zloader | d538dfafbdf6ac115c24dbdd68c65dbef6460808dd2c4f3fc01d5e15bfc2f902

Resubmissions

08/12/2023, 10:30

231208-mj7y5aaf75 10

13/03/2022, 04:08

220313-eqel6aeddm 1

Analysis

max time kernel
985s
max time network
985s
platform
windows7_x64
resource
win7-20231201-en
resource tags

arch:x64arch:x86image:win7-20231201-enlocale:en-usos:windows7-x64system
submitted
08/12/2023, 10:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

zloader.dll
Size

472KB
MD5

dea7ef874f21922114e030ab165635e4
SHA1

478431cb35563783340cbfd69f5eef74a808f5bf
SHA256

d538dfafbdf6ac115c24dbdd68c65dbef6460808dd2c4f3fc01d5e15bfc2f902
SHA512

eab49f24a3b6772dcf753bd31119eb1c3d863c15dfce577fcd52c2688d18364d6708e40f53d76bf59747f592ada8b71be24f4bb52fb69ebbc07927fe0bee60fe
SSDEEP

12288:zayq7dYtaR2FV9DAuuasxaunyIVTyMAzj:zxvta+jmnlVTIzj

Score

10^/10

zloader april24misha april24misha botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

April24misha

Campaign

April24misha

http://wmwifbajxxbcxmucxmlc.com/post.php

http://onfovdaqqrwbvdfoqnof.com/post.php

http://cmmxhurildiigqghlryq.com/post.php

http://nmqsmbiabjdnuushksas.com/post.php

http://fvqlkgedqjiqgapudkgq.com/post.php

http://iawfqecrwohcxnhwtofa.com/post.php

http://nlbmfsyplohyaicmxhum.com/post.php

http://snnmnkxdhflwgthqismb.com/post.php

Attributes

build_id
122

rc4.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1744 set thread context of 2732	1744	rundll32.exe	31

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2732	msiexec.exe
Token: SeSecurityPrivilege	2732	msiexec.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 1744	1704	rundll32.exe	28
PID 1704 wrote to memory of 1744	1704	rundll32.exe	28
PID 1704 wrote to memory of 1744	1704	rundll32.exe	28
PID 1704 wrote to memory of 1744	1704	rundll32.exe	28
PID 1704 wrote to memory of 1744	1704	rundll32.exe	28
PID 1704 wrote to memory of 1744	1704	rundll32.exe	28
PID 1704 wrote to memory of 1744	1704	rundll32.exe	28
PID 1744 wrote to memory of 2732	1744	rundll32.exe	31
PID 1744 wrote to memory of 2732	1744	rundll32.exe	31
PID 1744 wrote to memory of 2732	1744	rundll32.exe	31
PID 1744 wrote to memory of 2732	1744	rundll32.exe	31
PID 1744 wrote to memory of 2732	1744	rundll32.exe	31
PID 1744 wrote to memory of 2732	1744	rundll32.exe	31
PID 1744 wrote to memory of 2732	1744	rundll32.exe	31
PID 1744 wrote to memory of 2732	1744	rundll32.exe	31
PID 1744 wrote to memory of 2732	1744	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\zloader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\zloader.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1744-0-0x0000000072860000-0x00000000737DF000-memory.dmp

Filesize
15.5MB

Download
memory/1744-1-0x0000000072860000-0x00000000737DF000-memory.dmp

Filesize
15.5MB

Download
memory/1744-2-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/1744-10-0x0000000072860000-0x00000000737DF000-memory.dmp

Filesize
15.5MB

Download
memory/2732-7-0x00000000000D0000-0x0000000000104000-memory.dmp

Filesize
208KB

Download
memory/2732-8-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/2732-9-0x00000000000D0000-0x0000000000104000-memory.dmp

Filesize
208KB

Download
memory/2732-12-0x00000000000D0000-0x0000000000104000-memory.dmp

Filesize
208KB

Download