zloader | a212778b12315f3eb63ed3cdfae0c21b30caff84e63218c790b81c12993e0834

Analysis

Target

b270e245132cf6624fc96642532a00c0a16681f59542220ad2c389d45865141f.dll
Size

298KB
MD5

a80859c1cd44daad1450948a1276bc0d
SHA1

46396892b9cafb2e59b8f667ec7822d0435384bb
SHA256

b270e245132cf6624fc96642532a00c0a16681f59542220ad2c389d45865141f
SHA512

ce68470318b8472b30aeee8778802ca4c9175f075a9c19c8332a08a6a8518a2f157a9e2ccaedba1d42f83f591d3c5f233ee1b8b8fbb90589aae82c9dea68352c

Score

10^/10

Family

zloader

Botnet

nut

Campaign

22/03

https://svilapp.svgipsar.org/post.php

https://nadar-gis.com/post.php

https://crearqarquitectos.com/post.php

https://crown-sign.com/post.php

https://dainikjahan.com/post.php

https://denatureedutech.com/post.php

https://alekllemtilaro.tk/post.php

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 884 set thread context of 1392 884 rundll32.exe msiexec.exe

description	pid	process	target process
PID 884 set thread context of 1392	884	rundll32.exe	msiexec.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 548 wrote to memory of 884	548	rundll32.exe	rundll32.exe
PID 548 wrote to memory of 884	548	rundll32.exe	rundll32.exe
PID 548 wrote to memory of 884	548	rundll32.exe	rundll32.exe
PID 548 wrote to memory of 884	548	rundll32.exe	rundll32.exe
PID 548 wrote to memory of 884	548	rundll32.exe	rundll32.exe
PID 548 wrote to memory of 884	548	rundll32.exe	rundll32.exe
PID 548 wrote to memory of 884	548	rundll32.exe	rundll32.exe
PID 884 wrote to memory of 1392	884	rundll32.exe	msiexec.exe
PID 884 wrote to memory of 1392	884	rundll32.exe	msiexec.exe
PID 884 wrote to memory of 1392	884	rundll32.exe	msiexec.exe
PID 884 wrote to memory of 1392	884	rundll32.exe	msiexec.exe
PID 884 wrote to memory of 1392	884	rundll32.exe	msiexec.exe
PID 884 wrote to memory of 1392	884	rundll32.exe	msiexec.exe
PID 884 wrote to memory of 1392	884	rundll32.exe	msiexec.exe
PID 884 wrote to memory of 1392	884	rundll32.exe	msiexec.exe
PID 884 wrote to memory of 1392	884	rundll32.exe	msiexec.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b270e245132cf6624fc96642532a00c0a16681f59542220ad2c389d45865141f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b270e245132cf6624fc96642532a00c0a16681f59542220ad2c389d45865141f.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:884
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec.exe
    3⤵
    PID:1392

memory/884-2-0x0000000000000000-mapping.dmp

Download
memory/884-3-0x0000000076451000-0x0000000076453000-memory.dmp

Filesize
8KB

Download
memory/884-4-0x0000000075030000-0x000000007505B000-memory.dmp

Filesize
172KB

Download
memory/884-5-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/1392-6-0x0000000000000000-mapping.dmp

Download
memory/1392-8-0x0000000000090000-0x00000000000BB000-memory.dmp

Filesize
172KB

Download