zloader | e6ff434fbb288fb16f228292d41ed7cad38d06eb091ef6b4ab5da61ac96de580

Resubmissions

26-12-2022 13:28

25-11-2022 10:07

max time kernel
142s
max time network
143s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-12-2022 13:28

Target

e6ff434fbb288fb16f228292d41ed7cad38d06eb091ef6b4ab5da61ac96de580.dll
Size

274KB
MD5

d046de3d748585f4740f11f44c5e7c31
SHA1

2b04641bd67e7d4bc6170bbd05b33a33dea521da
SHA256

e6ff434fbb288fb16f228292d41ed7cad38d06eb091ef6b4ab5da61ac96de580
SHA512

8f5bbdd39a6932b7b30be8736e1d5f7df4d20b894a3396f18daa93b018f7fa0651d3d915d37a13f84359439e23060cd1f9ac12b7c5aeff8f2353b8e0422df6e1
SSDEEP

6144:sq0e5NP+8ZqKMLLnMxOl6sl4IgKW1rYxk4xJS4H1m3tz3qLWYemA:s2Cnj6sYS36aC

Score

10^/10

Family

zloader

Botnet

kev

Campaign

02/02

https://inservitudetothedivine.com/post.php

https://pebbleauto.com/post.php

https://ineenbeaudi.tk/post.php

Attributes

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 1508 set thread context of 848 1508 rundll32.exe msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeSecurityPrivilege 848 msiexec.exe
Token: SeSecurityPrivilege 848 msiexec.exe

description	pid	process	target process
PID 1508 set thread context of 848	1508	rundll32.exe	msiexec.exe

description	pid	process
Token: SeSecurityPrivilege	848	msiexec.exe
Token: SeSecurityPrivilege	848	msiexec.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1088 wrote to memory of 1508	1088	rundll32.exe	rundll32.exe
PID 1088 wrote to memory of 1508	1088	rundll32.exe	rundll32.exe
PID 1088 wrote to memory of 1508	1088	rundll32.exe	rundll32.exe
PID 1088 wrote to memory of 1508	1088	rundll32.exe	rundll32.exe
PID 1088 wrote to memory of 1508	1088	rundll32.exe	rundll32.exe
PID 1088 wrote to memory of 1508	1088	rundll32.exe	rundll32.exe
PID 1088 wrote to memory of 1508	1088	rundll32.exe	rundll32.exe
PID 1508 wrote to memory of 848	1508	rundll32.exe	msiexec.exe
PID 1508 wrote to memory of 848	1508	rundll32.exe	msiexec.exe
PID 1508 wrote to memory of 848	1508	rundll32.exe	msiexec.exe
PID 1508 wrote to memory of 848	1508	rundll32.exe	msiexec.exe
PID 1508 wrote to memory of 848	1508	rundll32.exe	msiexec.exe
PID 1508 wrote to memory of 848	1508	rundll32.exe	msiexec.exe
PID 1508 wrote to memory of 848	1508	rundll32.exe	msiexec.exe
PID 1508 wrote to memory of 848	1508	rundll32.exe	msiexec.exe
PID 1508 wrote to memory of 848	1508	rundll32.exe	msiexec.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e6ff434fbb288fb16f228292d41ed7cad38d06eb091ef6b4ab5da61ac96de580.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1088

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:848

memory/848-58-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/848-60-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/848-61-0x0000000000000000-mapping.dmp

Download
memory/848-64-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/848-65-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/1508-54-0x0000000000000000-mapping.dmp

Download
memory/1508-55-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download
memory/1508-56-0x0000000010000000-0x0000000012541000-memory.dmp

Filesize
37.3MB

Download
memory/1508-57-0x00000000022B0000-0x00000000047EB000-memory.dmp

Filesize
37.2MB

Download
memory/1508-63-0x0000000010000000-0x0000000012541000-memory.dmp

Filesize
37.3MB

Download