zloader | 890eacb1a49d606586eb585ee0738f55ac76fb3a175016ad627532425ee19dc8

Target

890eacb1a49d606586eb585ee0738f55ac76fb3a175016ad627532425ee19dc8.dll
Size

251KB
MD5

4c35bc0bb978ae5273a27c7882483eb4
SHA1

e5fb5c5c523e872db6ffd03428f5c0dc74cc9192
SHA256

890eacb1a49d606586eb585ee0738f55ac76fb3a175016ad627532425ee19dc8
SHA512

03154958d83f22969e2967425c35c30bd3a402073819cbea4583f147fecae8ca28281f6c4af5c4c883c3d71e2d272dba066f7b524bf185e512f1092e2db520ee

Score

10^/10

Malware Config

Family

zloader

Botnet

spam

Campaign

BZMAN

https://stoutorder.xyz/rest.php

Attributes

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
Suspicious use of SetThreadContext 1 IoCs

Processes:

regsvr32.exe

description pid process target process

PID 1932 set thread context of 1868 1932 regsvr32.exe msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeSecurityPrivilege 1868 msiexec.exe
Token: SeSecurityPrivilege 1868 msiexec.exe

description	pid	process	target process
PID 1932 set thread context of 1868	1932	regsvr32.exe	msiexec.exe

description	pid	process
Token: SeSecurityPrivilege	1868	msiexec.exe
Token: SeSecurityPrivilege	1868	msiexec.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 1388 wrote to memory of 1932	1388	regsvr32.exe	regsvr32.exe
PID 1388 wrote to memory of 1932	1388	regsvr32.exe	regsvr32.exe
PID 1388 wrote to memory of 1932	1388	regsvr32.exe	regsvr32.exe
PID 1388 wrote to memory of 1932	1388	regsvr32.exe	regsvr32.exe
PID 1388 wrote to memory of 1932	1388	regsvr32.exe	regsvr32.exe
PID 1388 wrote to memory of 1932	1388	regsvr32.exe	regsvr32.exe
PID 1388 wrote to memory of 1932	1388	regsvr32.exe	regsvr32.exe
PID 1932 wrote to memory of 1868	1932	regsvr32.exe	msiexec.exe
PID 1932 wrote to memory of 1868	1932	regsvr32.exe	msiexec.exe
PID 1932 wrote to memory of 1868	1932	regsvr32.exe	msiexec.exe
PID 1932 wrote to memory of 1868	1932	regsvr32.exe	msiexec.exe
PID 1932 wrote to memory of 1868	1932	regsvr32.exe	msiexec.exe
PID 1932 wrote to memory of 1868	1932	regsvr32.exe	msiexec.exe
PID 1932 wrote to memory of 1868	1932	regsvr32.exe	msiexec.exe
PID 1932 wrote to memory of 1868	1932	regsvr32.exe	msiexec.exe
PID 1932 wrote to memory of 1868	1932	regsvr32.exe	msiexec.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\890eacb1a49d606586eb585ee0738f55ac76fb3a175016ad627532425ee19dc8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1388

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1868

memory/1388-54-0x000007FEFBF31000-0x000007FEFBF33000-memory.dmp

Filesize
8KB

Download
memory/1868-60-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/1868-59-0x00000000000D0000-0x00000000000FC000-memory.dmp

Filesize
176KB

Download
memory/1868-61-0x00000000000D0000-0x00000000000FC000-memory.dmp

Filesize
176KB

Download
memory/1868-63-0x00000000000D0000-0x00000000000FC000-memory.dmp

Filesize
176KB

Download
memory/1932-55-0x00000000758A1000-0x00000000758A3000-memory.dmp

Filesize
8KB

Download
memory/1932-56-0x00000000002A0000-0x00000000002E6000-memory.dmp

Filesize
280KB

Download
memory/1932-57-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/1932-58-0x00000000002A0000-0x0000000000320000-memory.dmp

Filesize
512KB

Download