Overview

overview

10

Static

static

a5ec2f495c...8b.dll

windows7_x64

10

a5ec2f495c...8b.dll

windows10-2004_x64

10

Analysis

  • max time kernel
    153s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    24-05-2022 23:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a5ec2f495c117f199e1cecc1e2c9e5ad7f4f8241eb0784bb82da89c5ac88778b.dll

  • Size

    395KB

  • MD5

    f00a09d9a91de170a986d743da8a912b

  • SHA1

    797e0c4bc66a9ce9598bd99b8c30340d42de71b7

  • SHA256

    a5ec2f495c117f199e1cecc1e2c9e5ad7f4f8241eb0784bb82da89c5ac88778b

  • SHA512

    ac36017e3d6b61332a983e5de1f20ef137c6127f90c6102c0a033a80fb7c4838e1eeb841615afe6226c4e4dee8aee38659d4df94d41a8fe14238d092f12e91ae

Score
10/10
zloaderjuly20ssljuly20sslbotnettrojan

Malware Config

Extracted

Family

zloader

Botnet

July20SSL

Campaign

July20SSL

C2

https://vlcafxbdjtlvlcduwhga.com/web/post.php

https://softwareserviceupdater3.com/web/post.php

https://softwareserviceupdater4.com/web/post.php
Attributes
  • build_id

    18

rc4.plain
rsa_pubkey.plain

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

    trojanbotnetzloader
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3304
      • C:\Windows\system32\rundll32.exe
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\a5ec2f495c117f199e1cecc1e2c9e5ad7f4f8241eb0784bb82da89c5ac88778b.dll,#1
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1572
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe C:\Users\Admin\AppData\Local\Temp\a5ec2f495c117f199e1cecc1e2c9e5ad7f4f8241eb0784bb82da89c5ac88778b.dll,#1
          3⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1968
      • C:\Windows\SysWOW64\msiexec.exe
        msiexec.exe
        2⤵
          PID:3920

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1968-131-0x0000000010000000-0x000000001002B000-memory.dmp

        Filesize

        172KB

        Download

      • memory/1968-132-0x0000000010000000-0x0000000010073000-memory.dmp

        Filesize

        460KB

        Download

      • memory/1968-133-0x0000000010000000-0x0000000010073000-memory.dmp

        Filesize

        460KB

        Download

      • memory/3920-135-0x0000000000B80000-0x0000000000BAB000-memory.dmp

        Filesize

        172KB

        Download

      • memory/3920-136-0x0000000000B80000-0x0000000000BAB000-memory.dmp

        Filesize

        172KB

        Download