zloader | fb55aa4029e826e42520861cc82a8db4a3568f1d2b5fe6f39d7bf870ec0005f9

Resubmissions

08-12-2023 09:57

231208-ly41caae27 10

05-02-2022 07:39

220205-jg3pvahcgr 10

Analysis

max time kernel
146s
max time network
157s
platform
windows7_x64
resource
win7-en-20211208
submitted
05-02-2022 07:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb55aa4029e826e42520861cc82a8db4a3568f1d2b5fe6f39d7bf870ec0005f9.dll
Size

472KB
MD5

1d03a39c5b1f99fc9c33bc4a9811cf0f
SHA1

ede00a9c20689c8c6dc5fa301b46c2a74ebe01af
SHA256

fb55aa4029e826e42520861cc82a8db4a3568f1d2b5fe6f39d7bf870ec0005f9
SHA512

fc3f2d776632fbfb1f3d0c3c32e3e57b818a697a53cc587fef3bc8e15f052573e90fffd493032a28eb7d93db93732efff523d406caf7dc07f733bac1b44fc126

Score

10^/10

zloader april24misha april24misha botnet suricata trojan

Malware Config

Extracted

Family

zloader

Botnet

April24misha

Campaign

April24misha

http://wmwifbajxxbcxmucxmlc.com/post.php

http://onfovdaqqrwbvdfoqnof.com/post.php

http://cmmxhurildiigqghlryq.com/post.php

http://nmqsmbiabjdnuushksas.com/post.php

http://fvqlkgedqjiqgapudkgq.com/post.php

http://iawfqecrwohcxnhwtofa.com/post.php

http://nlbmfsyplohyaicmxhum.com/post.php

http://snnmnkxdhflwgthqismb.com/post.php

Attributes

build_id
122

rc4.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata

Blocklisted process makes network request 7 IoCs

flow	pid	Process
5	1320	msiexec.exe
9	1320	msiexec.exe
11	1320	msiexec.exe
13	1320	msiexec.exe
15	1320	msiexec.exe
17	1320	msiexec.exe
19	1320	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2044 set thread context of 1320	2044	rundll32.exe	30

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1320	msiexec.exe
Token: SeSecurityPrivilege	1320	msiexec.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 2044	1228	rundll32.exe	27
PID 1228 wrote to memory of 2044	1228	rundll32.exe	27
PID 1228 wrote to memory of 2044	1228	rundll32.exe	27
PID 1228 wrote to memory of 2044	1228	rundll32.exe	27
PID 1228 wrote to memory of 2044	1228	rundll32.exe	27
PID 1228 wrote to memory of 2044	1228	rundll32.exe	27
PID 1228 wrote to memory of 2044	1228	rundll32.exe	27
PID 2044 wrote to memory of 1320	2044	rundll32.exe	30
PID 2044 wrote to memory of 1320	2044	rundll32.exe	30
PID 2044 wrote to memory of 1320	2044	rundll32.exe	30
PID 2044 wrote to memory of 1320	2044	rundll32.exe	30
PID 2044 wrote to memory of 1320	2044	rundll32.exe	30
PID 2044 wrote to memory of 1320	2044	rundll32.exe	30
PID 2044 wrote to memory of 1320	2044	rundll32.exe	30
PID 2044 wrote to memory of 1320	2044	rundll32.exe	30
PID 2044 wrote to memory of 1320	2044	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb55aa4029e826e42520861cc82a8db4a3568f1d2b5fe6f39d7bf870ec0005f9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb55aa4029e826e42520861cc82a8db4a3568f1d2b5fe6f39d7bf870ec0005f9.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec.exe
    3⤵
    - Blocklisted process makes network request
    - Suspicious use of AdjustPrivilegeToken
    PID:1320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1320-59-0x0000000000090000-0x00000000000C4000-memory.dmp

Filesize
208KB

Download
memory/1320-60-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download
memory/1320-61-0x0000000000090000-0x00000000000C4000-memory.dmp

Filesize
208KB

Download
memory/1320-63-0x0000000000090000-0x00000000000C4000-memory.dmp

Filesize
208KB

Download
memory/2044-55-0x00000000758A1000-0x00000000758A3000-memory.dmp

Filesize
8KB

Download
memory/2044-56-0x0000000072D50000-0x0000000072D84000-memory.dmp

Filesize
208KB

Download
memory/2044-57-0x0000000072D50000-0x0000000073CCF000-memory.dmp

Filesize
15.5MB

Download
memory/2044-58-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download