zloader | c1532b3d37ff2ec7d70d7f8037b8cdf843d3cdd24adf860f4251d045ddf9d47c

Resubmissions

15-11-2023 13:29

231115-qrppascc7z 10

25-07-2020 00:15

200725-jw6c5c3brx 10

Analysis

max time kernel
1167s
max time network
1176s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
15-11-2023 13:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

july22.dll
Size

395KB
MD5

94fa4ef5c63b688a2813e95138198cb4
SHA1

24695fee9af688864a789b0415c19918870fdff5
SHA256

c1532b3d37ff2ec7d70d7f8037b8cdf843d3cdd24adf860f4251d045ddf9d47c
SHA512

e3d83795765e9e1f6c87f33494894260956b86fc7d8455c7ac0eb23c3f4d9c227c6e0358745eba7a87e9ff367d9a19adc257c75c59278d0f968f94eb408bf85c
SSDEEP

6144:VhLHWQz0GP/YR2rCnft7BdI7vHFtpuqVtT/C9KxwlfCokKYmT8SNhXDZi5121jYN:/WQz0GYX1dIbHF5V09TlfDTthXc5M1j

Score

10^/10

zloader july20ssl july20ssl botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

July20SSL

Campaign

July20SSL

https://vlcafxbdjtlvlcduwhga.com/web/post.php

https://softwareserviceupdater3.com/web/post.php

https://softwareserviceupdater4.com/web/post.php

Attributes

build_id
18

rc4.plain

rsa_pubkey.plain

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4252 created 3280	4252	rundll32.exe	43

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4252 set thread context of 1904	4252	rundll32.exe	109

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4252	rundll32.exe
4252	rundll32.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4252	rundll32.exe
Token: SeSecurityPrivilege	1904	msiexec.exe
Token: SeSecurityPrivilege	1904	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 4252	2908	rundll32.exe	86
PID 2908 wrote to memory of 4252	2908	rundll32.exe	86
PID 2908 wrote to memory of 4252	2908	rundll32.exe	86
PID 4252 wrote to memory of 1904	4252	rundll32.exe	109
PID 4252 wrote to memory of 1904	4252	rundll32.exe	109
PID 4252 wrote to memory of 1904	4252	rundll32.exe	109
PID 4252 wrote to memory of 1904	4252	rundll32.exe	109
PID 4252 wrote to memory of 1904	4252	rundll32.exe	109

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3280
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\july22.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\july22.dll,#1
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4252
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1904-11-0x0000000000960000-0x000000000098B000-memory.dmp

Filesize
172KB

Download
memory/1904-13-0x0000000000960000-0x000000000098B000-memory.dmp

Filesize
172KB

Download
memory/1904-15-0x0000000000960000-0x000000000098B000-memory.dmp

Filesize
172KB

Download
memory/1904-16-0x0000000000960000-0x000000000098B000-memory.dmp

Filesize
172KB

Download
memory/4252-1-0x0000000010000000-0x0000000010073000-memory.dmp

Filesize
460KB

Download
memory/4252-2-0x00000000008C0000-0x00000000008C1000-memory.dmp

Filesize
4KB

Download
memory/4252-3-0x0000000010000000-0x0000000010073000-memory.dmp

Filesize
460KB

Download
memory/4252-5-0x00000000008C0000-0x00000000008C1000-memory.dmp

Filesize
4KB

Download
memory/4252-12-0x0000000010000000-0x0000000010073000-memory.dmp

Filesize
460KB

Download