zloader | f84e08a4d83f63cb37f7117f401c242ecbd3ebbd6b7a12fb99332bcf5950f803

Resubmissions

23-01-2024 11:22

240123-ng2j1ahgel 10

26-06-2020 17:36

200626-xs19z3xc5a 10

Analysis

max time kernel
1161s
max time network
1166s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
23-01-2024 11:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.BScope.TrojanSpy.Ursnif.dll
Size

426KB
MD5

95d3b622d696c1a31dbef624a2e47163
SHA1

8a1c5a4f794af421e7b54471ed7f4a62212721a0
SHA256

f84e08a4d83f63cb37f7117f401c242ecbd3ebbd6b7a12fb99332bcf5950f803
SHA512

c3ac8a246e7d769faa21f330c5c0a0fef4c4e33a6875478e43ee891f367e90fee3ea657b08ba338f6263e38b17efe69b7c5c1c86167afc871b9a20f251fd67d1
SSDEEP

6144:gJf9uWKIWhnuEbXDcQ/MUF0140znw+i/ZEOEHDLDXRYWQ:g6Jhu0IQ/MUwcDENTQ

Score

10^/10

zloader june26 june botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

june26

Campaign

june

http://snnmnkxdhflwgthqismb.com/web/post.php

http://nlbmfsyplohyaicmxhum.com/web/post.php

http://softwareserviceupdater1.com/web/post.php

http://softwareserviceupdater2.com/web/post.php

Attributes

build_id
10

rc4.plain

rsa_pubkey.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 908 set thread context of 2352	908	regsvr32.exe	97

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2352	msiexec.exe
Token: SeSecurityPrivilege	2352	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 908	2172	regsvr32.exe	85
PID 2172 wrote to memory of 908	2172	regsvr32.exe	85
PID 2172 wrote to memory of 908	2172	regsvr32.exe	85
PID 908 wrote to memory of 2352	908	regsvr32.exe	97
PID 908 wrote to memory of 2352	908	regsvr32.exe	97
PID 908 wrote to memory of 2352	908	regsvr32.exe	97
PID 908 wrote to memory of 2352	908	regsvr32.exe	97
PID 908 wrote to memory of 2352	908	regsvr32.exe	97

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BScope.TrojanSpy.Ursnif.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BScope.TrojanSpy.Ursnif.dll
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:908
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2352

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/908-0-0x0000000075490000-0x0000000075517000-memory.dmp

Filesize
540KB

Download
memory/908-1-0x00000000029A0000-0x00000000029A1000-memory.dmp

Filesize
4KB

Download
memory/908-2-0x0000000075490000-0x0000000075517000-memory.dmp

Filesize
540KB

Download
memory/908-8-0x0000000075490000-0x0000000075517000-memory.dmp

Filesize
540KB

Download
memory/2352-7-0x00000000004E0000-0x000000000050B000-memory.dmp

Filesize
172KB

Download
memory/2352-10-0x00000000004E0000-0x000000000050B000-memory.dmp

Filesize
172KB

Download