zloader | 890eacb1a49d606586eb585ee0738f55ac76fb3a175016ad627532425ee19dc8

Resubmissions

10-08-2023 17:07

10-08-2023 16:28

01-02-2022 09:54

max time kernel
2605s
max time network
2288s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
10-08-2023 17:07

Target

890eacb1a49d606586eb585ee0738f55ac76fb3a175016ad627532425ee19dc8.dll
Size

251KB
MD5

4c35bc0bb978ae5273a27c7882483eb4
SHA1

e5fb5c5c523e872db6ffd03428f5c0dc74cc9192
SHA256

890eacb1a49d606586eb585ee0738f55ac76fb3a175016ad627532425ee19dc8
SHA512

03154958d83f22969e2967425c35c30bd3a402073819cbea4583f147fecae8ca28281f6c4af5c4c883c3d71e2d272dba066f7b524bf185e512f1092e2db520ee
SSDEEP

3072:i0WgIwbSN7hT/MO4005Cs//ubGAVsyGTqD58Vf2TIoe/vW/hDGvRR/ib10CEjq1v:0gIwatT/3w0zVsyGTQ8eTmDbC1rBFak

Score

10^/10

Family

zloader

Botnet

spam

Campaign

BZMAN

https://stoutorder.xyz/rest.php

Attributes

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
Suspicious use of SetThreadContext 1 IoCs

Processes:

regsvr32.exe

description pid process target process

PID 1308 set thread context of 2380 1308 regsvr32.exe msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeSecurityPrivilege 2380 msiexec.exe
Token: SeSecurityPrivilege 2380 msiexec.exe

description	pid	process	target process
PID 1308 set thread context of 2380	1308	regsvr32.exe	msiexec.exe

description	pid	process
Token: SeSecurityPrivilege	2380	msiexec.exe
Token: SeSecurityPrivilege	2380	msiexec.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 2172 wrote to memory of 1308	2172	regsvr32.exe	regsvr32.exe
PID 2172 wrote to memory of 1308	2172	regsvr32.exe	regsvr32.exe
PID 2172 wrote to memory of 1308	2172	regsvr32.exe	regsvr32.exe
PID 2172 wrote to memory of 1308	2172	regsvr32.exe	regsvr32.exe
PID 2172 wrote to memory of 1308	2172	regsvr32.exe	regsvr32.exe
PID 2172 wrote to memory of 1308	2172	regsvr32.exe	regsvr32.exe
PID 2172 wrote to memory of 1308	2172	regsvr32.exe	regsvr32.exe
PID 1308 wrote to memory of 2380	1308	regsvr32.exe	msiexec.exe
PID 1308 wrote to memory of 2380	1308	regsvr32.exe	msiexec.exe
PID 1308 wrote to memory of 2380	1308	regsvr32.exe	msiexec.exe
PID 1308 wrote to memory of 2380	1308	regsvr32.exe	msiexec.exe
PID 1308 wrote to memory of 2380	1308	regsvr32.exe	msiexec.exe
PID 1308 wrote to memory of 2380	1308	regsvr32.exe	msiexec.exe
PID 1308 wrote to memory of 2380	1308	regsvr32.exe	msiexec.exe
PID 1308 wrote to memory of 2380	1308	regsvr32.exe	msiexec.exe
PID 1308 wrote to memory of 2380	1308	regsvr32.exe	msiexec.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\890eacb1a49d606586eb585ee0738f55ac76fb3a175016ad627532425ee19dc8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2172

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2380

memory/1308-53-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1308-54-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1308-55-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1308-68-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2380-63-0x00000000000D0000-0x00000000000FC000-memory.dmp

Filesize
176KB

Download
memory/2380-65-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2380-67-0x00000000000D0000-0x00000000000FC000-memory.dmp

Filesize
176KB

Download
memory/2380-69-0x00000000000D0000-0x00000000000FC000-memory.dmp

Filesize
176KB

Download
memory/2380-71-0x00000000000D0000-0x00000000000FC000-memory.dmp

Filesize
176KB

Download
memory/2380-72-0x00000000000D0000-0x00000000000FC000-memory.dmp

Filesize
176KB

Download
memory/2380-74-0x00000000000D0000-0x00000000000FC000-memory.dmp

Filesize
176KB

Download