zloader | de47a37cb8c666a36b7e9315bfebf0996c0c92747a2f4029b4fafb2ba9f2b275

Analysis

Target

microsoft_shared.tmp.dll
Size

470KB
MD5

5ab3e07ce737bb6b3d4e025fc13096fa
SHA1

850d397ca30d1ca42f8c225b00ab003ae6a5cb3e
SHA256

de47a37cb8c666a36b7e9315bfebf0996c0c92747a2f4029b4fafb2ba9f2b275
SHA512

0b4e1f846733d52f074a92e042de26a7606227aaf7c204ddd29d4e42fb789b622c6fcd95f946f2f7ec3c5bba495b5e244474916533eb3a41e8d9289f86034006

Score

10^/10

Family

zloader

Botnet

personal

Campaign

personal

https://iqowijsdakm.com/gate.php

https://wiewjdmkfjn.com/gate.php

https://dksaoidiakjd.com/gate.php

https://iweuiqjdakjd.com/gate.php

https://yuidskadjna.com/gate.php

https://olksmadnbdj.com/gate.php

https://odsakmdfnbs.com/gate.php

https://odsakjmdnhsaj.com/gate.php

https://odjdnhsaj.com/gate.php

https://odoishsaj.com/gate.php

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 548 wrote to memory of 1540	548	regsvr32.exe	regsvr32.exe
PID 548 wrote to memory of 1540	548	regsvr32.exe	regsvr32.exe
PID 548 wrote to memory of 1540	548	regsvr32.exe	regsvr32.exe
PID 548 wrote to memory of 1540	548	regsvr32.exe	regsvr32.exe
PID 548 wrote to memory of 1540	548	regsvr32.exe	regsvr32.exe
PID 548 wrote to memory of 1540	548	regsvr32.exe	regsvr32.exe
PID 548 wrote to memory of 1540	548	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\microsoft_shared.tmp.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:548

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\microsoft_shared.tmp.dll
2⤵
PID:1540

memory/548-2-0x000007FEFC2A1000-0x000007FEFC2A3000-memory.dmp

Filesize
8KB

Download
memory/1212-7-0x0000000000000000-mapping.dmp

Download
memory/1212-9-0x00000000000D0000-0x00000000000F6000-memory.dmp

Filesize
152KB

Download
memory/1540-3-0x0000000000000000-mapping.dmp

Download
memory/1540-4-0x0000000076451000-0x0000000076453000-memory.dmp

Filesize
8KB

Download
memory/1540-6-0x00000000009A0000-0x0000000000A56000-memory.dmp

Filesize
728KB

Download
memory/1540-5-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/1580-10-0x000007FEF8800000-0x000007FEF8A7A000-memory.dmp

Filesize
2.5MB

Download