zloader | f84e08a4d83f63cb37f7117f401c242ecbd3ebbd6b7a12fb99332bcf5950f803

Resubmissions

23-01-2024 11:22

240123-ng2j1ahgel 10

26-06-2020 17:36

200626-xs19z3xc5a 10

Analysis

max time kernel
901s
max time network
903s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
23-01-2024 11:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.BScope.TrojanSpy.Ursnif.dll
Size

426KB
MD5

95d3b622d696c1a31dbef624a2e47163
SHA1

8a1c5a4f794af421e7b54471ed7f4a62212721a0
SHA256

f84e08a4d83f63cb37f7117f401c242ecbd3ebbd6b7a12fb99332bcf5950f803
SHA512

c3ac8a246e7d769faa21f330c5c0a0fef4c4e33a6875478e43ee891f367e90fee3ea657b08ba338f6263e38b17efe69b7c5c1c86167afc871b9a20f251fd67d1
SSDEEP

6144:gJf9uWKIWhnuEbXDcQ/MUF0140znw+i/ZEOEHDLDXRYWQ:g6Jhu0IQ/MUwcDENTQ

Score

10^/10

zloader june26 june botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

june26

Campaign

june

http://snnmnkxdhflwgthqismb.com/web/post.php

http://nlbmfsyplohyaicmxhum.com/web/post.php

http://softwareserviceupdater1.com/web/post.php

http://softwareserviceupdater2.com/web/post.php

Attributes

build_id
10

rc4.plain

rsa_pubkey.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2524 set thread context of 2948	2524	regsvr32.exe	31

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2948	msiexec.exe
Token: SeSecurityPrivilege	2948	msiexec.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 2524	1188	regsvr32.exe	28
PID 1188 wrote to memory of 2524	1188	regsvr32.exe	28
PID 1188 wrote to memory of 2524	1188	regsvr32.exe	28
PID 1188 wrote to memory of 2524	1188	regsvr32.exe	28
PID 1188 wrote to memory of 2524	1188	regsvr32.exe	28
PID 1188 wrote to memory of 2524	1188	regsvr32.exe	28
PID 1188 wrote to memory of 2524	1188	regsvr32.exe	28
PID 2524 wrote to memory of 2948	2524	regsvr32.exe	31
PID 2524 wrote to memory of 2948	2524	regsvr32.exe	31
PID 2524 wrote to memory of 2948	2524	regsvr32.exe	31
PID 2524 wrote to memory of 2948	2524	regsvr32.exe	31
PID 2524 wrote to memory of 2948	2524	regsvr32.exe	31
PID 2524 wrote to memory of 2948	2524	regsvr32.exe	31
PID 2524 wrote to memory of 2948	2524	regsvr32.exe	31
PID 2524 wrote to memory of 2948	2524	regsvr32.exe	31
PID 2524 wrote to memory of 2948	2524	regsvr32.exe	31

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BScope.TrojanSpy.Ursnif.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BScope.TrojanSpy.Ursnif.dll
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2524-0-0x0000000075010000-0x0000000075097000-memory.dmp

Filesize
540KB

Download
memory/2524-1-0x0000000075010000-0x0000000075097000-memory.dmp

Filesize
540KB

Download
memory/2524-7-0x0000000075010000-0x0000000075097000-memory.dmp

Filesize
540KB

Download
memory/2524-13-0x0000000075010000-0x0000000075097000-memory.dmp

Filesize
540KB

Download
memory/2948-10-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/2948-8-0x0000000000090000-0x00000000000BB000-memory.dmp

Filesize
172KB

Download
memory/2948-12-0x0000000000090000-0x00000000000BB000-memory.dmp

Filesize
172KB

Download
memory/2948-14-0x0000000000090000-0x00000000000BB000-memory.dmp

Filesize
172KB

Download
memory/2948-16-0x0000000000090000-0x00000000000BB000-memory.dmp

Filesize
172KB

Download
memory/2948-17-0x0000000000090000-0x00000000000BB000-memory.dmp

Filesize
172KB

Download