zloader | cc87e6581ca91f941f65332b2de0e681d58491b54aff9d0b30afae828a5f5790

Analysis

max time kernel
164s
max time network
181s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
17-11-2023 17:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cc87e6581ca91f941f65332b2de0e681d58491b54aff9d0b30afae828a5f5790.dll
Size

539KB
MD5

2169e871d4ca668d1872722d1a0695dc
SHA1

add2bbbac042c328ed71c9fd2efcb9cbce5a89f7
SHA256

cc87e6581ca91f941f65332b2de0e681d58491b54aff9d0b30afae828a5f5790
SHA512

fdb93959e88f9cf59be9c515127d02ec41b1370544c23a82b51a49f51b611231e91549a043d7796acef4e95539c75f8a95046b2b31ea0011104a2762b2504c64
SSDEEP

12288:2fgs/ArUlRabXDUMr6xziFHPSMI0VI/+m3Ian:2fZY2an/JzxOD4an

Score

10^/10

zloader apr14 spam botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

Apr14

Campaign

Spam

http://wmwifbajxxbcxmucxmlc.com/post.php

http://ojnxjgfjlftfkkuxxiqd.com/post.php

http://pwkqhdgytsshkoibaake.com/post.php

http://snnmnkxdhflwgthqismb.com/post.php

http://iawfqecrwohcxnhwtofa.com/post.php

http://nlbmfsyplohyaicmxhum.com/post.php

http://fvqlkgedqjiqgapudkgq.com/post.php

http://cmmxhurildiigqghlryq.com/post.php

http://nmqsmbiabjdnuushksas.com/post.php

http://fyratyubvflktyyjiqgq.com/post.php

Attributes

build_id
102

rc4.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Blocklisted process makes network request 17 IoCs

flow	pid	Process
11	2692	msiexec.exe
12	2692	msiexec.exe
14	2692	msiexec.exe
15	2692	msiexec.exe
16	2692	msiexec.exe
17	2692	msiexec.exe
18	2692	msiexec.exe
19	2692	msiexec.exe
20	2692	msiexec.exe
21	2692	msiexec.exe
22	2692	msiexec.exe
23	2692	msiexec.exe
24	2692	msiexec.exe
27	2692	msiexec.exe
28	2692	msiexec.exe
29	2692	msiexec.exe
30	2692	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1724 set thread context of 2692	1724	rundll32.exe	30

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2692	msiexec.exe
Token: SeSecurityPrivilege	2692	msiexec.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 1724	2784	rundll32.exe	27
PID 2784 wrote to memory of 1724	2784	rundll32.exe	27
PID 2784 wrote to memory of 1724	2784	rundll32.exe	27
PID 2784 wrote to memory of 1724	2784	rundll32.exe	27
PID 2784 wrote to memory of 1724	2784	rundll32.exe	27
PID 2784 wrote to memory of 1724	2784	rundll32.exe	27
PID 2784 wrote to memory of 1724	2784	rundll32.exe	27
PID 1724 wrote to memory of 2692	1724	rundll32.exe	30
PID 1724 wrote to memory of 2692	1724	rundll32.exe	30
PID 1724 wrote to memory of 2692	1724	rundll32.exe	30
PID 1724 wrote to memory of 2692	1724	rundll32.exe	30
PID 1724 wrote to memory of 2692	1724	rundll32.exe	30
PID 1724 wrote to memory of 2692	1724	rundll32.exe	30
PID 1724 wrote to memory of 2692	1724	rundll32.exe	30
PID 1724 wrote to memory of 2692	1724	rundll32.exe	30
PID 1724 wrote to memory of 2692	1724	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cc87e6581ca91f941f65332b2de0e681d58491b54aff9d0b30afae828a5f5790.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cc87e6581ca91f941f65332b2de0e681d58491b54aff9d0b30afae828a5f5790.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec.exe
    3⤵
    - Blocklisted process makes network request
    - Suspicious use of AdjustPrivilegeToken
    PID:2692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab871C.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar876D.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit
memory/1724-0-0x00000000750E0000-0x0000000075183000-memory.dmp

Filesize
652KB

Download
memory/1724-1-0x00000000750E0000-0x0000000075183000-memory.dmp

Filesize
652KB

Download
memory/1724-2-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1724-14-0x00000000750E0000-0x0000000075183000-memory.dmp

Filesize
652KB

Download
memory/2692-10-0x0000000000090000-0x00000000000C4000-memory.dmp

Filesize
208KB

Download
memory/2692-12-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download
memory/2692-13-0x0000000000090000-0x00000000000C4000-memory.dmp

Filesize
208KB

Download
memory/2692-15-0x0000000000090000-0x00000000000C4000-memory.dmp

Filesize
208KB

Download
memory/2692-17-0x0000000000090000-0x00000000000C4000-memory.dmp

Filesize
208KB

Download
memory/2692-18-0x0000000000090000-0x00000000000C4000-memory.dmp

Filesize
208KB

Download