zloader | 0d5cc8c23f947379e847033dbe1cc4ecc5d5d5f54b56a73d9833d40154e9cd23

General

Target

434c89ee9f413c1455992b6a9b0c67b6.dll
Size

688KB
MD5

434c89ee9f413c1455992b6a9b0c67b6
SHA1

8ae47bd241b56e4ffa340b09e3fe590775f87efc
SHA256

0d5cc8c23f947379e847033dbe1cc4ecc5d5d5f54b56a73d9833d40154e9cd23
SHA512

96226c34ab487f995d12ec099e7c53402fd39be5675e50a8f26db875329e0666581a9574dac0aa030451d21e83cd20a2e928fee3b3cad3daa3343009b018ba1b

Score

10^/10

zloader nut 24/03 botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

nut

Campaign

24/03

C2

https://electrabeautytools.com/post.php

https://elexitodelonatural.com/post.php

https://elmaaref.com/post.php

https://enrichuae.com/post.php

https://www.epsilon-me.com/post.php

https://codilmeosoterti.tk/post.php

rc4.plain

rsa_pubkey.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Blocklisted process makes network request 40 IoCs

Processes:

msiexec.exe

flow	pid	process
6	900	msiexec.exe
7	900	msiexec.exe
8	900	msiexec.exe
9	900	msiexec.exe
10	900	msiexec.exe
11	900	msiexec.exe
12	900	msiexec.exe
13	900	msiexec.exe
14	900	msiexec.exe
15	900	msiexec.exe
16	900	msiexec.exe
17	900	msiexec.exe
18	900	msiexec.exe
19	900	msiexec.exe
20	900	msiexec.exe
21	900	msiexec.exe
22	900	msiexec.exe
23	900	msiexec.exe
24	900	msiexec.exe
25	900	msiexec.exe
26	900	msiexec.exe
28	900	msiexec.exe
29	900	msiexec.exe
30	900	msiexec.exe
32	900	msiexec.exe
33	900	msiexec.exe
34	900	msiexec.exe
35	900	msiexec.exe
36	900	msiexec.exe
37	900	msiexec.exe
38	900	msiexec.exe
39	900	msiexec.exe
40	900	msiexec.exe
41	900	msiexec.exe
42	900	msiexec.exe
43	900	msiexec.exe
44	900	msiexec.exe
45	900	msiexec.exe
46	900	msiexec.exe
47	900	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 1848 set thread context of 900 1848 rundll32.exe msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeSecurityPrivilege 900 msiexec.exe
Token: SeSecurityPrivilege 900 msiexec.exe

description	pid	process	target process
PID 1848 set thread context of 900	1848	rundll32.exe	msiexec.exe

description	pid	process
Token: SeSecurityPrivilege	900	msiexec.exe
Token: SeSecurityPrivilege	900	msiexec.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 844 wrote to memory of 1848	844	rundll32.exe	rundll32.exe
PID 844 wrote to memory of 1848	844	rundll32.exe	rundll32.exe
PID 844 wrote to memory of 1848	844	rundll32.exe	rundll32.exe
PID 844 wrote to memory of 1848	844	rundll32.exe	rundll32.exe
PID 844 wrote to memory of 1848	844	rundll32.exe	rundll32.exe
PID 844 wrote to memory of 1848	844	rundll32.exe	rundll32.exe
PID 844 wrote to memory of 1848	844	rundll32.exe	rundll32.exe
PID 1848 wrote to memory of 900	1848	rundll32.exe	msiexec.exe
PID 1848 wrote to memory of 900	1848	rundll32.exe	msiexec.exe
PID 1848 wrote to memory of 900	1848	rundll32.exe	msiexec.exe
PID 1848 wrote to memory of 900	1848	rundll32.exe	msiexec.exe
PID 1848 wrote to memory of 900	1848	rundll32.exe	msiexec.exe
PID 1848 wrote to memory of 900	1848	rundll32.exe	msiexec.exe
PID 1848 wrote to memory of 900	1848	rundll32.exe	msiexec.exe
PID 1848 wrote to memory of 900	1848	rundll32.exe	msiexec.exe
PID 1848 wrote to memory of 900	1848	rundll32.exe	msiexec.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\434c89ee9f413c1455992b6a9b0c67b6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:844

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\434c89ee9f413c1455992b6a9b0c67b6.dll,#1
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1848

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
3⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/564-9-0x000007FEF6790000-0x000007FEF6A0A000-memory.dmp

Filesize
2.5MB

Download
memory/900-6-0x0000000000000000-mapping.dmp

Download
memory/900-8-0x0000000000090000-0x00000000000BB000-memory.dmp

Filesize
172KB

Download
memory/1848-2-0x0000000000000000-mapping.dmp

Download
memory/1848-3-0x0000000076881000-0x0000000076883000-memory.dmp

Filesize
8KB

Download
memory/1848-4-0x0000000000320000-0x000000000034B000-memory.dmp

Filesize
172KB

Download
memory/1848-5-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing