zloader | 903c3b246b516395e8aaca0c647d496005d9d6609107f7f67a061b5390608010

General

Target

903c3b246b516395e8aaca0c647d496005d9d6609107f7f67a061b5390608010.dll
Size

448KB
MD5

8a46f0c4be8a91b533142a112618a885
SHA1

32a765a9a32ec7065087b172607e0f9a8119fc20
SHA256

903c3b246b516395e8aaca0c647d496005d9d6609107f7f67a061b5390608010
SHA512

54a9c56d0b18779fc6d7c54f5b01bdf8cb2d830f7b035de2817950b90c1f363f1ad0a6a46db66fc0470c0e7b5c221d35cbe69752afbfb56560caaa42f06e7e5e

Score

10^/10

zloader bat1k3 bat1k3 botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

bat1k3

Campaign

bat1k3

C2

http://ad123234234.in/LKhwojehDgwegSDG/gateJKjdsh.php

http://ad123234234.info/LKhwojehDgwegSDG/gateJKjdsh.php

http://ad123234234.net/LKhwojehDgwegSDG/gateJKjdsh.php

http://ad123234234.org/LKhwojehDgwegSDG/gateJKjdsh.php

http://ad123234234.xyz/LKhwojehDgwegSDG/gateJKjdsh.php

Attributes

build_id
29

rc4.plain

rsa_pubkey.plain

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

regsvr32.exe

description pid process target process

PID 1712 created 1232 1712 regsvr32.exe Explorer.EXE
Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
Suspicious use of SetThreadContext 1 IoCs

Processes:

regsvr32.exe

description pid process target process

PID 1712 set thread context of 2004 1712 regsvr32.exe msiexec.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

regsvr32.exe

pid process

1712 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

regsvr32.exemsiexec.exe

description pid process

Token: SeDebugPrivilege 1712 regsvr32.exe
Token: SeSecurityPrivilege 2004 msiexec.exe
Token: SeSecurityPrivilege 2004 msiexec.exe

description	pid	process	target process
PID 1712 created 1232	1712	regsvr32.exe	Explorer.EXE

description	pid	process	target process
PID 1712 set thread context of 2004	1712	regsvr32.exe	msiexec.exe

pid	process
1712	regsvr32.exe

description	pid	process
Token: SeDebugPrivilege	1712	regsvr32.exe
Token: SeSecurityPrivilege	2004	msiexec.exe
Token: SeSecurityPrivilege	2004	msiexec.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 868 wrote to memory of 1712	868	regsvr32.exe	regsvr32.exe
PID 868 wrote to memory of 1712	868	regsvr32.exe	regsvr32.exe
PID 868 wrote to memory of 1712	868	regsvr32.exe	regsvr32.exe
PID 868 wrote to memory of 1712	868	regsvr32.exe	regsvr32.exe
PID 868 wrote to memory of 1712	868	regsvr32.exe	regsvr32.exe
PID 868 wrote to memory of 1712	868	regsvr32.exe	regsvr32.exe
PID 868 wrote to memory of 1712	868	regsvr32.exe	regsvr32.exe
PID 1712 wrote to memory of 2004	1712	regsvr32.exe	msiexec.exe
PID 1712 wrote to memory of 2004	1712	regsvr32.exe	msiexec.exe
PID 1712 wrote to memory of 2004	1712	regsvr32.exe	msiexec.exe
PID 1712 wrote to memory of 2004	1712	regsvr32.exe	msiexec.exe
PID 1712 wrote to memory of 2004	1712	regsvr32.exe	msiexec.exe
PID 1712 wrote to memory of 2004	1712	regsvr32.exe	msiexec.exe
PID 1712 wrote to memory of 2004	1712	regsvr32.exe	msiexec.exe
PID 1712 wrote to memory of 2004	1712	regsvr32.exe	msiexec.exe
PID 1712 wrote to memory of 2004	1712	regsvr32.exe	msiexec.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1232

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\903c3b246b516395e8aaca0c647d496005d9d6609107f7f67a061b5390608010.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:868

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\903c3b246b516395e8aaca0c647d496005d9d6609107f7f67a061b5390608010.dll
3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1712

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2004

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/868-54-0x000007FEFC041000-0x000007FEFC043000-memory.dmp

Filesize
8KB

Download
memory/1712-55-0x0000000000000000-mapping.dmp

Download
memory/1712-56-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/1712-58-0x0000000074BD0000-0x0000000074C50000-memory.dmp

Filesize
512KB

Download
memory/1712-57-0x0000000074BD0000-0x0000000074BFD000-memory.dmp

Filesize
180KB

Download
memory/1712-59-0x0000000074BD0000-0x0000000074C50000-memory.dmp

Filesize
512KB

Download
memory/2004-60-0x0000000000090000-0x00000000000BD000-memory.dmp

Filesize
180KB

Download
memory/2004-62-0x0000000000090000-0x00000000000BD000-memory.dmp

Filesize
180KB

Download
memory/2004-63-0x0000000000000000-mapping.dmp

Download
memory/2004-65-0x0000000000090000-0x00000000000BD000-memory.dmp

Filesize
180KB

Download

Analysis

Sharing