zloader | c4ab81d7b7d44dd6dfc4f2b69dbe3f22fbf23c1ae49ab8edac2d26f85ae4514d

Target

ycof.exe.dll
Size

1.1MB
MD5

54a3bcca6b1eb92adb299a46df941826
SHA1

6988e010056d88985b8e8f8de06706327779d3ca
SHA256

c4ab81d7b7d44dd6dfc4f2b69dbe3f22fbf23c1ae49ab8edac2d26f85ae4514d
SHA512

4e4f10abf8a97f649060cb3eaa125a487141a42b87d2dc1449d87531d927031279bd7b48a3859ffa8f5d4400deea77022ecb00c61de8511756dc9c0d27e3f150

Score

10^/10

Malware Config

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 2636 set thread context of 3988 2636 rundll32.exe msiexec.exe

description	pid	process	target process
PID 2636 set thread context of 3988	2636	rundll32.exe	msiexec.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

rundll32.exe

description	pid	process
Token: SeShutdownPrivilege	2636	rundll32.exe
Token: SeCreatePagefilePrivilege	2636	rundll32.exe
Token: SeShutdownPrivilege	2636	rundll32.exe
Token: SeCreatePagefilePrivilege	2636	rundll32.exe
Token: SeShutdownPrivilege	2636	rundll32.exe
Token: SeCreatePagefilePrivilege	2636	rundll32.exe
Token: SeShutdownPrivilege	2636	rundll32.exe
Token: SeCreatePagefilePrivilege	2636	rundll32.exe
Token: SeShutdownPrivilege	2636	rundll32.exe
Token: SeCreatePagefilePrivilege	2636	rundll32.exe
Token: SeShutdownPrivilege	2636	rundll32.exe
Token: SeCreatePagefilePrivilege	2636	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2484 wrote to memory of 2636	2484	rundll32.exe	rundll32.exe
PID 2484 wrote to memory of 2636	2484	rundll32.exe	rundll32.exe
PID 2484 wrote to memory of 2636	2484	rundll32.exe	rundll32.exe
PID 2636 wrote to memory of 3988	2636	rundll32.exe	msiexec.exe
PID 2636 wrote to memory of 3988	2636	rundll32.exe	msiexec.exe
PID 2636 wrote to memory of 3988	2636	rundll32.exe	msiexec.exe
PID 2636 wrote to memory of 3988	2636	rundll32.exe	msiexec.exe
PID 2636 wrote to memory of 3988	2636	rundll32.exe	msiexec.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ycof.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2484

memory/2636-115-0x0000000000000000-mapping.dmp

Download
memory/2636-116-0x0000000072E70000-0x0000000072E9A000-memory.dmp

Filesize
168KB

Download
memory/2636-117-0x0000000072E70000-0x00000000738A6000-memory.dmp

Filesize
10.2MB

Download
memory/2636-118-0x00000000033E0000-0x00000000033E1000-memory.dmp

Filesize
4KB

Download
memory/3988-119-0x0000000000000000-mapping.dmp

Download
memory/3988-122-0x0000000000740000-0x000000000076A000-memory.dmp

Filesize
168KB

Download