zloader | fa09c9ab2f3fc8d3c6541cb835769792d6bc041ba5aa1d04a22be1608791ad9e

Resubmissions

31-10-2023 10:08

231031-l564aafc8y 10

01-08-2020 19:35

200801-yxa2qg44dx 10

Analysis

max time kernel
1796s
max time network
1801s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
31-10-2023 10:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Trojan.GenericKD.34222957.15631.dll
Size

395KB
MD5

5120008536c0de7bf6030f10377ec8c0
SHA1

778a0fd8c2b307ad1aba4a66fadef2ff3306d5d0
SHA256

fa09c9ab2f3fc8d3c6541cb835769792d6bc041ba5aa1d04a22be1608791ad9e
SHA512

83f151f19a5cada9420040522d21b52943793530e5e43d1e0e47f8b4cc726d4b741663d4c8b8ef03649c1b281cd9c702419cb580abc555317363e7b8d02edb15
SSDEEP

6144:VhLHWQznGP/YR2rCnft7BdI7vHFtpuqVtT/C9KxwlfCokKYmT8SNhXDZi5121jYN:/WQznGYX1dIbHF5V09TlfDTthXc5M1j

Score

10^/10

zloader july20ssl july20ssl botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

July20SSL

Campaign

July20SSL

https://vlcafxbdjtlvlcduwhga.com/web/post.php

https://softwareserviceupdater3.com/web/post.php

https://softwareserviceupdater4.com/web/post.php

Attributes

build_id
18

rc4.plain

rsa_pubkey.plain

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3280 created 3096	3280	rundll32.exe	34

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3280 set thread context of 4192	3280	rundll32.exe	110

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3280	rundll32.exe
3280	rundll32.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3280	rundll32.exe
Token: SeSecurityPrivilege	4192	msiexec.exe
Token: SeSecurityPrivilege	4192	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 3280	4836	rundll32.exe	88
PID 4836 wrote to memory of 3280	4836	rundll32.exe	88
PID 4836 wrote to memory of 3280	4836	rundll32.exe	88
PID 3280 wrote to memory of 4192	3280	rundll32.exe	110
PID 3280 wrote to memory of 4192	3280	rundll32.exe	110
PID 3280 wrote to memory of 4192	3280	rundll32.exe	110
PID 3280 wrote to memory of 4192	3280	rundll32.exe	110
PID 3280 wrote to memory of 4192	3280	rundll32.exe	110

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3096
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.34222957.15631.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.34222957.15631.dll,#1
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3280
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3280-1-0x0000000010000000-0x0000000010073000-memory.dmp

Filesize
460KB

Download
memory/3280-0-0x0000000010000000-0x0000000010073000-memory.dmp

Filesize
460KB

Download
memory/3280-2-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

Filesize
4KB

Download
memory/3280-3-0x0000000010000000-0x0000000010073000-memory.dmp

Filesize
460KB

Download
memory/3280-4-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

Filesize
4KB

Download
memory/3280-12-0x0000000010000000-0x0000000010073000-memory.dmp

Filesize
460KB

Download
memory/4192-11-0x00000000007C0000-0x00000000007EB000-memory.dmp

Filesize
172KB

Download
memory/4192-14-0x00000000007C0000-0x00000000007EB000-memory.dmp

Filesize
172KB

Download