zloader | b4c029f9bb6d85ace85302d25caa7ec1da9d641872ea8f62b333a667c0d7b864

Analysis

Target
d057014fe0e29b2604bd852595441a22.dll
Size 666KB
Sample210415-p16phf7ckn
SHA256 b4c029f9bb6d85ace85302d25caa7ec1da9d641872ea8f62b333a667c0d7b864
MD5 d057014fe0e29b2604bd852595441a22
SHA1 57563b2ba10105f0183bcff42800a1b061b560a6
SHA512 09aeb08c2450b9f79967f071e7bc85b5d9ae86f3e005fb107e91695654620c52450ceabd74aad31a9d49d53fe588c194d3425348bf1527d34dd8a1ce94febcbc
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

Campaign

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 2288	1832	rundll32.exe	70
PID 1832 wrote to memory of 2288	1832	rundll32.exe	70
PID 1832 wrote to memory of 2288	1832	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d057014fe0e29b2604bd852595441a22.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d057014fe0e29b2604bd852595441a22.dll,#1
  2⤵
  PID:2288

memory/2288-115-0x0000000074140000-0x000000007416B000-memory.dmp

Download

memory/2288-116-0x0000000074140000-0x0000000074208000-memory.dmp

Download

memory/2288-117-0x00000000032F0000-0x000000000339E000-memory.dmp

Download