zloader | 635a1f8e2eff8717c791f846b6e7a4b0c1d1d84d93c20630686d5079a9ede5c3

Analysis

Target

SecuriteInfo.com.Trojan-Banker.Win32.Cridex.gen.10545.dll
Size

667KB
MD5

b92aa4b3201734007fbce2e237fe091f
SHA1

9982a7d1af6b13e48c39fd2327ac3181f09856e1
SHA256

635a1f8e2eff8717c791f846b6e7a4b0c1d1d84d93c20630686d5079a9ede5c3
SHA512

6116392f19c439a2c029b2e48641730429d084183f4ab29f75eba4bc3f172984e30afbec31643193faf93b2aa10d0bea9af4e36dc7eb13e86baba1f467c82574

Score

10^/10

Family

zloader

Botnet

dll26

Campaign

dll26

https://eecakesconf.at/web982/gate.php

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1036 wrote to memory of 1900	1036	rundll32.exe	rundll32.exe
PID 1036 wrote to memory of 1900	1036	rundll32.exe	rundll32.exe
PID 1036 wrote to memory of 1900	1036	rundll32.exe	rundll32.exe
PID 1036 wrote to memory of 1900	1036	rundll32.exe	rundll32.exe
PID 1036 wrote to memory of 1900	1036	rundll32.exe	rundll32.exe
PID 1036 wrote to memory of 1900	1036	rundll32.exe	rundll32.exe
PID 1036 wrote to memory of 1900	1036	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan-Banker.Win32.Cridex.gen.10545.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1036

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan-Banker.Win32.Cridex.gen.10545.dll,#1
2⤵
PID:1900

memory/1164-5-0x000007FEF7020000-0x000007FEF729A000-memory.dmp

Filesize
2.5MB

Download
memory/1756-1-0x00000000000D0000-0x00000000000F6000-memory.dmp

Filesize
152KB

Download
memory/1756-2-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/1756-3-0x00000000000D0000-0x00000000000F6000-memory.dmp

Filesize
152KB

Download
memory/1756-4-0x0000000000000000-mapping.dmp

Download
memory/1900-0-0x0000000000000000-mapping.dmp

Download