zloader | b4c029f9bb6d85ace85302d25caa7ec1da9d641872ea8f62b333a667c0d7b864

Analysis

Target

d057014fe0e29b2604bd852595441a22.dll
Size

666KB
MD5

d057014fe0e29b2604bd852595441a22
SHA1

57563b2ba10105f0183bcff42800a1b061b560a6
SHA256

b4c029f9bb6d85ace85302d25caa7ec1da9d641872ea8f62b333a667c0d7b864
SHA512

09aeb08c2450b9f79967f071e7bc85b5d9ae86f3e005fb107e91695654620c52450ceabd74aad31a9d49d53fe588c194d3425348bf1527d34dd8a1ce94febcbc

Score

10^/10

Family

zloader

Botnet

nut

Campaign

13/04

https://jiaayanu.com/post.php

https://investinszeklerland.eu/post.php

https://iqs-sac.com/post.php

https://jciems.in/post.php

https://jinnahofficersschool.com/post.php

https://kancagh.com/post.php

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1832 wrote to memory of 2288	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 2288	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 2288	1832	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d057014fe0e29b2604bd852595441a22.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d057014fe0e29b2604bd852595441a22.dll,#1
  2⤵
  PID:2288

memory/2288-114-0x0000000000000000-mapping.dmp

Download
memory/2288-115-0x0000000074140000-0x000000007416B000-memory.dmp

Filesize
172KB

Download
memory/2288-116-0x0000000074140000-0x0000000074208000-memory.dmp

Filesize
800KB

Download
memory/2288-117-0x00000000032F0000-0x000000000339E000-memory.dmp

Filesize
696KB

Download