zloader | b4c029f9bb6d85ace85302d25caa7ec1da9d641872ea8f62b333a667c0d7b864

General

Target

d057014fe0e29b2604bd852595441a22.dll
Size

666KB
MD5

d057014fe0e29b2604bd852595441a22
SHA1

57563b2ba10105f0183bcff42800a1b061b560a6
SHA256

b4c029f9bb6d85ace85302d25caa7ec1da9d641872ea8f62b333a667c0d7b864
SHA512

09aeb08c2450b9f79967f071e7bc85b5d9ae86f3e005fb107e91695654620c52450ceabd74aad31a9d49d53fe588c194d3425348bf1527d34dd8a1ce94febcbc

Score

10^/10

zloader nut 13/04 botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

nut

Campaign

13/04

C2

https://jiaayanu.com/post.php

https://investinszeklerland.eu/post.php

https://iqs-sac.com/post.php

https://jciems.in/post.php

https://jinnahofficersschool.com/post.php

https://kancagh.com/post.php

rc4.plain

rsa_pubkey.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Blocklisted process makes network request 16 IoCs

Processes:

msiexec.exe

flow	pid	process
7	1568	msiexec.exe
8	1568	msiexec.exe
9	1568	msiexec.exe
10	1568	msiexec.exe
11	1568	msiexec.exe
12	1568	msiexec.exe
13	1568	msiexec.exe
14	1568	msiexec.exe
15	1568	msiexec.exe
16	1568	msiexec.exe
17	1568	msiexec.exe
18	1568	msiexec.exe
19	1568	msiexec.exe
20	1568	msiexec.exe
21	1568	msiexec.exe
22	1568	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 2020 set thread context of 1568 2020 rundll32.exe msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeSecurityPrivilege 1568 msiexec.exe
Token: SeSecurityPrivilege 1568 msiexec.exe

description	pid	process	target process
PID 2020 set thread context of 1568	2020	rundll32.exe	msiexec.exe

description	pid	process
Token: SeSecurityPrivilege	1568	msiexec.exe
Token: SeSecurityPrivilege	1568	msiexec.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1088 wrote to memory of 2020	1088	rundll32.exe	rundll32.exe
PID 1088 wrote to memory of 2020	1088	rundll32.exe	rundll32.exe
PID 1088 wrote to memory of 2020	1088	rundll32.exe	rundll32.exe
PID 1088 wrote to memory of 2020	1088	rundll32.exe	rundll32.exe
PID 1088 wrote to memory of 2020	1088	rundll32.exe	rundll32.exe
PID 1088 wrote to memory of 2020	1088	rundll32.exe	rundll32.exe
PID 1088 wrote to memory of 2020	1088	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 1568	2020	rundll32.exe	msiexec.exe
PID 2020 wrote to memory of 1568	2020	rundll32.exe	msiexec.exe
PID 2020 wrote to memory of 1568	2020	rundll32.exe	msiexec.exe
PID 2020 wrote to memory of 1568	2020	rundll32.exe	msiexec.exe
PID 2020 wrote to memory of 1568	2020	rundll32.exe	msiexec.exe
PID 2020 wrote to memory of 1568	2020	rundll32.exe	msiexec.exe
PID 2020 wrote to memory of 1568	2020	rundll32.exe	msiexec.exe
PID 2020 wrote to memory of 1568	2020	rundll32.exe	msiexec.exe
PID 2020 wrote to memory of 1568	2020	rundll32.exe	msiexec.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d057014fe0e29b2604bd852595441a22.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d057014fe0e29b2604bd852595441a22.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec.exe
    3⤵
    - Blocklisted process makes network request
    - Suspicious use of AdjustPrivilegeToken
    PID:1568

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1568-64-0x0000000000000000-mapping.dmp

Download
memory/1568-66-0x0000000000090000-0x00000000000BB000-memory.dmp

Filesize
172KB

Download
memory/2020-59-0x0000000000000000-mapping.dmp

Download
memory/2020-60-0x00000000753B1000-0x00000000753B3000-memory.dmp

Filesize
8KB

Download
memory/2020-62-0x0000000074B50000-0x0000000074C18000-memory.dmp

Filesize
800KB

Download
memory/2020-61-0x0000000074B50000-0x0000000074B7B000-memory.dmp

Filesize
172KB

Download
memory/2020-63-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing