zloader | 81eb75e4ddc107718bedb39c72c1fae12541dc69d586510d1a89de7d7893620f

Analysis

Target

4480be0491a4e2b03910757fe9ed868736e9b795f07205a66d2bf19253d9b104.dll
Size

183KB
MD5

d674bca869b8452501dbe9d467a75c52
SHA1

db637cc185267090764a82a05f16108b9e86f764
SHA256

4480be0491a4e2b03910757fe9ed868736e9b795f07205a66d2bf19253d9b104
SHA512

5aaba2fd5cf4d056fbb65fad52787cc6959b2f037b5de0f173dea96a7ed479193186074c04d6eca05d6252d692e709c4f1d442d6946373a13d4936f741f30c84

Score

10^/10

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
Suspicious use of SetThreadContext 1 IoCs

Processes:

regsvr32.exe

description pid process target process

PID 1532 set thread context of 948 1532 regsvr32.exe msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeSecurityPrivilege 948 msiexec.exe
Token: SeSecurityPrivilege 948 msiexec.exe

description	pid	process	target process
PID 1532 set thread context of 948	1532	regsvr32.exe	msiexec.exe

description	pid	process
Token: SeSecurityPrivilege	948	msiexec.exe
Token: SeSecurityPrivilege	948	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 896 wrote to memory of 1532	896	regsvr32.exe	regsvr32.exe
PID 896 wrote to memory of 1532	896	regsvr32.exe	regsvr32.exe
PID 896 wrote to memory of 1532	896	regsvr32.exe	regsvr32.exe
PID 1532 wrote to memory of 948	1532	regsvr32.exe	msiexec.exe
PID 1532 wrote to memory of 948	1532	regsvr32.exe	msiexec.exe
PID 1532 wrote to memory of 948	1532	regsvr32.exe	msiexec.exe
PID 1532 wrote to memory of 948	1532	regsvr32.exe	msiexec.exe
PID 1532 wrote to memory of 948	1532	regsvr32.exe	msiexec.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4480be0491a4e2b03910757fe9ed868736e9b795f07205a66d2bf19253d9b104.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:896

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:948