zloader | e6ff434fbb288fb16f228292d41ed7cad38d06eb091ef6b4ab5da61ac96de580

Resubmissions

26-12-2022 13:28

25-11-2022 10:07

max time kernel
60s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2022 13:28

Target

e6ff434fbb288fb16f228292d41ed7cad38d06eb091ef6b4ab5da61ac96de580.dll
Size

274KB
MD5

d046de3d748585f4740f11f44c5e7c31
SHA1

2b04641bd67e7d4bc6170bbd05b33a33dea521da
SHA256

e6ff434fbb288fb16f228292d41ed7cad38d06eb091ef6b4ab5da61ac96de580
SHA512

8f5bbdd39a6932b7b30be8736e1d5f7df4d20b894a3396f18daa93b018f7fa0651d3d915d37a13f84359439e23060cd1f9ac12b7c5aeff8f2353b8e0422df6e1
SSDEEP

6144:sq0e5NP+8ZqKMLLnMxOl6sl4IgKW1rYxk4xJS4H1m3tz3qLWYemA:s2Cnj6sYS36aC

Score

10^/10

Family

zloader

Botnet

kev

Campaign

02/02

https://inservitudetothedivine.com/post.php

https://pebbleauto.com/post.php

https://ineenbeaudi.tk/post.php

Attributes

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 4552 set thread context of 5080 4552 rundll32.exe msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeSecurityPrivilege 5080 msiexec.exe
Token: SeSecurityPrivilege 5080 msiexec.exe

description	pid	process	target process
PID 4552 set thread context of 5080	4552	rundll32.exe	msiexec.exe

description	pid	process
Token: SeSecurityPrivilege	5080	msiexec.exe
Token: SeSecurityPrivilege	5080	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 4632 wrote to memory of 4552	4632	rundll32.exe	rundll32.exe
PID 4632 wrote to memory of 4552	4632	rundll32.exe	rundll32.exe
PID 4632 wrote to memory of 4552	4632	rundll32.exe	rundll32.exe
PID 4552 wrote to memory of 5080	4552	rundll32.exe	msiexec.exe
PID 4552 wrote to memory of 5080	4552	rundll32.exe	msiexec.exe
PID 4552 wrote to memory of 5080	4552	rundll32.exe	msiexec.exe
PID 4552 wrote to memory of 5080	4552	rundll32.exe	msiexec.exe
PID 4552 wrote to memory of 5080	4552	rundll32.exe	msiexec.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e6ff434fbb288fb16f228292d41ed7cad38d06eb091ef6b4ab5da61ac96de580.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4632

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5080

memory/4552-132-0x0000000000000000-mapping.dmp

Download
memory/4552-133-0x0000000010000000-0x0000000012541000-memory.dmp

Filesize
37.3MB

Download
memory/4552-134-0x0000000002760000-0x0000000004C9B000-memory.dmp

Filesize
37.2MB

Download
memory/4552-135-0x0000000010000000-0x0000000012541000-memory.dmp

Filesize
37.3MB

Download
memory/4552-138-0x0000000010000000-0x0000000012541000-memory.dmp

Filesize
37.3MB

Download
memory/5080-136-0x0000000000000000-mapping.dmp

Download
memory/5080-137-0x0000000000F80000-0x0000000000FA6000-memory.dmp

Filesize
152KB

Download
memory/5080-139-0x0000000000F80000-0x0000000000FA6000-memory.dmp

Filesize
152KB

Download
memory/5080-140-0x0000000000F80000-0x0000000000FA6000-memory.dmp

Filesize
152KB

Download