zloader | d538dfafbdf6ac115c24dbdd68c65dbef6460808dd2c4f3fc01d5e15bfc2f902

Resubmissions

08-12-2023 10:30

231208-mj7y5aaf75 10

13-03-2022 04:08

220313-eqel6aeddm 1

Analysis

max time kernel
1171s
max time network
1172s
platform
windows10-2004_x64
resource
win10v2004-20231201-en
resource tags

arch:x64arch:x86image:win10v2004-20231201-enlocale:en-usos:windows10-2004-x64system
submitted
08-12-2023 10:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

zloader.dll
Size

472KB
MD5

dea7ef874f21922114e030ab165635e4
SHA1

478431cb35563783340cbfd69f5eef74a808f5bf
SHA256

d538dfafbdf6ac115c24dbdd68c65dbef6460808dd2c4f3fc01d5e15bfc2f902
SHA512

eab49f24a3b6772dcf753bd31119eb1c3d863c15dfce577fcd52c2688d18364d6708e40f53d76bf59747f592ada8b71be24f4bb52fb69ebbc07927fe0bee60fe
SSDEEP

12288:zayq7dYtaR2FV9DAuuasxaunyIVTyMAzj:zxvta+jmnlVTIzj

Score

10^/10

zloader april24misha april24misha botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

April24misha

Campaign

April24misha

http://wmwifbajxxbcxmucxmlc.com/post.php

http://onfovdaqqrwbvdfoqnof.com/post.php

http://cmmxhurildiigqghlryq.com/post.php

http://nmqsmbiabjdnuushksas.com/post.php

http://fvqlkgedqjiqgapudkgq.com/post.php

http://iawfqecrwohcxnhwtofa.com/post.php

http://nlbmfsyplohyaicmxhum.com/post.php

http://snnmnkxdhflwgthqismb.com/post.php

Attributes

build_id
122

rc4.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4756 set thread context of 3468	4756	rundll32.exe	97

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	3468	msiexec.exe
Token: SeSecurityPrivilege	3468	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4056 wrote to memory of 4756	4056	rundll32.exe	27
PID 4056 wrote to memory of 4756	4056	rundll32.exe	27
PID 4056 wrote to memory of 4756	4056	rundll32.exe	27
PID 4756 wrote to memory of 3468	4756	rundll32.exe	97
PID 4756 wrote to memory of 3468	4756	rundll32.exe	97
PID 4756 wrote to memory of 3468	4756	rundll32.exe	97
PID 4756 wrote to memory of 3468	4756	rundll32.exe	97
PID 4756 wrote to memory of 3468	4756	rundll32.exe	97

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\zloader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\zloader.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3468-7-0x0000000000580000-0x00000000005B4000-memory.dmp

Filesize
208KB

Download
memory/3468-9-0x0000000000580000-0x00000000005B4000-memory.dmp

Filesize
208KB

Download
memory/3468-11-0x0000000000580000-0x00000000005B4000-memory.dmp

Filesize
208KB

Download
memory/3468-12-0x0000000000580000-0x00000000005B4000-memory.dmp

Filesize
208KB

Download
memory/4756-0-0x0000000073A10000-0x000000007498F000-memory.dmp

Filesize
15.5MB

Download
memory/4756-1-0x0000000073A10000-0x000000007498F000-memory.dmp

Filesize
15.5MB

Download
memory/4756-2-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/4756-8-0x0000000073A10000-0x000000007498F000-memory.dmp

Filesize
15.5MB

Download