zloader | 8c19669b6ea804b0f3d63a285e115a01084efffc9501c31b0b09d79cadba34e6

General

Target

qUDLf.dll
Size

300KB
MD5

35377178edc832c00f9b8f04c961e1fd
SHA1

ca363d13d681ba404101b76acf8bc7ae518c149a
SHA256

8c19669b6ea804b0f3d63a285e115a01084efffc9501c31b0b09d79cadba34e6
SHA512

7bc01e2219fddddb480ba64521002e392eddd17f0f0a43249c5fd13205dde0f8a1e777e23bf266697b70cb077534d672ce81afdbb78a61996174d73fda6c562a

Score

10^/10

zloader nut 09/03 botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

nut

Campaign

09/03

C2

https://impresosypapeleriaocana.com/post.php

https://anirban24tv.com/post.php

https://geniesoutien.com/post.php

https://artist.capitaldstudio.com/post.php

https://e-anjab.jatimprov.go.id/post.php

https://landmarklive.in/post.php

https://webtvparacatu.com.br/post.php

https://petiteballerina.fi/post.php

https://sasremetgausal.tk/post.php

rc4.plain

rsa_pubkey.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Blocklisted process makes network request 64 IoCs

Processes:

msiexec.exe

flow	pid	process
7	1684	msiexec.exe
8	1684	msiexec.exe
9	1684	msiexec.exe
10	1684	msiexec.exe
11	1684	msiexec.exe
12	1684	msiexec.exe
13	1684	msiexec.exe
14	1684	msiexec.exe
15	1684	msiexec.exe
16	1684	msiexec.exe
17	1684	msiexec.exe
18	1684	msiexec.exe
19	1684	msiexec.exe
20	1684	msiexec.exe
21	1684	msiexec.exe
22	1684	msiexec.exe
23	1684	msiexec.exe
24	1684	msiexec.exe
25	1684	msiexec.exe
26	1684	msiexec.exe
27	1684	msiexec.exe
29	1684	msiexec.exe
30	1684	msiexec.exe
31	1684	msiexec.exe
33	1684	msiexec.exe
35	1684	msiexec.exe
37	1684	msiexec.exe
38	1684	msiexec.exe
39	1684	msiexec.exe
40	1684	msiexec.exe
41	1684	msiexec.exe
42	1684	msiexec.exe
43	1684	msiexec.exe
44	1684	msiexec.exe
45	1684	msiexec.exe
46	1684	msiexec.exe
47	1684	msiexec.exe
48	1684	msiexec.exe
49	1684	msiexec.exe
50	1684	msiexec.exe
51	1684	msiexec.exe
52	1684	msiexec.exe
53	1684	msiexec.exe
54	1684	msiexec.exe
55	1684	msiexec.exe
56	1684	msiexec.exe
57	1684	msiexec.exe
58	1684	msiexec.exe
59	1684	msiexec.exe
60	1684	msiexec.exe
62	1684	msiexec.exe
63	1684	msiexec.exe
64	1684	msiexec.exe
65	1684	msiexec.exe
66	1684	msiexec.exe
67	1684	msiexec.exe
68	1684	msiexec.exe
69	1684	msiexec.exe
70	1684	msiexec.exe
71	1684	msiexec.exe
72	1684	msiexec.exe
73	1684	msiexec.exe
74	1684	msiexec.exe
75	1684	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

regsvr32.exe

description pid process target process

PID 1328 set thread context of 1684 1328 regsvr32.exe msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeSecurityPrivilege 1684 msiexec.exe
Token: SeSecurityPrivilege 1684 msiexec.exe

description	pid	process	target process
PID 1328 set thread context of 1684	1328	regsvr32.exe	msiexec.exe

description	pid	process
Token: SeSecurityPrivilege	1684	msiexec.exe
Token: SeSecurityPrivilege	1684	msiexec.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 1340 wrote to memory of 1328	1340	regsvr32.exe	regsvr32.exe
PID 1340 wrote to memory of 1328	1340	regsvr32.exe	regsvr32.exe
PID 1340 wrote to memory of 1328	1340	regsvr32.exe	regsvr32.exe
PID 1340 wrote to memory of 1328	1340	regsvr32.exe	regsvr32.exe
PID 1340 wrote to memory of 1328	1340	regsvr32.exe	regsvr32.exe
PID 1340 wrote to memory of 1328	1340	regsvr32.exe	regsvr32.exe
PID 1340 wrote to memory of 1328	1340	regsvr32.exe	regsvr32.exe
PID 1328 wrote to memory of 1684	1328	regsvr32.exe	msiexec.exe
PID 1328 wrote to memory of 1684	1328	regsvr32.exe	msiexec.exe
PID 1328 wrote to memory of 1684	1328	regsvr32.exe	msiexec.exe
PID 1328 wrote to memory of 1684	1328	regsvr32.exe	msiexec.exe
PID 1328 wrote to memory of 1684	1328	regsvr32.exe	msiexec.exe
PID 1328 wrote to memory of 1684	1328	regsvr32.exe	msiexec.exe
PID 1328 wrote to memory of 1684	1328	regsvr32.exe	msiexec.exe
PID 1328 wrote to memory of 1684	1328	regsvr32.exe	msiexec.exe
PID 1328 wrote to memory of 1684	1328	regsvr32.exe	msiexec.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\qUDLf.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1340

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\qUDLf.dll
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1328

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
3⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:1684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1328-3-0x0000000000000000-mapping.dmp

Download
memory/1328-4-0x0000000076691000-0x0000000076693000-memory.dmp

Filesize
8KB

Download
memory/1328-5-0x0000000074D80000-0x0000000074DA9000-memory.dmp

Filesize
164KB

Download
memory/1328-6-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download
memory/1340-2-0x000007FEFC271000-0x000007FEFC273000-memory.dmp

Filesize
8KB

Download
memory/1684-7-0x0000000000000000-mapping.dmp

Download
memory/1684-9-0x00000000000D0000-0x00000000000F9000-memory.dmp

Filesize
164KB

Download
memory/1704-10-0x000007FEF7D20000-0x000007FEF7F9A000-memory.dmp

Filesize
2.5MB

Download

Analysis

Sharing