zloader | 92819abc5959ef5dcdec4ad5ffc638e8492d0deec4569fc9cef2501adec5474a

Analysis

max time kernel
159s
max time network
117s
platform
windows7_x64
resource
win7-en-20211208
submitted
01-02-2022 05:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

92819abc5959ef5dcdec4ad5ffc638e8492d0deec4569fc9cef2501adec5474a.dll
Size

276KB
MD5

bbfa105715b98f8de465c8afcb4130ef
SHA1

b73c7aed91aa18f558b1a9a378fea4e5535bdf4c
SHA256

92819abc5959ef5dcdec4ad5ffc638e8492d0deec4569fc9cef2501adec5474a
SHA512

ca8279c7b22805a19a02ea7a2793db800b987f9554233df2a709a3c136c8cf89c8c6d6944b05c5f09d0e39628ce39fd43a2861c83772a1cd2a9205401a3c214d

Score

10^/10

zloader 25/03 botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

25/03

https://wgyvjbse.pw/milagrecf.php

https://botiq.xyz/milagrecf.php

Attributes

build_id
103

rc4.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 1872 set thread context of 1232 1872 rundll32.exe msiexec.exe

description	pid	process	target process
PID 1872 set thread context of 1232	1872	rundll32.exe	msiexec.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1092 wrote to memory of 1872	1092	rundll32.exe	rundll32.exe
PID 1092 wrote to memory of 1872	1092	rundll32.exe	rundll32.exe
PID 1092 wrote to memory of 1872	1092	rundll32.exe	rundll32.exe
PID 1092 wrote to memory of 1872	1092	rundll32.exe	rundll32.exe
PID 1092 wrote to memory of 1872	1092	rundll32.exe	rundll32.exe
PID 1092 wrote to memory of 1872	1092	rundll32.exe	rundll32.exe
PID 1092 wrote to memory of 1872	1092	rundll32.exe	rundll32.exe
PID 1872 wrote to memory of 1232	1872	rundll32.exe	msiexec.exe
PID 1872 wrote to memory of 1232	1872	rundll32.exe	msiexec.exe
PID 1872 wrote to memory of 1232	1872	rundll32.exe	msiexec.exe
PID 1872 wrote to memory of 1232	1872	rundll32.exe	msiexec.exe
PID 1872 wrote to memory of 1232	1872	rundll32.exe	msiexec.exe
PID 1872 wrote to memory of 1232	1872	rundll32.exe	msiexec.exe
PID 1872 wrote to memory of 1232	1872	rundll32.exe	msiexec.exe
PID 1872 wrote to memory of 1232	1872	rundll32.exe	msiexec.exe
PID 1872 wrote to memory of 1232	1872	rundll32.exe	msiexec.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\92819abc5959ef5dcdec4ad5ffc638e8492d0deec4569fc9cef2501adec5474a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1092

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\92819abc5959ef5dcdec4ad5ffc638e8492d0deec4569fc9cef2501adec5474a.dll,#1
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1872

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
3⤵
PID:1232

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1232-61-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/1232-60-0x0000000000090000-0x00000000000BE000-memory.dmp

Filesize
184KB

Download
memory/1232-62-0x0000000000090000-0x00000000000BE000-memory.dmp

Filesize
184KB

Download
memory/1232-64-0x0000000000090000-0x00000000000BE000-memory.dmp

Filesize
184KB

Download
memory/1872-54-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download
memory/1872-55-0x0000000000220000-0x000000000027A000-memory.dmp

Filesize
360KB

Download
memory/1872-58-0x0000000000220000-0x000000000027A000-memory.dmp

Filesize
360KB

Download
memory/1872-57-0x0000000000220000-0x000000000024E000-memory.dmp

Filesize
184KB

Download
memory/1872-59-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download