitec.co/wp-punch.php

https://empresascreciendobien.com/server.php

https://smartat.co/error.php

https://teamearenttopdiaty.ga/wp-smarts.php

rc4.plain

rsa_pubkey.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Blocklisted process makes network request 27 IoCs

Processes:

msiexec.exe

flow	pid	process
7	1376	msiexec.exe
9	1376	msiexec.exe
10	1376	msiexec.exe
11	1376	msiexec.exe
12	1376	msiexec.exe
13	1376	msiexec.exe
14	1376	msiexec.exe
16	1376	msiexec.exe
18	1376	msiexec.exe
19	1376	msiexec.exe
20	1376	msiexec.exe
21	1376	msiexec.exe
22	1376	msiexec.exe
23	1376	msiexec.exe
25	1376	msiexec.exe
26	1376	msiexec.exe
27	1376	msiexec.exe
28	1376	msiexec.exe
29	1376	msiexec.exe
30	1376	msiexec.exe
32	1376	msiexec.exe
33	1376	msiexec.exe
34	1376	msiexec.exe
35	1376	msiexec.exe
36	1376	msiexec.exe
37	1376	msiexec.exe
39	1376	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

regsvr32.exe

description pid process target process

PID 1496 set thread context of 1376 1496 regsvr32.exe msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeSecurityPrivilege 1376 msiexec.exe
Token: SeSecurityPrivilege 1376 msiexec.exe

description	pid	process	target process
PID 1496 set thread context of 1376	1496	regsvr32.exe	msiexec.exe

description	pid	process
Token: SeSecurityPrivilege	1376	msiexec.exe
Token: SeSecurityPrivilege	1376	msiexec.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 800 wrote to memory of 1496	800	regsvr32.exe	regsvr32.exe
PID 800 wrote to memory of 1496	800	regsvr32.exe	regsvr32.exe
PID 800 wrote to memory of 1496	800	regsvr32.exe	regsvr32.exe
PID 800 wrote to memory of 1496	800	regsvr32.exe	regsvr32.exe
PID 800 wrote to memory of 1496	800	regsvr32.exe	regsvr32.exe
PID 800 wrote to memory of 1496	800	regsvr32.exe	regsvr32.exe
PID 800 wrote to memory of 1496	800	regsvr32.exe	regsvr32.exe
PID 1496 wrote to memory of 1376	1496	regsvr32.exe	msiexec.exe
PID 1496 wrote to memory of 1376	1496	regsvr32.exe	msiexec.exe
PID 1496 wrote to memory of 1376	1496	regsvr32.exe	msiexec.exe
PID 1496 wrote to memory of 1376	1496	regsvr32.exe	msiexec.exe
PID 1496 wrote to memory of 1376	1496	regsvr32.exe	msiexec.exe
PID 1496 wrote to memory of 1376	1496	regsvr32.exe	msiexec.exe
PID 1496 wrote to memory of 1376	1496	regsvr32.exe	msiexec.exe
PID 1496 wrote to memory of 1376	1496	regsvr32.exe	msiexec.exe
PID 1496 wrote to memory of 1376	1496	regsvr32.exe	msiexec.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\34aa0bd4dc61cca23b7950282df26ce2e16a339b2895add65d46e6d317a11fe1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:800

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\34aa0bd4dc61cca23b7950282df26ce2e16a339b2895add65d46e6d317a11fe1.dll
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1496

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
3⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:1376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/800-2-0x000007FEFC321000-0x000007FEFC323000-memory.dmp

Filesize
8KB

Download
memory/808-10-0x000007FEF7C70000-0x000007FEF7EEA000-memory.dmp

Filesize
2.5MB

Download
memory/1376-7-0x0000000000000000-mapping.dmp

Download
memory/1376-9-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/1496-3-0x0000000000000000-mapping.dmp

Download
memory/1496-4-0x0000000076C21000-0x0000000076C23000-memory.dmp

Filesize
8KB

Download
memory/1496-5-0x0000000074F80000-0x0000000074FA6000-memory.dmp

Filesize
152KB

Download
memory/1496-6-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing