zloader | fa09c9ab2f3fc8d3c6541cb835769792d6bc041ba5aa1d04a22be1608791ad9e

Resubmissions

31-10-2023 10:08

231031-l564aafc8y 10

01-08-2020 19:35

200801-yxa2qg44dx 10

Analysis

max time kernel
1743s
max time network
1747s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
31-10-2023 10:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Trojan.GenericKD.34222957.15631.dll
Size

395KB
MD5

5120008536c0de7bf6030f10377ec8c0
SHA1

778a0fd8c2b307ad1aba4a66fadef2ff3306d5d0
SHA256

fa09c9ab2f3fc8d3c6541cb835769792d6bc041ba5aa1d04a22be1608791ad9e
SHA512

83f151f19a5cada9420040522d21b52943793530e5e43d1e0e47f8b4cc726d4b741663d4c8b8ef03649c1b281cd9c702419cb580abc555317363e7b8d02edb15
SSDEEP

6144:VhLHWQznGP/YR2rCnft7BdI7vHFtpuqVtT/C9KxwlfCokKYmT8SNhXDZi5121jYN:/WQznGYX1dIbHF5V09TlfDTthXc5M1j

Score

10^/10

zloader july20ssl july20ssl botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

July20SSL

Campaign

July20SSL

https://vlcafxbdjtlvlcduwhga.com/web/post.php

https://softwareserviceupdater3.com/web/post.php

https://softwareserviceupdater4.com/web/post.php

Attributes

build_id
18

rc4.plain

rsa_pubkey.plain

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 536 created 1212	536	rundll32.exe	16

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 536 set thread context of 2568	536	rundll32.exe	31

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
536	rundll32.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	536	rundll32.exe
Token: SeSecurityPrivilege	2568	msiexec.exe
Token: SeSecurityPrivilege	2568	msiexec.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 536	2360	rundll32.exe	28
PID 2360 wrote to memory of 536	2360	rundll32.exe	28
PID 2360 wrote to memory of 536	2360	rundll32.exe	28
PID 2360 wrote to memory of 536	2360	rundll32.exe	28
PID 2360 wrote to memory of 536	2360	rundll32.exe	28
PID 2360 wrote to memory of 536	2360	rundll32.exe	28
PID 2360 wrote to memory of 536	2360	rundll32.exe	28
PID 536 wrote to memory of 2568	536	rundll32.exe	31
PID 536 wrote to memory of 2568	536	rundll32.exe	31
PID 536 wrote to memory of 2568	536	rundll32.exe	31
PID 536 wrote to memory of 2568	536	rundll32.exe	31
PID 536 wrote to memory of 2568	536	rundll32.exe	31
PID 536 wrote to memory of 2568	536	rundll32.exe	31
PID 536 wrote to memory of 2568	536	rundll32.exe	31
PID 536 wrote to memory of 2568	536	rundll32.exe	31
PID 536 wrote to memory of 2568	536	rundll32.exe	31

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1212
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.34222957.15631.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.34222957.15631.dll,#1
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:536
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2568

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/536-1-0x0000000010000000-0x0000000010073000-memory.dmp

Filesize
460KB

Download
memory/536-2-0x0000000010000000-0x0000000010073000-memory.dmp

Filesize
460KB

Download
memory/536-3-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/536-0-0x0000000010000000-0x0000000010073000-memory.dmp

Filesize
460KB

Download
memory/536-15-0x0000000010000000-0x0000000010073000-memory.dmp

Filesize
460KB

Download
memory/2568-13-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/2568-11-0x0000000000090000-0x00000000000BB000-memory.dmp

Filesize
172KB

Download
memory/2568-14-0x0000000000090000-0x00000000000BB000-memory.dmp

Filesize
172KB

Download
memory/2568-16-0x0000000000090000-0x00000000000BB000-memory.dmp

Filesize
172KB

Download
memory/2568-18-0x0000000000090000-0x00000000000BB000-memory.dmp

Filesize
172KB

Download
memory/2568-19-0x0000000000090000-0x00000000000BB000-memory.dmp

Filesize
172KB

Download