zloader | ca97bd5dbbcb449c0b49f54d9dceff863678578e2fb9293baa10e5790693cf09

General

Target

ca97bd5dbbcb449c0b49f54d9dceff863678578e2fb9293baa10e5790693cf09.dll
Size

638KB
MD5

51c8980f12f9f2c24350e5e06ffe8b2e
SHA1

3aa5663d81eb8bae16e3217f206e38a3333e04c6
SHA256

ca97bd5dbbcb449c0b49f54d9dceff863678578e2fb9293baa10e5790693cf09
SHA512

e1638f95566c31c723cfc098690a2beff1eba0f292563ae082d603a5ce0d2b88ccec50abe17e4c42fa56677a588db19b5d9000843fd9a64851179bf29603f422
SSDEEP

12288:TMFaRxiRVw4GEBkvkNbBUT29aCBYC8Hc/sdL9nHGqxHZC5gDG+pG/Y6:TMkxh49kvkNbHCW0d5HG0CeJgY6

Score

10^/10

zloader plspam plspam botnet discovery persistence trojan upx

Malware Config

Extracted

Family

zloader

Botnet

PLSPAM

Campaign

PLSPAM

C2

http://marchadvertisingnetwork4.com/post.php

http://marchadvertisingnetwork5.com/post.php

http://marchadvertisingnetwork6.com/post.php

http://marchadvertisingnetwork7.com/post.php

http://marchadvertisingnetwork8.com/post.php

http://marchadvertisingnetwork9.com/post.php

http://marchadvertisingnetwork10.com/post.php

Attributes

build_id
27

rc4.plain

Signatures

Zloader family
zloader
Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Executes dropped EXE 1 IoCs

pid	Process
2632	rundll32mgr.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Gumaydev = "rundll32.exe C:\\Users\\Admin\\AppData\\Roaming\\Huelo\\anonube.dll,DllRegisterServer"	msiexec.exe

Blocklisted process makes network request 3 IoCs

flow	pid	Process
64	3320	msiexec.exe
66	3320	msiexec.exe
89	3320	msiexec.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4732 set thread context of 3320	4732	rundll32.exe	108

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2632-4-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/files/0x0009000000009f13-3.dat	upx
behavioral2/memory/2632-8-0x0000000000400000-0x000000000045D000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
720	2632	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32mgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	3320	msiexec.exe
Token: SeSecurityPrivilege	3320	msiexec.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3380 wrote to memory of 4732	3380	rundll32.exe	86
PID 3380 wrote to memory of 4732	3380	rundll32.exe	86
PID 3380 wrote to memory of 4732	3380	rundll32.exe	86
PID 4732 wrote to memory of 2632	4732	rundll32.exe	87
PID 4732 wrote to memory of 2632	4732	rundll32.exe	87
PID 4732 wrote to memory of 2632	4732	rundll32.exe	87
PID 4732 wrote to memory of 3320	4732	rundll32.exe	108
PID 4732 wrote to memory of 3320	4732	rundll32.exe	108
PID 4732 wrote to memory of 3320	4732	rundll32.exe	108
PID 4732 wrote to memory of 3320	4732	rundll32.exe	108
PID 4732 wrote to memory of 3320	4732	rundll32.exe	108

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca97bd5dbbcb449c0b49f54d9dceff863678578e2fb9293baa10e5790693cf09.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca97bd5dbbcb449c0b49f54d9dceff863678578e2fb9293baa10e5790693cf09.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4732
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2632
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 264
      4⤵
      Program crash
      PID:720
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec.exe
    3⤵
    - Adds Run key to start application
    - Blocklisted process makes network request
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2632 -ip 2632
1⤵
PID:1756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
105KB

MD5
d5ca6e1f080abc64bbb11e098acbeabb

SHA1
1849634bf5a65e1baddddd4452c99dfa003e2647

SHA256
30193b5ccf8a1834eac3502ef165350ab74b107451145f3d2937fdf24b9eceae

SHA512
aa57ce51de38af6212d7339c4baac543a54b0f527621b0ef9e78eca5e5699e8508a154f54f8ac04135527d8417275eeee72a502a362547575699330cc756b161

Download Submit
memory/2632-4-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2632-6-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/2632-8-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/3320-16-0x0000000000F20000-0x0000000000F50000-memory.dmp

Filesize
192KB

Download
memory/4732-1-0x00000000750D0000-0x0000000075190000-memory.dmp

Filesize
768KB

Download
memory/4732-9-0x00000000750D0000-0x0000000075190000-memory.dmp

Filesize
768KB

Download
memory/4732-12-0x00000000750D0000-0x0000000075190000-memory.dmp

Filesize
768KB

Download
memory/4732-11-0x0000000075152000-0x0000000075155000-memory.dmp

Filesize
12KB

Download
memory/4732-18-0x00000000750D0000-0x0000000075190000-memory.dmp

Filesize
768KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads