zloader | 6df88e26b94be01b9a7abcd8473f74b9ea7278282421da4bf7dbffa6a53a2a58

General

Target

330000.dll
Size

150KB
MD5

4209e752839b142cc328261ba570b0d2
SHA1

275a712c823e2a5935145c418d2fe2abe38d2eba
SHA256

6df88e26b94be01b9a7abcd8473f74b9ea7278282421da4bf7dbffa6a53a2a58
SHA512

0b6f903f10f4c1e523f87fc5e5a64c173ab112833748e11d13efed049801d5381aff4139cf3e852c24c25f7049b98a2af16549594ea3ceafe698ae1fc0b692ba

Score

10^/10

zloader nut 24/03 botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

nut

Campaign

24/03

C2

https://electrabeautytools.com/post.php

https://elexitodelonatural.com/post.php

https://elmaaref.com/post.php

https://enrichuae.com/post.php

https://www.epsilon-me.com/post.php

https://codilmeosoterti.tk/post.php

rc4.plain

rsa_pubkey.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Blocklisted process makes network request 62 IoCs

Processes:

msiexec.exe

flow	pid	process
7	1676	msiexec.exe
8	1676	msiexec.exe
9	1676	msiexec.exe
10	1676	msiexec.exe
11	1676	msiexec.exe
12	1676	msiexec.exe
13	1676	msiexec.exe
14	1676	msiexec.exe
15	1676	msiexec.exe
16	1676	msiexec.exe
17	1676	msiexec.exe
18	1676	msiexec.exe
19	1676	msiexec.exe
20	1676	msiexec.exe
21	1676	msiexec.exe
22	1676	msiexec.exe
23	1676	msiexec.exe
24	1676	msiexec.exe
25	1676	msiexec.exe
26	1676	msiexec.exe
27	1676	msiexec.exe
29	1676	msiexec.exe
30	1676	msiexec.exe
31	1676	msiexec.exe
33	1676	msiexec.exe
34	1676	msiexec.exe
35	1676	msiexec.exe
36	1676	msiexec.exe
37	1676	msiexec.exe
38	1676	msiexec.exe
39	1676	msiexec.exe
40	1676	msiexec.exe
41	1676	msiexec.exe
42	1676	msiexec.exe
43	1676	msiexec.exe
44	1676	msiexec.exe
45	1676	msiexec.exe
46	1676	msiexec.exe
47	1676	msiexec.exe
48	1676	msiexec.exe
49	1676	msiexec.exe
50	1676	msiexec.exe
51	1676	msiexec.exe
52	1676	msiexec.exe
53	1676	msiexec.exe
55	1676	msiexec.exe
56	1676	msiexec.exe
57	1676	msiexec.exe
59	1676	msiexec.exe
60	1676	msiexec.exe
61	1676	msiexec.exe
62	1676	msiexec.exe
63	1676	msiexec.exe
64	1676	msiexec.exe
65	1676	msiexec.exe
66	1676	msiexec.exe
67	1676	msiexec.exe
68	1676	msiexec.exe
69	1676	msiexec.exe
70	1676	msiexec.exe
71	1676	msiexec.exe
72	1676	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 1264 set thread context of 1676 1264 rundll32.exe msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeSecurityPrivilege 1676 msiexec.exe
Token: SeSecurityPrivilege 1676 msiexec.exe

description	pid	process	target process
PID 1264 set thread context of 1676	1264	rundll32.exe	msiexec.exe

description	pid	process
Token: SeSecurityPrivilege	1676	msiexec.exe
Token: SeSecurityPrivilege	1676	msiexec.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1096 wrote to memory of 1264	1096	rundll32.exe	rundll32.exe
PID 1096 wrote to memory of 1264	1096	rundll32.exe	rundll32.exe
PID 1096 wrote to memory of 1264	1096	rundll32.exe	rundll32.exe
PID 1096 wrote to memory of 1264	1096	rundll32.exe	rundll32.exe
PID 1096 wrote to memory of 1264	1096	rundll32.exe	rundll32.exe
PID 1096 wrote to memory of 1264	1096	rundll32.exe	rundll32.exe
PID 1096 wrote to memory of 1264	1096	rundll32.exe	rundll32.exe
PID 1264 wrote to memory of 1676	1264	rundll32.exe	msiexec.exe
PID 1264 wrote to memory of 1676	1264	rundll32.exe	msiexec.exe
PID 1264 wrote to memory of 1676	1264	rundll32.exe	msiexec.exe
PID 1264 wrote to memory of 1676	1264	rundll32.exe	msiexec.exe
PID 1264 wrote to memory of 1676	1264	rundll32.exe	msiexec.exe
PID 1264 wrote to memory of 1676	1264	rundll32.exe	msiexec.exe
PID 1264 wrote to memory of 1676	1264	rundll32.exe	msiexec.exe
PID 1264 wrote to memory of 1676	1264	rundll32.exe	msiexec.exe
PID 1264 wrote to memory of 1676	1264	rundll32.exe	msiexec.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\330000.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\330000.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1264
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec.exe
    3⤵
    - Blocklisted process makes network request
    - Suspicious use of AdjustPrivilegeToken
    PID:1676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/268-7-0x000007FEF6930000-0x000007FEF6BAA000-memory.dmp

Filesize
2.5MB

Download
memory/1264-2-0x0000000000000000-mapping.dmp

Download
memory/1264-3-0x0000000075711000-0x0000000075713000-memory.dmp

Filesize
8KB

Download
memory/1676-4-0x0000000000000000-mapping.dmp

Download
memory/1676-6-0x00000000000F0000-0x000000000011B000-memory.dmp

Filesize
172KB

Download

Analysis

Sharing