1391343.dll

General
Target

1391343.dll

Filesize

500KB

Completed

16-03-2021 10:23

Score
10 /10
MD5

c91aa7c80fa2e6fbf094040caeabca14

SHA1

aaa87f6e2b6f923df5aa4b92ebe70bb744d1f311

SHA256

e5af4868fc46a5a675d9e93c4e45b9fef7043fe2263ad0bd9469082c00d74139

Malware Config

Extracted

Family zloader
Botnet googleaktualizacija
Campaign googleaktualizacija2
C2

https://iqowijsdakm.com/gate.php

https://wiewjdmkfjn.com/gate.php

https://dksaoidiakjd.com/gate.php

https://iweuiqjdakjd.com/gate.php

https://yuidskadjna.com/gate.php

https://olksmadnbdj.com/gate.php

https://odsakmdfnbs.com/gate.php

https://odsakjmdnhsaj.com/gate.php

https://odjdnhsaj.com/gate.php

https://odoishsaj.com/gate.php

rc4.plain
rsa_pubkey.plain
Signatures 2

Filter: none

  • Zloader, Terdot, DELoader, ZeusSphinx

    Description

    Zloader is a malware strain that was initially discovered back in August 2015.

  • Suspicious use of WriteProcessMemory
    regsvr32.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1924 wrote to memory of 12001924regsvr32.exeregsvr32.exe
    PID 1924 wrote to memory of 12001924regsvr32.exeregsvr32.exe
    PID 1924 wrote to memory of 12001924regsvr32.exeregsvr32.exe
    PID 1924 wrote to memory of 12001924regsvr32.exeregsvr32.exe
    PID 1924 wrote to memory of 12001924regsvr32.exeregsvr32.exe
    PID 1924 wrote to memory of 12001924regsvr32.exeregsvr32.exe
    PID 1924 wrote to memory of 12001924regsvr32.exeregsvr32.exe
Processes 3
  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1391343.dll
    Suspicious use of WriteProcessMemory
    PID:1924
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\1391343.dll
      PID:1200
      • C:\Windows\SysWOW64\msiexec.exe
        msiexec.exe
        PID:1100
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads
                          • memory/368-11-0x000007FEF6680000-0x000007FEF68FA000-memory.dmp

                          • memory/1100-8-0x0000000000000000-mapping.dmp

                          • memory/1100-10-0x0000000000090000-0x00000000000B6000-memory.dmp

                          • memory/1200-5-0x0000000000130000-0x0000000000131000-memory.dmp

                          • memory/1200-6-0x0000000000431000-0x000000000044D000-memory.dmp

                          • memory/1200-7-0x0000000000430000-0x00000000004C0000-memory.dmp

                          • memory/1200-3-0x0000000000000000-mapping.dmp

                          • memory/1200-4-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

                          • memory/1924-2-0x000007FEFC021000-0x000007FEFC023000-memory.dmp