zloader | a5ec2f495c117f199e1cecc1e2c9e5ad7f4f8241eb0784bb82da89c5ac88778b

General

Target

a5ec2f495c117f199e1cecc1e2c9e5ad7f4f8241eb0784bb82da89c5ac88778b.dll
Size

395KB
MD5

f00a09d9a91de170a986d743da8a912b
SHA1

797e0c4bc66a9ce9598bd99b8c30340d42de71b7
SHA256

a5ec2f495c117f199e1cecc1e2c9e5ad7f4f8241eb0784bb82da89c5ac88778b
SHA512

ac36017e3d6b61332a983e5de1f20ef137c6127f90c6102c0a033a80fb7c4838e1eeb841615afe6226c4e4dee8aee38659d4df94d41a8fe14238d092f12e91ae

Score

10^/10

zloader july20ssl july20ssl botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

July20SSL

Campaign

July20SSL

C2

https://vlcafxbdjtlvlcduwhga.com/web/post.php

https://softwareserviceupdater3.com/web/post.php

https://softwareserviceupdater4.com/web/post.php

Attributes

build_id
18

rc4.plain

rsa_pubkey.plain

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 884 created 1260 884 rundll32.exe Explorer.EXE
Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 884 set thread context of 1976 884 rundll32.exe msiexec.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

884 rundll32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

rundll32.exe

description pid process

Token: SeDebugPrivilege 884 rundll32.exe

description	pid	process	target process
PID 884 created 1260	884	rundll32.exe	Explorer.EXE

description	pid	process	target process
PID 884 set thread context of 1976	884	rundll32.exe	msiexec.exe

pid	process
884	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	884	rundll32.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 892 wrote to memory of 884	892	rundll32.exe	rundll32.exe
PID 892 wrote to memory of 884	892	rundll32.exe	rundll32.exe
PID 892 wrote to memory of 884	892	rundll32.exe	rundll32.exe
PID 892 wrote to memory of 884	892	rundll32.exe	rundll32.exe
PID 892 wrote to memory of 884	892	rundll32.exe	rundll32.exe
PID 892 wrote to memory of 884	892	rundll32.exe	rundll32.exe
PID 892 wrote to memory of 884	892	rundll32.exe	rundll32.exe
PID 884 wrote to memory of 1976	884	rundll32.exe	msiexec.exe
PID 884 wrote to memory of 1976	884	rundll32.exe	msiexec.exe
PID 884 wrote to memory of 1976	884	rundll32.exe	msiexec.exe
PID 884 wrote to memory of 1976	884	rundll32.exe	msiexec.exe
PID 884 wrote to memory of 1976	884	rundll32.exe	msiexec.exe
PID 884 wrote to memory of 1976	884	rundll32.exe	msiexec.exe
PID 884 wrote to memory of 1976	884	rundll32.exe	msiexec.exe
PID 884 wrote to memory of 1976	884	rundll32.exe	msiexec.exe
PID 884 wrote to memory of 1976	884	rundll32.exe	msiexec.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1260

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a5ec2f495c117f199e1cecc1e2c9e5ad7f4f8241eb0784bb82da89c5ac88778b.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:892

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a5ec2f495c117f199e1cecc1e2c9e5ad7f4f8241eb0784bb82da89c5ac88778b.dll,#1
3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:884

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
2⤵
PID:1976

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/884-54-0x0000000000000000-mapping.dmp

Download
memory/884-55-0x0000000075801000-0x0000000075803000-memory.dmp

Filesize
8KB

Download
memory/884-57-0x0000000010000000-0x0000000010073000-memory.dmp

Filesize
460KB

Download
memory/884-56-0x0000000010000000-0x000000001002B000-memory.dmp

Filesize
172KB

Download
memory/884-58-0x0000000010000000-0x0000000010073000-memory.dmp

Filesize
460KB

Download
memory/1976-59-0x0000000000090000-0x00000000000BB000-memory.dmp

Filesize
172KB

Download
memory/1976-61-0x0000000000090000-0x00000000000BB000-memory.dmp

Filesize
172KB

Download
memory/1976-62-0x0000000000000000-mapping.dmp

Download
memory/1976-64-0x0000000000090000-0x00000000000BB000-memory.dmp

Filesize
172KB

Download

Analysis

Sharing