zloader | 2ec1659438816ccaeedbc9f36e35b7adf24cd6153c5e0a43855a5b8103b272fc

Analysis

Target

420d173305f5d46ca47fc49999f9b1bf.dll
Size

667KB
MD5

420d173305f5d46ca47fc49999f9b1bf
SHA1

0a012f03c260c67100b757dac6422408f46cc1a3
SHA256

2ec1659438816ccaeedbc9f36e35b7adf24cd6153c5e0a43855a5b8103b272fc
SHA512

f054be14b644bc54123bafd3ede2dbd48211ef1a9d37635d82952e62cc87243ce1f20ae16f3e009140ce388f615e2b2d8ce035c51e386135998306ea68f4312a

Score

10^/10

Family

zloader

Botnet

dll26

Campaign

dll26

https://eecakesconf.at/web982/gate.php

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1824 wrote to memory of 2036	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 2036	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 2036	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 2036	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 2036	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 2036	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 2036	1824	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\420d173305f5d46ca47fc49999f9b1bf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1824

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\420d173305f5d46ca47fc49999f9b1bf.dll,#1
2⤵
PID:2036

memory/544-7-0x000007FEF5D50000-0x000007FEF5FCA000-memory.dmp

Filesize
2.5MB

Download
memory/1508-4-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download
memory/1508-3-0x0000000000130000-0x0000000000156000-memory.dmp

Filesize
152KB

Download
memory/1508-5-0x0000000000130000-0x0000000000156000-memory.dmp

Filesize
152KB

Download
memory/1508-6-0x0000000000000000-mapping.dmp

Download
memory/2036-2-0x0000000000000000-mapping.dmp

Download