zloader | 5e0362037ebe9276b9a253a66c233be67bb6ceedec997e9bd0faa294091eb52c

Analysis

max time kernel
56s
max time network
11s
platform
windows7_x64
resource
win7v20210408
submitted
30/04/2021, 20:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e5480369_by_Libranalysis.dll
Size 619KB
Sample210430-3twptlr2sa
SHA256 5e0362037ebe9276b9a253a66c233be67bb6ceedec997e9bd0faa294091eb52c
MD5 e54803695352cd8a46fb303f6d83c4f5
SHA1 246416a97b5d712495a17081456a3ceb4f6d2d2e
SHA512 739de9da9b8755c34577801c4fa0b88a347012fc579a4ac4a4a2e6d4b1213e1ac585b1f1a9db59549693436eac6700ab57af4598ae0b3f2f8c32a86701f923fa
MD5 SHA1 SHA512

Score

10^/10

zloader nut 30/03 botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

Campaign

30/03

https://holacast.com/post.php
https://homeloansadvisor.in/post.php
https://hoteldonalala.com.mx/post.php
https://hotimobiliaria.com.br/post.php
https://hrdgschool.com/post.php
https://huloolcreations.com/post.php
https://hyundainhatrang.vn/post.php
https://iaikotasemarang.id/post.php

rc4.plain

rsa_pubkey.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 1388	1652	regsvr32.exe	26
PID 1652 wrote to memory of 1388	1652	regsvr32.exe	26
PID 1652 wrote to memory of 1388	1652	regsvr32.exe	26
PID 1652 wrote to memory of 1388	1652	regsvr32.exe	26
PID 1652 wrote to memory of 1388	1652	regsvr32.exe	26
PID 1652 wrote to memory of 1388	1652	regsvr32.exe	26
PID 1652 wrote to memory of 1388	1652	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e5480369_by_Libranalysis.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\e5480369_by_Libranalysis.dll
  2⤵
  PID:1388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1388-62-0x00000000754F1000-0x00000000754F3000-memory.dmp

Download

memory/1388-63-0x0000000073D30000-0x0000000073D5B000-memory.dmp

Download

memory/1388-64-0x0000000073D30000-0x00000000742D4000-memory.dmp

Download

memory/1388-65-0x00000000001D0000-0x00000000001D1000-memory.dmp

Download

memory/1652-60-0x000007FEFB6A1000-0x000007FEFB6A3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads