zloader | a5ec2f495c117f199e1cecc1e2c9e5ad7f4f8241eb0784bb82da89c5ac88778b

General

Target

a5ec2f495c117f199e1cecc1e2c9e5ad7f4f8241eb0784bb82da89c5ac88778b.dll
Size

395KB
MD5

f00a09d9a91de170a986d743da8a912b
SHA1

797e0c4bc66a9ce9598bd99b8c30340d42de71b7
SHA256

a5ec2f495c117f199e1cecc1e2c9e5ad7f4f8241eb0784bb82da89c5ac88778b
SHA512

ac36017e3d6b61332a983e5de1f20ef137c6127f90c6102c0a033a80fb7c4838e1eeb841615afe6226c4e4dee8aee38659d4df94d41a8fe14238d092f12e91ae

Score

10^/10

zloader july20ssl july20ssl botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

July20SSL

Campaign

July20SSL

C2

https://vlcafxbdjtlvlcduwhga.com/web/post.php

https://softwareserviceupdater3.com/web/post.php

https://softwareserviceupdater4.com/web/post.php

Attributes

build_id
18

rc4.plain

rsa_pubkey.plain

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 884 created 1260	884	rundll32.exe	8

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 884 set thread context of 1976	884	rundll32.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
884	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	884	rundll32.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 884	892	rundll32.exe	27
PID 892 wrote to memory of 884	892	rundll32.exe	27
PID 892 wrote to memory of 884	892	rundll32.exe	27
PID 892 wrote to memory of 884	892	rundll32.exe	27
PID 892 wrote to memory of 884	892	rundll32.exe	27
PID 892 wrote to memory of 884	892	rundll32.exe	27
PID 892 wrote to memory of 884	892	rundll32.exe	27
PID 884 wrote to memory of 1976	884	rundll32.exe	28
PID 884 wrote to memory of 1976	884	rundll32.exe	28
PID 884 wrote to memory of 1976	884	rundll32.exe	28
PID 884 wrote to memory of 1976	884	rundll32.exe	28
PID 884 wrote to memory of 1976	884	rundll32.exe	28
PID 884 wrote to memory of 1976	884	rundll32.exe	28
PID 884 wrote to memory of 1976	884	rundll32.exe	28
PID 884 wrote to memory of 1976	884	rundll32.exe	28
PID 884 wrote to memory of 1976	884	rundll32.exe	28

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1260
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a5ec2f495c117f199e1cecc1e2c9e5ad7f4f8241eb0784bb82da89c5ac88778b.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:892
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\a5ec2f495c117f199e1cecc1e2c9e5ad7f4f8241eb0784bb82da89c5ac88778b.dll,#1
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:884
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe
  2⤵
  PID:1976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/884-55-0x0000000075801000-0x0000000075803000-memory.dmp

Filesize
8KB

Download
memory/884-57-0x0000000010000000-0x0000000010073000-memory.dmp

Filesize
460KB

Download
memory/884-56-0x0000000010000000-0x000000001002B000-memory.dmp

Filesize
172KB

Download
memory/884-58-0x0000000010000000-0x0000000010073000-memory.dmp

Filesize
460KB

Download
memory/1976-59-0x0000000000090000-0x00000000000BB000-memory.dmp

Filesize
172KB

Download
memory/1976-61-0x0000000000090000-0x00000000000BB000-memory.dmp

Filesize
172KB

Download
memory/1976-64-0x0000000000090000-0x00000000000BB000-memory.dmp

Filesize
172KB

Download

Analysis

Sharing