zloader | de7da2ce5f2d7e5415bc3256cc5b7f97878ae9436497660b9add78829a8650cf

Resubmissions

15-11-2023 12:50

231115-p3c9zacb5x 10

22-07-2020 17:01

200722-kpynvy9y5s 10

Analysis

max time kernel
915s
max time network
918s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
15-11-2023 12:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cYNhXOc.dll
Size

395KB
MD5

4aaf7ca556de0be48d9bb5bed405fa88
SHA1

b85f9bf19e02f7756ee4aeb32c41d4b117a75045
SHA256

de7da2ce5f2d7e5415bc3256cc5b7f97878ae9436497660b9add78829a8650cf
SHA512

31911b68c382f04ca332c55274a31a20822b444f51a4ff407901deb686b035e209cf209ab997c03a40341de0ec868e83e701ae0950d577c7aac6f5f654e74c22
SSDEEP

6144:VhLHWQzNGP/YR2rCnft7BdI7vHFtpuqVtT/C9KxwlfCokKYmT8SNhXDZi5121jYN:/WQzNGYX1dIbHF5V09TlfDTthXc5M1j

Score

10^/10

zloader july20ssl july20ssl botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

July20SSL

Campaign

July20SSL

https://vlcafxbdjtlvlcduwhga.com/web/post.php

https://softwareserviceupdater3.com/web/post.php

https://softwareserviceupdater4.com/web/post.php

Attributes

build_id
18

rc4.plain

rsa_pubkey.plain

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2828 created 1280	2828	rundll32.exe	17

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2828 set thread context of 2956	2828	rundll32.exe	31

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2828	rundll32.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2828	rundll32.exe
Token: SeSecurityPrivilege	2956	msiexec.exe
Token: SeSecurityPrivilege	2956	msiexec.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 2828	2600	rundll32.exe	28
PID 2600 wrote to memory of 2828	2600	rundll32.exe	28
PID 2600 wrote to memory of 2828	2600	rundll32.exe	28
PID 2600 wrote to memory of 2828	2600	rundll32.exe	28
PID 2600 wrote to memory of 2828	2600	rundll32.exe	28
PID 2600 wrote to memory of 2828	2600	rundll32.exe	28
PID 2600 wrote to memory of 2828	2600	rundll32.exe	28
PID 2828 wrote to memory of 2956	2828	rundll32.exe	31
PID 2828 wrote to memory of 2956	2828	rundll32.exe	31
PID 2828 wrote to memory of 2956	2828	rundll32.exe	31
PID 2828 wrote to memory of 2956	2828	rundll32.exe	31
PID 2828 wrote to memory of 2956	2828	rundll32.exe	31
PID 2828 wrote to memory of 2956	2828	rundll32.exe	31
PID 2828 wrote to memory of 2956	2828	rundll32.exe	31
PID 2828 wrote to memory of 2956	2828	rundll32.exe	31
PID 2828 wrote to memory of 2956	2828	rundll32.exe	31

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1280
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cYNhXOc.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\cYNhXOc.dll,#1
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2828
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2828-0-0x0000000010000000-0x0000000010073000-memory.dmp

Filesize
460KB

Download
memory/2828-1-0x0000000010000000-0x0000000010073000-memory.dmp

Filesize
460KB

Download
memory/2828-2-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2828-15-0x0000000010000000-0x0000000010073000-memory.dmp

Filesize
460KB

Download
memory/2956-11-0x0000000000090000-0x00000000000BB000-memory.dmp

Filesize
172KB

Download
memory/2956-12-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/2956-14-0x0000000000090000-0x00000000000BB000-memory.dmp

Filesize
172KB

Download
memory/2956-17-0x0000000000090000-0x00000000000BB000-memory.dmp

Filesize
172KB

Download