zloader | 026760f8167753f0a3f95b232f0a23cad6d18295e9b68381d7f61c20364c6e9b

Analysis

Target

1243656.bin.dll
Size

281KB
MD5

7a4334c164c28530b28858559643c6b9
SHA1

ee3ebcb8b28702c50b0083db163ba5876f40f54c
SHA256

b250b1ccb8194ce1ccc86b4a88bd7279f6804fac990758e95d203fdd1d97dcc2
SHA512

e58a00c9b7b947d573632097eb056b5791b0b3d4577ff5e4635b8056076d599240e128ac948a995c2c8102b2a2d4550c0d7edbd3d684f5364c44467f64e50c45

Score

10^/10

Family

zloader

Botnet

googleaktualizacija

Campaign

googleaktualizacija2

https://iqowijsdakm.com/gate.php

https://wiewjdmkfjn.com/gate.php

https://dksaoidiakjd.com/gate.php

https://iweuiqjdakjd.com/gate.php

https://yuidskadjna.com/gate.php

https://olksmadnbdj.com/gate.php

https://odsakmdfnbs.com/gate.php

https://odsakjmdnhsaj.com/gate.php

https://odjdnhsaj.com/gate.php

https://odoishsaj.com/gate.php

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1724 wrote to memory of 1908	1724	regsvr32.exe	regsvr32.exe
PID 1724 wrote to memory of 1908	1724	regsvr32.exe	regsvr32.exe
PID 1724 wrote to memory of 1908	1724	regsvr32.exe	regsvr32.exe
PID 1724 wrote to memory of 1908	1724	regsvr32.exe	regsvr32.exe
PID 1724 wrote to memory of 1908	1724	regsvr32.exe	regsvr32.exe
PID 1724 wrote to memory of 1908	1724	regsvr32.exe	regsvr32.exe
PID 1724 wrote to memory of 1908	1724	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1243656.bin.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1724

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\1243656.bin.dll
2⤵
PID:1908

memory/1296-10-0x000007FEF7D90000-0x000007FEF800A000-memory.dmp

Filesize
2.5MB

Download
memory/1724-2-0x000007FEFC601000-0x000007FEFC603000-memory.dmp

Filesize
8KB

Download
memory/1908-3-0x0000000000000000-mapping.dmp

Download
memory/1908-4-0x00000000761E1000-0x00000000761E3000-memory.dmp

Filesize
8KB

Download
memory/1908-5-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/1908-6-0x0000000000100000-0x000000000014F000-memory.dmp

Filesize
316KB

Download
memory/2040-7-0x0000000000000000-mapping.dmp

Download
memory/2040-9-0x00000000000D0000-0x00000000000F6000-memory.dmp

Filesize
152KB

Download