zloader | 890eacb1a49d606586eb585ee0738f55ac76fb3a175016ad627532425ee19dc8

Target

890eacb1a49d606586eb585ee0738f55ac76fb3a175016ad627532425ee19dc8.dll
Size

251KB
MD5

4c35bc0bb978ae5273a27c7882483eb4
SHA1

e5fb5c5c523e872db6ffd03428f5c0dc74cc9192
SHA256

890eacb1a49d606586eb585ee0738f55ac76fb3a175016ad627532425ee19dc8
SHA512

03154958d83f22969e2967425c35c30bd3a402073819cbea4583f147fecae8ca28281f6c4af5c4c883c3d71e2d272dba066f7b524bf185e512f1092e2db520ee

Score

10^/10

Malware Config

Family

zloader

Botnet

spam

Campaign

BZMAN

https://stoutorder.xyz/rest.php

Attributes

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1932 set thread context of 1868	1932	regsvr32.exe	30

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1868	msiexec.exe
Token: SeSecurityPrivilege	1868	msiexec.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 1932	1388	regsvr32.exe	27
PID 1388 wrote to memory of 1932	1388	regsvr32.exe	27
PID 1388 wrote to memory of 1932	1388	regsvr32.exe	27
PID 1388 wrote to memory of 1932	1388	regsvr32.exe	27
PID 1388 wrote to memory of 1932	1388	regsvr32.exe	27
PID 1388 wrote to memory of 1932	1388	regsvr32.exe	27
PID 1388 wrote to memory of 1932	1388	regsvr32.exe	27
PID 1932 wrote to memory of 1868	1932	regsvr32.exe	30
PID 1932 wrote to memory of 1868	1932	regsvr32.exe	30
PID 1932 wrote to memory of 1868	1932	regsvr32.exe	30
PID 1932 wrote to memory of 1868	1932	regsvr32.exe	30
PID 1932 wrote to memory of 1868	1932	regsvr32.exe	30
PID 1932 wrote to memory of 1868	1932	regsvr32.exe	30
PID 1932 wrote to memory of 1868	1932	regsvr32.exe	30
PID 1932 wrote to memory of 1868	1932	regsvr32.exe	30
PID 1932 wrote to memory of 1868	1932	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\890eacb1a49d606586eb585ee0738f55ac76fb3a175016ad627532425ee19dc8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\890eacb1a49d606586eb585ee0738f55ac76fb3a175016ad627532425ee19dc8.dll
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1868

memory/1388-54-0x000007FEFBF31000-0x000007FEFBF33000-memory.dmp

Filesize
8KB

Download
memory/1868-60-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/1868-59-0x00000000000D0000-0x00000000000FC000-memory.dmp

Filesize
176KB

Download
memory/1868-61-0x00000000000D0000-0x00000000000FC000-memory.dmp

Filesize
176KB

Download
memory/1868-63-0x00000000000D0000-0x00000000000FC000-memory.dmp

Filesize
176KB

Download
memory/1932-55-0x00000000758A1000-0x00000000758A3000-memory.dmp

Filesize
8KB

Download
memory/1932-56-0x00000000002A0000-0x00000000002E6000-memory.dmp

Filesize
280KB

Download
memory/1932-57-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/1932-58-0x00000000002A0000-0x0000000000320000-memory.dmp

Filesize
512KB

Download