zloader | 890eacb1a49d606586eb585ee0738f55ac76fb3a175016ad627532425ee19dc8

Resubmissions

10-08-2023 17:07

230810-vmzqxsfe66 10

10-08-2023 16:28

230810-tym1tsfa36 10

01-02-2022 09:54

220201-lxap4sceap 10

Analysis

max time kernel
2605s
max time network
2288s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
10-08-2023 17:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

890eacb1a49d606586eb585ee0738f55ac76fb3a175016ad627532425ee19dc8.dll
Size

251KB
MD5

4c35bc0bb978ae5273a27c7882483eb4
SHA1

e5fb5c5c523e872db6ffd03428f5c0dc74cc9192
SHA256

890eacb1a49d606586eb585ee0738f55ac76fb3a175016ad627532425ee19dc8
SHA512

03154958d83f22969e2967425c35c30bd3a402073819cbea4583f147fecae8ca28281f6c4af5c4c883c3d71e2d272dba066f7b524bf185e512f1092e2db520ee
SSDEEP

3072:i0WgIwbSN7hT/MO4005Cs//ubGAVsyGTqD58Vf2TIoe/vW/hDGvRR/ib10CEjq1v:0gIwatT/3w0zVsyGTQ8eTmDbC1rBFak

Score

10^/10

zloader spam bzman botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

spam

Campaign

BZMAN

https://stoutorder.xyz/rest.php

Attributes

build_id
3

rc4.plain

rsa_pubkey.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1308 set thread context of 2380	1308	regsvr32.exe	31

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2380	msiexec.exe
Token: SeSecurityPrivilege	2380	msiexec.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 1308	2172	regsvr32.exe	28
PID 2172 wrote to memory of 1308	2172	regsvr32.exe	28
PID 2172 wrote to memory of 1308	2172	regsvr32.exe	28
PID 2172 wrote to memory of 1308	2172	regsvr32.exe	28
PID 2172 wrote to memory of 1308	2172	regsvr32.exe	28
PID 2172 wrote to memory of 1308	2172	regsvr32.exe	28
PID 2172 wrote to memory of 1308	2172	regsvr32.exe	28
PID 1308 wrote to memory of 2380	1308	regsvr32.exe	31
PID 1308 wrote to memory of 2380	1308	regsvr32.exe	31
PID 1308 wrote to memory of 2380	1308	regsvr32.exe	31
PID 1308 wrote to memory of 2380	1308	regsvr32.exe	31
PID 1308 wrote to memory of 2380	1308	regsvr32.exe	31
PID 1308 wrote to memory of 2380	1308	regsvr32.exe	31
PID 1308 wrote to memory of 2380	1308	regsvr32.exe	31
PID 1308 wrote to memory of 2380	1308	regsvr32.exe	31
PID 1308 wrote to memory of 2380	1308	regsvr32.exe	31

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\890eacb1a49d606586eb585ee0738f55ac76fb3a175016ad627532425ee19dc8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\890eacb1a49d606586eb585ee0738f55ac76fb3a175016ad627532425ee19dc8.dll
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1308-53-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1308-54-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1308-55-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1308-68-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2380-63-0x00000000000D0000-0x00000000000FC000-memory.dmp

Filesize
176KB

Download
memory/2380-65-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2380-67-0x00000000000D0000-0x00000000000FC000-memory.dmp

Filesize
176KB

Download
memory/2380-69-0x00000000000D0000-0x00000000000FC000-memory.dmp

Filesize
176KB

Download
memory/2380-71-0x00000000000D0000-0x00000000000FC000-memory.dmp

Filesize
176KB

Download
memory/2380-72-0x00000000000D0000-0x00000000000FC000-memory.dmp

Filesize
176KB

Download
memory/2380-74-0x00000000000D0000-0x00000000000FC000-memory.dmp

Filesize
176KB

Download