zloader | 8590e972d263241c145b54e5954895f5cb625d7740fed2ca18866ba77e82a0b0

Analysis

Target

cbe76b68ade1838441294ffc661c7f7329bd26c04de70e4d22c7bfb87ed3c943.dll
Size

523KB
MD5

99dbb0f00c0a4a675ff967249b417903
SHA1

abe0287899a323ec57bacee9edbc85ae7ec0ea30
SHA256

cbe76b68ade1838441294ffc661c7f7329bd26c04de70e4d22c7bfb87ed3c943
SHA512

be518a608d43148d203823f2720ec144b33f2a85e21556e128f6ab0cd079c44af23b0f97fcb6e7d172bfd11be4703b1883a6a6ed1ecc75f8631881b8c5cb76e7

Score

10^/10

Family

zloader

Botnet

googleaktualizacija

Campaign

googleaktualizacija1

https://iqowijsdakm.ru/gate.php

https://wiewjdmkfjn.ru/gate.php

https://dksaoidiakjd.su/gate.php

https://iweuiqjdakjd.su/gate.php

https://yuidskadjna.su/gate.php

https://olksmadnbdj.su/gate.php

https://odsakmdfnbs.com/gate.php

https://odsakjmdnhsaj.com/gate.php

https://odjdnhsaj.com/gate.php

https://odoishsaj.com/gate.php

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1812 wrote to memory of 844	1812	rundll32.exe	rundll32.exe
PID 1812 wrote to memory of 844	1812	rundll32.exe	rundll32.exe
PID 1812 wrote to memory of 844	1812	rundll32.exe	rundll32.exe
PID 1812 wrote to memory of 844	1812	rundll32.exe	rundll32.exe
PID 1812 wrote to memory of 844	1812	rundll32.exe	rundll32.exe
PID 1812 wrote to memory of 844	1812	rundll32.exe	rundll32.exe
PID 1812 wrote to memory of 844	1812	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cbe76b68ade1838441294ffc661c7f7329bd26c04de70e4d22c7bfb87ed3c943.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1812

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cbe76b68ade1838441294ffc661c7f7329bd26c04de70e4d22c7bfb87ed3c943.dll,#1
2⤵
PID:844

memory/844-2-0x0000000000000000-mapping.dmp

Download
memory/844-3-0x0000000076241000-0x0000000076243000-memory.dmp

Filesize
8KB

Download
memory/844-4-0x00000000001B0000-0x00000000001FB000-memory.dmp

Filesize
300KB

Download
memory/844-5-0x00000000002D0000-0x00000000002F6000-memory.dmp

Filesize
152KB

Download
memory/1572-9-0x000007FEF79D0000-0x000007FEF7C4A000-memory.dmp

Filesize
2.5MB

Download
memory/1724-6-0x0000000000000000-mapping.dmp

Download
memory/1724-8-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download