zloader | fb55aa4029e826e42520861cc82a8db4a3568f1d2b5fe6f39d7bf870ec0005f9

Resubmissions

08-12-2023 09:57

231208-ly41caae27 10

05-02-2022 07:39

220205-jg3pvahcgr 10

Analysis

max time kernel
1172s
max time network
1173s
platform
windows10-2004_x64
resource
win10v2004-20231130-en
resource tags

arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
submitted
08-12-2023 09:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb55aa4029e826e42520861cc82a8db4a3568f1d2b5fe6f39d7bf870ec0005f9.dll
Size

472KB
MD5

1d03a39c5b1f99fc9c33bc4a9811cf0f
SHA1

ede00a9c20689c8c6dc5fa301b46c2a74ebe01af
SHA256

fb55aa4029e826e42520861cc82a8db4a3568f1d2b5fe6f39d7bf870ec0005f9
SHA512

fc3f2d776632fbfb1f3d0c3c32e3e57b818a697a53cc587fef3bc8e15f052573e90fffd493032a28eb7d93db93732efff523d406caf7dc07f733bac1b44fc126
SSDEEP

12288:zayC7dYtaR2FV9DAuuasxaunyIVTyMAzj:zxHta+jmnlVTIzj

Score

10^/10

zloader april24misha april24misha botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

April24misha

Campaign

April24misha

http://wmwifbajxxbcxmucxmlc.com/post.php

http://onfovdaqqrwbvdfoqnof.com/post.php

http://cmmxhurildiigqghlryq.com/post.php

http://nmqsmbiabjdnuushksas.com/post.php

http://fvqlkgedqjiqgapudkgq.com/post.php

http://iawfqecrwohcxnhwtofa.com/post.php

http://nlbmfsyplohyaicmxhum.com/post.php

http://snnmnkxdhflwgthqismb.com/post.php

Attributes

build_id
122

rc4.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1532 set thread context of 4888	1532	rundll32.exe	104

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4888	msiexec.exe
Token: SeSecurityPrivilege	4888	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 1532	220	rundll32.exe	64
PID 220 wrote to memory of 1532	220	rundll32.exe	64
PID 220 wrote to memory of 1532	220	rundll32.exe	64
PID 1532 wrote to memory of 4888	1532	rundll32.exe	104
PID 1532 wrote to memory of 4888	1532	rundll32.exe	104
PID 1532 wrote to memory of 4888	1532	rundll32.exe	104
PID 1532 wrote to memory of 4888	1532	rundll32.exe	104
PID 1532 wrote to memory of 4888	1532	rundll32.exe	104

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb55aa4029e826e42520861cc82a8db4a3568f1d2b5fe6f39d7bf870ec0005f9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb55aa4029e826e42520861cc82a8db4a3568f1d2b5fe6f39d7bf870ec0005f9.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1532-0-0x0000000073CE0000-0x0000000074C5F000-memory.dmp

Filesize
15.5MB

Download
memory/1532-2-0x0000000073CE0000-0x0000000074C5F000-memory.dmp

Filesize
15.5MB

Download
memory/1532-3-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/1532-10-0x0000000073CE0000-0x0000000074C5F000-memory.dmp

Filesize
15.5MB

Download
memory/4888-9-0x0000000000EC0000-0x0000000000EF4000-memory.dmp

Filesize
208KB

Download
memory/4888-12-0x0000000000EC0000-0x0000000000EF4000-memory.dmp

Filesize
208KB

Download