zloader | f049bc2e1d492fd242d906e01612d4fda6de1272685d1ca4aabc37d742fa9588

Analysis

Target

f049bc2e1d492fd242d906e01612d4fda6de1272685d1ca4aabc37d742fa9588.dll
Size

311KB
MD5

25c714013c34af91b9ca850a80d70eda
SHA1

1fad812ef985e29b469aedada4b5a785bd498450
SHA256

f049bc2e1d492fd242d906e01612d4fda6de1272685d1ca4aabc37d742fa9588
SHA512

8164a3ab31e12197745a593d6afc3014167da405abc95a0993e162bd7ab129be0f60526dd107dff0d271e3fb0a13c1ee0dd3e2c9da7211cdc91c06501f71657f

Score

10^/10

Family

zloader

Botnet

googleaktualizacija

Campaign

googleaktualizacija2

https://iqowijsdakm.com/gate.php

https://wiewjdmkfjn.com/gate.php

https://dksaoidiakjd.com/gate.php

https://iweuiqjdakjd.com/gate.php

https://yuidskadjna.com/gate.php

https://olksmadnbdj.com/gate.php

https://odsakmdfnbs.com/gate.php

https://odsakjmdnhsaj.com/gate.php

https://odjdnhsaj.com/gate.php

https://odoishsaj.com/gate.php

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1832 wrote to memory of 1408	1832	regsvr32.exe	regsvr32.exe
PID 1832 wrote to memory of 1408	1832	regsvr32.exe	regsvr32.exe
PID 1832 wrote to memory of 1408	1832	regsvr32.exe	regsvr32.exe
PID 1832 wrote to memory of 1408	1832	regsvr32.exe	regsvr32.exe
PID 1832 wrote to memory of 1408	1832	regsvr32.exe	regsvr32.exe
PID 1832 wrote to memory of 1408	1832	regsvr32.exe	regsvr32.exe
PID 1832 wrote to memory of 1408	1832	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f049bc2e1d492fd242d906e01612d4fda6de1272685d1ca4aabc37d742fa9588.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1832

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\f049bc2e1d492fd242d906e01612d4fda6de1272685d1ca4aabc37d742fa9588.dll
2⤵
PID:1408

memory/1408-60-0x0000000000000000-mapping.dmp

Download
memory/1408-61-0x0000000074D91000-0x0000000074D93000-memory.dmp

Filesize
8KB

Download
memory/1408-62-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/1408-63-0x0000000000A20000-0x0000000000AC0000-memory.dmp

Filesize
640KB

Download
memory/1720-64-0x0000000000000000-mapping.dmp

Download
memory/1720-66-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/1832-59-0x000007FEFB681000-0x000007FEFB683000-memory.dmp

Filesize
8KB

Download