zloader | 92f61cc6548277705585cc0c28d553093323d802a1d0d2e9fe618ebeaa6752fa

General

Target

92f61cc6548277705585cc0c28d553093323d802a1d0d2e9fe618ebeaa6752fa.dll
Size

472KB
MD5

cf3dbc7f75f6588465e7550501609550
SHA1

ab140968ca7f8c8bfb13c7c7412fbe3575f0418b
SHA256

92f61cc6548277705585cc0c28d553093323d802a1d0d2e9fe618ebeaa6752fa
SHA512

d2db1005e83548262c6e76fbb560feb9e8f527f5d107d68d8485558cc68ec389adbbb3008dba9293ecd49fd6a4c6273be3daac52c357eadc8343770b838df68f

Score

10^/10

zloader april24misha april24misha botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

April24misha

Campaign

April24misha

C2

http://wmwifbajxxbcxmucxmlc.com/post.php

http://onfovdaqqrwbvdfoqnof.com/post.php

http://cmmxhurildiigqghlryq.com/post.php

http://nmqsmbiabjdnuushksas.com/post.php

http://fvqlkgedqjiqgapudkgq.com/post.php

http://iawfqecrwohcxnhwtofa.com/post.php

http://nlbmfsyplohyaicmxhum.com/post.php

http://snnmnkxdhflwgthqismb.com/post.php

Attributes

build_id
122

rc4.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Blocklisted process makes network request 4 IoCs

flow	pid	Process
5	560	msiexec.exe
9	560	msiexec.exe
11	560	msiexec.exe
13	560	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1992 set thread context of 560	1992	rundll32.exe	30

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	560	msiexec.exe
Token: SeSecurityPrivilege	560	msiexec.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1992	2004	rundll32.exe	27
PID 2004 wrote to memory of 1992	2004	rundll32.exe	27
PID 2004 wrote to memory of 1992	2004	rundll32.exe	27
PID 2004 wrote to memory of 1992	2004	rundll32.exe	27
PID 2004 wrote to memory of 1992	2004	rundll32.exe	27
PID 2004 wrote to memory of 1992	2004	rundll32.exe	27
PID 2004 wrote to memory of 1992	2004	rundll32.exe	27
PID 1992 wrote to memory of 560	1992	rundll32.exe	30
PID 1992 wrote to memory of 560	1992	rundll32.exe	30
PID 1992 wrote to memory of 560	1992	rundll32.exe	30
PID 1992 wrote to memory of 560	1992	rundll32.exe	30
PID 1992 wrote to memory of 560	1992	rundll32.exe	30
PID 1992 wrote to memory of 560	1992	rundll32.exe	30
PID 1992 wrote to memory of 560	1992	rundll32.exe	30
PID 1992 wrote to memory of 560	1992	rundll32.exe	30
PID 1992 wrote to memory of 560	1992	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\92f61cc6548277705585cc0c28d553093323d802a1d0d2e9fe618ebeaa6752fa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\92f61cc6548277705585cc0c28d553093323d802a1d0d2e9fe618ebeaa6752fa.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec.exe
    3⤵
    - Blocklisted process makes network request
    - Suspicious use of AdjustPrivilegeToken
    PID:560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/560-60-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/560-59-0x0000000000100000-0x0000000000134000-memory.dmp

Filesize
208KB

Download
memory/560-61-0x0000000000100000-0x0000000000134000-memory.dmp

Filesize
208KB

Download
memory/560-63-0x0000000000100000-0x0000000000134000-memory.dmp

Filesize
208KB

Download
memory/1992-55-0x0000000076731000-0x0000000076733000-memory.dmp

Filesize
8KB

Download
memory/1992-56-0x0000000072A70000-0x0000000072AA4000-memory.dmp

Filesize
208KB

Download
memory/1992-57-0x0000000072A70000-0x00000000739EF000-memory.dmp

Filesize
15.5MB

Download
memory/1992-58-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing