zloader | 4c414d6237c225d3bba766647807b0f2c32d4f400e585ee3f7fbe3d8b3b54c70 | Triage

Analysis

max time kernel
98s
max time network
8s
platform
windows7_x64
resource
win7v20201028
submitted
14-12-2020 17:13

Sharing

Report Analysis Logs

General

Target

f7c5fdac4daf9505c16d353fa9b0b577.dll
Size

667KB
MD5

f7c5fdac4daf9505c16d353fa9b0b577
SHA1

0195de0967e2a5a851280fd99464ec739e0979dd
SHA256

4c414d6237c225d3bba766647807b0f2c32d4f400e585ee3f7fbe3d8b3b54c70
SHA512

e1f4fc7518895b6e936f4b528ff922f47c7dbe9596c3cf4f38fabf1e2a36117bf04269bb1f64b3beada6ccca6713c7f4bc79345f45e71dc691562bf6ba137892

Score

10^/10

zloader dll26 dll26 botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

dll26

Campaign

dll26

C2

https://eecakesconf.at/web982/gate.php

rc4.plain

rsa_pubkey.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1824 wrote to memory of 1192	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 1192	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 1192	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 1192	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 1192	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 1192	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 1192	1824	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7c5fdac4daf9505c16d353fa9b0b577.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1824

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7c5fdac4daf9505c16d353fa9b0b577.dll,#1
2⤵
PID:1192

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
3⤵
PID:284

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/284-3-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/284-4-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/284-5-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/284-6-0x0000000000000000-mapping.dmp

Download
memory/1192-2-0x0000000000000000-mapping.dmp

Download