zloader | 607a091d00b4660179f3b9c85bf1cd66edf3a2bc6bfcd794e60030b67363464c

Analysis

Target

microsoft_shared.tmp.dll
Size

369KB
MD5

08fb0dfc406671b03c9c9b8f39238321
SHA1

0b85e55d662fc7f87c142250ffa54a52eb3df3cb
SHA256

607a091d00b4660179f3b9c85bf1cd66edf3a2bc6bfcd794e60030b67363464c
SHA512

e320d16b78a82835cf5d3aa762e83a32429998d062f8c832a437b20d00c69295223503f9b20766c7cfe5e45478d3c09ae0f44c2744875905f684a461af2f0c25

Score

10^/10

Family

zloader

Botnet

personal

Campaign

personal

https://iqowijsdakm.com/gate.php

https://wiewjdmkfjn.com/gate.php

https://dksaoidiakjd.com/gate.php

https://iweuiqjdakjd.com/gate.php

https://yuidskadjna.com/gate.php

https://olksmadnbdj.com/gate.php

https://odsakmdfnbs.com/gate.php

https://odsakjmdnhsaj.com/gate.php

https://odjdnhsaj.com/gate.php

https://odoishsaj.com/gate.php

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 792 wrote to memory of 1532	792	regsvr32.exe	regsvr32.exe
PID 792 wrote to memory of 1532	792	regsvr32.exe	regsvr32.exe
PID 792 wrote to memory of 1532	792	regsvr32.exe	regsvr32.exe
PID 792 wrote to memory of 1532	792	regsvr32.exe	regsvr32.exe
PID 792 wrote to memory of 1532	792	regsvr32.exe	regsvr32.exe
PID 792 wrote to memory of 1532	792	regsvr32.exe	regsvr32.exe
PID 792 wrote to memory of 1532	792	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\microsoft_shared.tmp.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:792

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\microsoft_shared.tmp.dll
2⤵
PID:1532

memory/792-2-0x000007FEFC4E1000-0x000007FEFC4E3000-memory.dmp

Filesize
8KB

Download
memory/1476-10-0x000007FEF6B80000-0x000007FEF6DFA000-memory.dmp

Filesize
2.5MB

Download
memory/1532-3-0x0000000000000000-mapping.dmp

Download
memory/1532-4-0x0000000076861000-0x0000000076863000-memory.dmp

Filesize
8KB

Download
memory/1532-5-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/1532-6-0x0000000000240000-0x00000000002A3000-memory.dmp

Filesize
396KB

Download
memory/1656-7-0x0000000000000000-mapping.dmp

Download
memory/1656-9-0x00000000000D0000-0x00000000000F6000-memory.dmp

Filesize
152KB

Download