zloader | 0d1774171175d150cc859a71fc56cd6a8132c9c679d3bd5c7f065126ed2a071e

Analysis

Target

1254515.dll
Size

843KB
MD5

c247335cbbfc2f607e43773d8c1c0f4a
SHA1

707ab78dab9cf2b5277e668eb1c59be42af6549f
SHA256

0d1774171175d150cc859a71fc56cd6a8132c9c679d3bd5c7f065126ed2a071e
SHA512

6f2c9f2647703aeef053e00b298ce10c1636f839ab5310416b57b496f98e7ffc2fca311938794138930cee95b6dc964c51c81c0570739fc040563ccb79c1412d

Score

10^/10

Family

zloader

Botnet

googleaktualizacija

Campaign

googleaktualizacija2

https://iqowijsdakm.com/gate.php

https://wiewjdmkfjn.com/gate.php

https://dksaoidiakjd.com/gate.php

https://iweuiqjdakjd.com/gate.php

https://yuidskadjna.com/gate.php

https://olksmadnbdj.com/gate.php

https://odsakmdfnbs.com/gate.php

https://odsakjmdnhsaj.com/gate.php

https://odjdnhsaj.com/gate.php

https://odoishsaj.com/gate.php

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 648 wrote to memory of 2280	648	regsvr32.exe	regsvr32.exe
PID 648 wrote to memory of 2280	648	regsvr32.exe	regsvr32.exe
PID 648 wrote to memory of 2280	648	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1254515.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:648

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\1254515.dll
2⤵
PID:2280

memory/208-5-0x0000000000000000-mapping.dmp

Download
memory/208-6-0x00000000008B0000-0x00000000008D6000-memory.dmp

Filesize
152KB

Download
memory/2280-2-0x0000000000000000-mapping.dmp

Download
memory/2280-3-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/2280-4-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download