zloader | ce4edec3111f584bc29e51a2b92011c0316f5bc570b00fc4eba16e15e426d5ef

Analysis

Target

afd0df3341add43b263b1ecb4a52905c.dll
Size

667KB
MD5

afd0df3341add43b263b1ecb4a52905c
SHA1

d8dc8121ed006cf2a77e671e01e8bbc921695541
SHA256

ce4edec3111f584bc29e51a2b92011c0316f5bc570b00fc4eba16e15e426d5ef
SHA512

13584a0fb48fb1396239182c14a9f341c03099b6247a7f361dcba5e1e55e8ce58b3a734d6eadeb4cbbfe37678621d06202c3f3b4fb82211d2ba55093705e9674

Score

10^/10

Family

zloader

Botnet

dll26

Campaign

dll26

https://eecakesconf.at/web982/gate.php

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1096 wrote to memory of 1784	1096	rundll32.exe	rundll32.exe
PID 1096 wrote to memory of 1784	1096	rundll32.exe	rundll32.exe
PID 1096 wrote to memory of 1784	1096	rundll32.exe	rundll32.exe
PID 1096 wrote to memory of 1784	1096	rundll32.exe	rundll32.exe
PID 1096 wrote to memory of 1784	1096	rundll32.exe	rundll32.exe
PID 1096 wrote to memory of 1784	1096	rundll32.exe	rundll32.exe
PID 1096 wrote to memory of 1784	1096	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\afd0df3341add43b263b1ecb4a52905c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1096

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\afd0df3341add43b263b1ecb4a52905c.dll,#1
2⤵
PID:1784

memory/388-7-0x000007FEF77D0000-0x000007FEF7A4A000-memory.dmp

Filesize
2.5MB

Download
memory/1532-4-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/1532-3-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/1532-5-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/1532-6-0x0000000000000000-mapping.dmp

Download
memory/1784-2-0x0000000000000000-mapping.dmp

Download