zloader | dd11381223ab1902db2963df4cbe3299e42064a5857545560f913647c1f70c5a

Analysis

max time kernel
142s
max time network
152s
platform
windows7_x64
resource
win7-en-20211208
submitted
05/02/2022, 09:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd11381223ab1902db2963df4cbe3299e42064a5857545560f913647c1f70c5a.dll
Size

187KB
MD5

133b1861b3590bf00308509227f82872
SHA1

eb6f12759da7aa84077143e3e2694b6fda3d5631
SHA256

dd11381223ab1902db2963df4cbe3299e42064a5857545560f913647c1f70c5a
SHA512

f541c46522cd6aaf52983fd8f28798550416aedd984b9de139521e89094db06a112add90079dec18b0eb0f90a556451d820bde8081af8eee6f676a0f6a260b34

Score

10^/10

zloader miguel 20/04 botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

miguel

Campaign

20/04

https://dcaiqjgnbt.icu/wp-config.php

https://nmttxggtb.press/wp-config.php

Attributes

build_id
165

rc4.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1040 set thread context of 1572	1040	regsvr32.exe	30

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1572	msiexec.exe
Token: SeSecurityPrivilege	1572	msiexec.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 1040	1208	regsvr32.exe	27
PID 1208 wrote to memory of 1040	1208	regsvr32.exe	27
PID 1208 wrote to memory of 1040	1208	regsvr32.exe	27
PID 1208 wrote to memory of 1040	1208	regsvr32.exe	27
PID 1208 wrote to memory of 1040	1208	regsvr32.exe	27
PID 1208 wrote to memory of 1040	1208	regsvr32.exe	27
PID 1208 wrote to memory of 1040	1208	regsvr32.exe	27
PID 1040 wrote to memory of 1572	1040	regsvr32.exe	30
PID 1040 wrote to memory of 1572	1040	regsvr32.exe	30
PID 1040 wrote to memory of 1572	1040	regsvr32.exe	30
PID 1040 wrote to memory of 1572	1040	regsvr32.exe	30
PID 1040 wrote to memory of 1572	1040	regsvr32.exe	30
PID 1040 wrote to memory of 1572	1040	regsvr32.exe	30
PID 1040 wrote to memory of 1572	1040	regsvr32.exe	30
PID 1040 wrote to memory of 1572	1040	regsvr32.exe	30
PID 1040 wrote to memory of 1572	1040	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\dd11381223ab1902db2963df4cbe3299e42064a5857545560f913647c1f70c5a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\dd11381223ab1902db2963df4cbe3299e42064a5857545560f913647c1f70c5a.dll
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1040
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1040-54-0x0000000076911000-0x0000000076913000-memory.dmp

Filesize
8KB

Download
memory/1208-53-0x000007FEFC061000-0x000007FEFC063000-memory.dmp

Filesize
8KB

Download
memory/1572-56-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download
memory/1572-55-0x0000000000090000-0x00000000000C4000-memory.dmp

Filesize
208KB

Download
memory/1572-57-0x0000000000090000-0x00000000000C4000-memory.dmp

Filesize
208KB

Download
memory/1572-59-0x0000000000090000-0x00000000000C4000-memory.dmp

Filesize
208KB

Download