zloader | 9a1f819c2b9de04e314248f10234c8bcb0ccfebbb6edf3e3edd1cd38450da4b5

Analysis

Target

IGzSPlI.dll
Size

499KB
MD5

90361067f5a67c2f5d5bc552a51f2a5e
SHA1

91c3fb6c603d41e39c60c8e429c4151db94d8d83
SHA256

9a1f819c2b9de04e314248f10234c8bcb0ccfebbb6edf3e3edd1cd38450da4b5
SHA512

2b7ebeaec463b959511b9f79759070c537d0f105de8c747f2e5bd2e8070d2ba71a8607b497feed346ed7b9694bdb0f0ba2b0937eb03a9b46e7a8f48542343e5f

Score

10^/10

Family

zloader

Botnet

bot5

Campaign

bot5

https://militanttra.at/owg.php

rc4.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 1092 set thread context of 1196 1092 rundll32.exe msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeSecurityPrivilege 1196 msiexec.exe
Token: SeSecurityPrivilege 1196 msiexec.exe

description	pid	process	target process
PID 1092 set thread context of 1196	1092	rundll32.exe	msiexec.exe

description	pid	process
Token: SeSecurityPrivilege	1196	msiexec.exe
Token: SeSecurityPrivilege	1196	msiexec.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1724 wrote to memory of 1092	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 1092	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 1092	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 1092	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 1092	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 1092	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 1092	1724	rundll32.exe	rundll32.exe
PID 1092 wrote to memory of 1196	1092	rundll32.exe	msiexec.exe
PID 1092 wrote to memory of 1196	1092	rundll32.exe	msiexec.exe
PID 1092 wrote to memory of 1196	1092	rundll32.exe	msiexec.exe
PID 1092 wrote to memory of 1196	1092	rundll32.exe	msiexec.exe
PID 1092 wrote to memory of 1196	1092	rundll32.exe	msiexec.exe
PID 1092 wrote to memory of 1196	1092	rundll32.exe	msiexec.exe
PID 1092 wrote to memory of 1196	1092	rundll32.exe	msiexec.exe
PID 1092 wrote to memory of 1196	1092	rundll32.exe	msiexec.exe
PID 1092 wrote to memory of 1196	1092	rundll32.exe	msiexec.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\IGzSPlI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1196

memory/1092-2-0x0000000000000000-mapping.dmp

Download
memory/1092-3-0x00000000761E1000-0x00000000761E3000-memory.dmp

Filesize
8KB

Download
memory/1092-4-0x0000000000930000-0x0000000000967000-memory.dmp

Filesize
220KB

Download
memory/1092-5-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/1196-6-0x0000000000000000-mapping.dmp

Download
memory/1196-8-0x0000000000090000-0x00000000000C7000-memory.dmp

Filesize
220KB

Download
memory/1376-9-0x000007FEF7D90000-0x000007FEF800A000-memory.dmp

Filesize
2.5MB

Download