zloader | 481af12b4e027b76b68c817c3cb806291f52042d3b5dce2e9f073408f596e206 | Triage™

Analysis

max time kernel
63s
max time network
152s
platform
windows10_x64
resource
win10
submitted
24/10/2020, 09:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ihuwma.dll
Size 538KB
Sample201024-brxeft3xss
SHA256 481af12b4e027b76b68c817c3cb806291f52042d3b5dce2e9f073408f596e206
MD5 80be8f74f423ffd951a2a807ab5815c9
SHA1 953610bd3f74f02f959b54c8832028404c96b8db
SHA512 c77aabf3d291197ba21ae1a08821dd7113e00cbc0c4e0b5874ef62d9d6850bed0eb67d72f5e7cc20fca611aedb2c2964e2b8ab6a5fe7817c0acf3f43905a31a0
MD5 SHA1 SHA512

Score

10^/10

trojan botnet zloader

Malware Config

Extracted

Family

zloader

Botnet

jw

Campaign

jw

C2

https://kochamkkkras.ru/gate.php
https://uookqihwdid.ru/gate.php
https://iqowijsdakm.ru/gate.php
https://wiewjdmkfjn.ru/gate.php
https://dksaoidiakjd.su/gate.php
https://iweuiqjdakjd.su/gate.php
https://yuidskadjna.su/gate.php
https://olksmadnbdj.su/gate.php
https://odsakmdfnbs.su/gate.php
https://odsakjmdnhsaj.su/gate.php

rc4.plain

rsa_pubkey.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3852 wrote to memory of 3228	3852	rundll32.exe	68
PID 3852 wrote to memory of 3228	3852	rundll32.exe	68
PID 3852 wrote to memory of 3228	3852	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ihuwma.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ihuwma.dll,#1
  2⤵
  PID:3228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/744-1-0x0000000000CF0000-0x0000000000D16000-memory.dmp

Download