zloader | cc87e6581ca91f941f65332b2de0e681d58491b54aff9d0b30afae828a5f5790

Resubmissions

17-11-2023 12:47

231117-p1nb6aad8x 10

05-02-2022 09:59

220205-lz81paaddn 10

Analysis

max time kernel
1153s
max time network
1161s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
17-11-2023 12:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cc87e6581ca91f941f65332b2de0e681d58491b54aff9d0b30afae828a5f5790.dll
Size

539KB
MD5

2169e871d4ca668d1872722d1a0695dc
SHA1

add2bbbac042c328ed71c9fd2efcb9cbce5a89f7
SHA256

cc87e6581ca91f941f65332b2de0e681d58491b54aff9d0b30afae828a5f5790
SHA512

fdb93959e88f9cf59be9c515127d02ec41b1370544c23a82b51a49f51b611231e91549a043d7796acef4e95539c75f8a95046b2b31ea0011104a2762b2504c64
SSDEEP

12288:2fgs/ArUlRabXDUMr6xziFHPSMI0VI/+m3Ian:2fZY2an/JzxOD4an

Score

10^/10

zloader apr14 spam botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

Apr14

Campaign

Spam

http://wmwifbajxxbcxmucxmlc.com/post.php

http://ojnxjgfjlftfkkuxxiqd.com/post.php

http://pwkqhdgytsshkoibaake.com/post.php

http://snnmnkxdhflwgthqismb.com/post.php

http://iawfqecrwohcxnhwtofa.com/post.php

http://nlbmfsyplohyaicmxhum.com/post.php

http://fvqlkgedqjiqgapudkgq.com/post.php

http://cmmxhurildiigqghlryq.com/post.php

http://nmqsmbiabjdnuushksas.com/post.php

http://fyratyubvflktyyjiqgq.com/post.php

Attributes

build_id
102

rc4.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Blocklisted process makes network request 64 IoCs

flow	pid	Process
11	2672	msiexec.exe
12	2672	msiexec.exe
14	2672	msiexec.exe
15	2672	msiexec.exe
16	2672	msiexec.exe
17	2672	msiexec.exe
18	2672	msiexec.exe
19	2672	msiexec.exe
20	2672	msiexec.exe
21	2672	msiexec.exe
22	2672	msiexec.exe
23	2672	msiexec.exe
24	2672	msiexec.exe
27	2672	msiexec.exe
28	2672	msiexec.exe
29	2672	msiexec.exe
30	2672	msiexec.exe
31	2672	msiexec.exe
32	2672	msiexec.exe
33	2672	msiexec.exe
34	2672	msiexec.exe
35	2672	msiexec.exe
36	2672	msiexec.exe
37	2672	msiexec.exe
38	2672	msiexec.exe
46	2672	msiexec.exe
47	2672	msiexec.exe
49	2672	msiexec.exe
50	2672	msiexec.exe
51	2672	msiexec.exe
52	2672	msiexec.exe
53	2672	msiexec.exe
54	2672	msiexec.exe
55	2672	msiexec.exe
56	2672	msiexec.exe
57	2672	msiexec.exe
58	2672	msiexec.exe
59	2672	msiexec.exe
60	2672	msiexec.exe
61	2672	msiexec.exe
62	2672	msiexec.exe
63	2672	msiexec.exe
64	2672	msiexec.exe
65	2672	msiexec.exe
66	2672	msiexec.exe
67	2672	msiexec.exe
68	2672	msiexec.exe
69	2672	msiexec.exe
70	2672	msiexec.exe
71	2672	msiexec.exe
72	2672	msiexec.exe
75	2672	msiexec.exe
77	2672	msiexec.exe
79	2672	msiexec.exe
80	2672	msiexec.exe
81	2672	msiexec.exe
82	2672	msiexec.exe
83	2672	msiexec.exe
84	2672	msiexec.exe
85	2672	msiexec.exe
86	2672	msiexec.exe
87	2672	msiexec.exe
88	2672	msiexec.exe
89	2672	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3044 set thread context of 2672	3044	rundll32.exe	30

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2672	msiexec.exe
Token: SeSecurityPrivilege	2672	msiexec.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 3044	2664	rundll32.exe	27
PID 2664 wrote to memory of 3044	2664	rundll32.exe	27
PID 2664 wrote to memory of 3044	2664	rundll32.exe	27
PID 2664 wrote to memory of 3044	2664	rundll32.exe	27
PID 2664 wrote to memory of 3044	2664	rundll32.exe	27
PID 2664 wrote to memory of 3044	2664	rundll32.exe	27
PID 2664 wrote to memory of 3044	2664	rundll32.exe	27
PID 3044 wrote to memory of 2672	3044	rundll32.exe	30
PID 3044 wrote to memory of 2672	3044	rundll32.exe	30
PID 3044 wrote to memory of 2672	3044	rundll32.exe	30
PID 3044 wrote to memory of 2672	3044	rundll32.exe	30
PID 3044 wrote to memory of 2672	3044	rundll32.exe	30
PID 3044 wrote to memory of 2672	3044	rundll32.exe	30
PID 3044 wrote to memory of 2672	3044	rundll32.exe	30
PID 3044 wrote to memory of 2672	3044	rundll32.exe	30
PID 3044 wrote to memory of 2672	3044	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cc87e6581ca91f941f65332b2de0e681d58491b54aff9d0b30afae828a5f5790.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cc87e6581ca91f941f65332b2de0e681d58491b54aff9d0b30afae828a5f5790.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec.exe
    3⤵
    - Blocklisted process makes network request
    - Suspicious use of AdjustPrivilegeToken
    PID:2672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2eef50ff7ef4f644bec96b254b08a8db

SHA1
dd7bc99c38029cb61eab206052d59ff966526b25

SHA256
5464a86b863699e42f35035667e697c9a4d1765b2af6d8be24795a562f3a71b6

SHA512
9f049cfd1e6ca21d03d170cd038694886c748f3c4cd96a8f0bdb841a7e6ae9fdbae708e79fb9f3b0acf5ae3e252bb22b438a4526908ab92bd9e28981f4619ad8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8BCD.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8BFF.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit
memory/2672-10-0x00000000000D0000-0x0000000000104000-memory.dmp

Filesize
208KB

Download
memory/2672-11-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/2672-13-0x00000000000D0000-0x0000000000104000-memory.dmp

Filesize
208KB

Download
memory/2672-16-0x00000000000D0000-0x0000000000104000-memory.dmp

Filesize
208KB

Download
memory/3044-0-0x00000000753A0000-0x0000000075443000-memory.dmp

Filesize
652KB

Download
memory/3044-1-0x00000000753A0000-0x0000000075443000-memory.dmp

Filesize
652KB

Download
memory/3044-2-0x00000000000B0000-0x00000000000B1000-memory.dmp

Filesize
4KB

Download
memory/3044-14-0x00000000753A0000-0x0000000075443000-memory.dmp

Filesize
652KB

Download