zloader | 61be79c9e47ad894006907c544c0a2d606d8d69c95298ffc5861f20c4b87769e

General

Target

xiNGRHX.txt.dll
Size

688KB
MD5

bb4d1959e6a7850a556ebadf69d18508
SHA1

c4a940aa768e97da36393a899775ff7172f66274
SHA256

61be79c9e47ad894006907c544c0a2d606d8d69c95298ffc5861f20c4b87769e
SHA512

57c6e278ca830b5d20ab0d6a442cfca2265abffa5f46f40c4551e22a0acafef0b0a9fe06b08848bc58dfd5e7e5327ccc4c684edb60204cbcc5a839a9bbbe0a0d

Score

10^/10

zloader nut 24/03 botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

nut

Campaign

24/03

C2

https://electrabeautytools.com/post.php

https://elexitodelonatural.com/post.php

https://elmaaref.com/post.php

https://enrichuae.com/post.php

https://www.epsilon-me.com/post.php

https://codilmeosoterti.tk/post.php

rc4.plain

rsa_pubkey.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Blocklisted process makes network request 40 IoCs

Processes:

msiexec.exe

flow	pid	process
6	1216	msiexec.exe
7	1216	msiexec.exe
8	1216	msiexec.exe
9	1216	msiexec.exe
10	1216	msiexec.exe
11	1216	msiexec.exe
12	1216	msiexec.exe
13	1216	msiexec.exe
14	1216	msiexec.exe
15	1216	msiexec.exe
16	1216	msiexec.exe
17	1216	msiexec.exe
18	1216	msiexec.exe
19	1216	msiexec.exe
20	1216	msiexec.exe
21	1216	msiexec.exe
22	1216	msiexec.exe
23	1216	msiexec.exe
24	1216	msiexec.exe
25	1216	msiexec.exe
26	1216	msiexec.exe
28	1216	msiexec.exe
29	1216	msiexec.exe
30	1216	msiexec.exe
32	1216	msiexec.exe
33	1216	msiexec.exe
34	1216	msiexec.exe
35	1216	msiexec.exe
36	1216	msiexec.exe
37	1216	msiexec.exe
38	1216	msiexec.exe
39	1216	msiexec.exe
40	1216	msiexec.exe
41	1216	msiexec.exe
42	1216	msiexec.exe
43	1216	msiexec.exe
44	1216	msiexec.exe
45	1216	msiexec.exe
46	1216	msiexec.exe
47	1216	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 1104 set thread context of 1216 1104 rundll32.exe msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeSecurityPrivilege 1216 msiexec.exe
Token: SeSecurityPrivilege 1216 msiexec.exe

description	pid	process	target process
PID 1104 set thread context of 1216	1104	rundll32.exe	msiexec.exe

description	pid	process
Token: SeSecurityPrivilege	1216	msiexec.exe
Token: SeSecurityPrivilege	1216	msiexec.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1724 wrote to memory of 1104	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 1104	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 1104	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 1104	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 1104	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 1104	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 1104	1724	rundll32.exe	rundll32.exe
PID 1104 wrote to memory of 1216	1104	rundll32.exe	msiexec.exe
PID 1104 wrote to memory of 1216	1104	rundll32.exe	msiexec.exe
PID 1104 wrote to memory of 1216	1104	rundll32.exe	msiexec.exe
PID 1104 wrote to memory of 1216	1104	rundll32.exe	msiexec.exe
PID 1104 wrote to memory of 1216	1104	rundll32.exe	msiexec.exe
PID 1104 wrote to memory of 1216	1104	rundll32.exe	msiexec.exe
PID 1104 wrote to memory of 1216	1104	rundll32.exe	msiexec.exe
PID 1104 wrote to memory of 1216	1104	rundll32.exe	msiexec.exe
PID 1104 wrote to memory of 1216	1104	rundll32.exe	msiexec.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\xiNGRHX.txt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\xiNGRHX.txt.dll,#1
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1104

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
3⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:1216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1104-2-0x0000000000000000-mapping.dmp

Download
memory/1104-3-0x00000000761E1000-0x00000000761E3000-memory.dmp

Filesize
8KB

Download
memory/1104-4-0x0000000000230000-0x000000000025B000-memory.dmp

Filesize
172KB

Download
memory/1104-5-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/1216-6-0x0000000000000000-mapping.dmp

Download
memory/1216-8-0x0000000000090000-0x00000000000BB000-memory.dmp

Filesize
172KB

Download
memory/1612-9-0x000007FEF7D90000-0x000007FEF800A000-memory.dmp

Filesize
2.5MB

Download

Analysis

Sharing