zloader | 574ab0eb02d9059cd771a6af0c467dfa1ac487baf10c54723e6b04771aa48059

Analysis

Target

1960546.dll
Size

453KB
MD5

6cdcdd2a2211570c00b3239ae350ee4c
SHA1

edfdc0cd64af23cc2a5ba21e00410d9451d0871a
SHA256

574ab0eb02d9059cd771a6af0c467dfa1ac487baf10c54723e6b04771aa48059
SHA512

febd3bdfa6a29408c89f4f485f968013d517407e530ae17815a8fded39f4c124a851b7089755474db4d56dbc4dfc759bc2adc1c788fbaab830b736b1391cd09c

Score

10^/10

Family

zloader

Botnet

googleaktualizacija

Campaign

googleaktualizacija2

https://iqowijsdakm.com/gate.php

https://wiewjdmkfjn.com/gate.php

https://dksaoidiakjd.com/gate.php

https://iweuiqjdakjd.com/gate.php

https://yuidskadjna.com/gate.php

https://olksmadnbdj.com/gate.php

https://odsakmdfnbs.com/gate.php

https://odsakjmdnhsaj.com/gate.php

https://odjdnhsaj.com/gate.php

https://odoishsaj.com/gate.php

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

regsvr32.exe

pid process

1528 regsvr32.exe

pid	process
1528	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 792 wrote to memory of 1528	792	regsvr32.exe	regsvr32.exe
PID 792 wrote to memory of 1528	792	regsvr32.exe	regsvr32.exe
PID 792 wrote to memory of 1528	792	regsvr32.exe	regsvr32.exe
PID 792 wrote to memory of 1528	792	regsvr32.exe	regsvr32.exe
PID 792 wrote to memory of 1528	792	regsvr32.exe	regsvr32.exe
PID 792 wrote to memory of 1528	792	regsvr32.exe	regsvr32.exe
PID 792 wrote to memory of 1528	792	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1960546.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:792

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\1960546.dll
2⤵
- Suspicious use of SetWindowsHookEx
PID:1528

memory/268-10-0x000007FEF6B80000-0x000007FEF6DFA000-memory.dmp

Filesize
2.5MB

Download
memory/792-2-0x000007FEFC4E1000-0x000007FEFC4E3000-memory.dmp

Filesize
8KB

Download
memory/1528-3-0x0000000000000000-mapping.dmp

Download
memory/1528-4-0x0000000076861000-0x0000000076863000-memory.dmp

Filesize
8KB

Download
memory/1528-5-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/1528-6-0x0000000000950000-0x0000000000A03000-memory.dmp

Filesize
716KB

Download
memory/1648-7-0x0000000000000000-mapping.dmp

Download
memory/1648-9-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download