zloader | e6ff434fbb288fb16f228292d41ed7cad38d06eb091ef6b4ab5da61ac96de580

Resubmissions

26-12-2022 13:28

221226-qqwq8ada46 10

25-11-2022 10:07

221125-l5na6sdb4t 10

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 10:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e6ff434fbb288fb16f228292d41ed7cad38d06eb091ef6b4ab5da61ac96de580.dll
Size

274KB
MD5

d046de3d748585f4740f11f44c5e7c31
SHA1

2b04641bd67e7d4bc6170bbd05b33a33dea521da
SHA256

e6ff434fbb288fb16f228292d41ed7cad38d06eb091ef6b4ab5da61ac96de580
SHA512

8f5bbdd39a6932b7b30be8736e1d5f7df4d20b894a3396f18daa93b018f7fa0651d3d915d37a13f84359439e23060cd1f9ac12b7c5aeff8f2353b8e0422df6e1
SSDEEP

6144:sq0e5NP+8ZqKMLLnMxOl6sl4IgKW1rYxk4xJS4H1m3tz3qLWYemA:s2Cnj6sYS36aC

Score

10^/10

zloader kev 02/02 botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

kev

Campaign

02/02

https://inservitudetothedivine.com/post.php

https://pebbleauto.com/post.php

https://ineenbeaudi.tk/post.php

Attributes

build_id
325

rc4.plain

rsa_pubkey.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1956 set thread context of 1192	1956	rundll32.exe	29

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1192	msiexec.exe
Token: SeSecurityPrivilege	1192	msiexec.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1956	1636	rundll32.exe	28
PID 1636 wrote to memory of 1956	1636	rundll32.exe	28
PID 1636 wrote to memory of 1956	1636	rundll32.exe	28
PID 1636 wrote to memory of 1956	1636	rundll32.exe	28
PID 1636 wrote to memory of 1956	1636	rundll32.exe	28
PID 1636 wrote to memory of 1956	1636	rundll32.exe	28
PID 1636 wrote to memory of 1956	1636	rundll32.exe	28
PID 1956 wrote to memory of 1192	1956	rundll32.exe	29
PID 1956 wrote to memory of 1192	1956	rundll32.exe	29
PID 1956 wrote to memory of 1192	1956	rundll32.exe	29
PID 1956 wrote to memory of 1192	1956	rundll32.exe	29
PID 1956 wrote to memory of 1192	1956	rundll32.exe	29
PID 1956 wrote to memory of 1192	1956	rundll32.exe	29
PID 1956 wrote to memory of 1192	1956	rundll32.exe	29
PID 1956 wrote to memory of 1192	1956	rundll32.exe	29
PID 1956 wrote to memory of 1192	1956	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e6ff434fbb288fb16f228292d41ed7cad38d06eb091ef6b4ab5da61ac96de580.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e6ff434fbb288fb16f228292d41ed7cad38d06eb091ef6b4ab5da61ac96de580.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1192-59-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/1192-61-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/1192-64-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/1192-66-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/1956-55-0x00000000762F1000-0x00000000762F3000-memory.dmp

Filesize
8KB

Download
memory/1956-56-0x0000000010000000-0x0000000012541000-memory.dmp

Filesize
37.3MB

Download
memory/1956-57-0x0000000002270000-0x00000000047AB000-memory.dmp

Filesize
37.2MB

Download
memory/1956-58-0x0000000010000000-0x0000000012541000-memory.dmp

Filesize
37.3MB

Download
memory/1956-65-0x0000000010000000-0x0000000012541000-memory.dmp

Filesize
37.3MB

Download