zloader | c68e80990502dc9b86fe4196af4a62985eb0a5ef56e06b9fa8bdf4ade2b9b668

Analysis

Target

c68e80990502dc9b86fe4196af4a62985eb0a5ef56e06b9fa8bdf4ade2b9b668.dll
Size

306KB
MD5

402cd29f7429abc1b4690c0c71770825
SHA1

e826394c54c5827f1142b11adc5d550e335ec82e
SHA256

c68e80990502dc9b86fe4196af4a62985eb0a5ef56e06b9fa8bdf4ade2b9b668
SHA512

a726eb34ec1bf0d97697adc7cf0db8ad38a53cefcf1aa7d6ddb938b0924ae11822ba7713be4d9b0de186541e37a0517e40003056aec0208304b2e5b7f3fa0012

Score

10^/10

Family

zloader

Botnet

googleaktualizacija

Campaign

googleaktualizacija2

https://iqowijsdakm.com/gate.php

https://wiewjdmkfjn.com/gate.php

https://dksaoidiakjd.com/gate.php

https://iweuiqjdakjd.com/gate.php

https://yuidskadjna.com/gate.php

https://olksmadnbdj.com/gate.php

https://odsakmdfnbs.com/gate.php

https://odsakjmdnhsaj.com/gate.php

https://odjdnhsaj.com/gate.php

https://odoishsaj.com/gate.php

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 332 wrote to memory of 1076	332	rundll32.exe	rundll32.exe
PID 332 wrote to memory of 1076	332	rundll32.exe	rundll32.exe
PID 332 wrote to memory of 1076	332	rundll32.exe	rundll32.exe
PID 332 wrote to memory of 1076	332	rundll32.exe	rundll32.exe
PID 332 wrote to memory of 1076	332	rundll32.exe	rundll32.exe
PID 332 wrote to memory of 1076	332	rundll32.exe	rundll32.exe
PID 332 wrote to memory of 1076	332	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c68e80990502dc9b86fe4196af4a62985eb0a5ef56e06b9fa8bdf4ade2b9b668.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:332

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c68e80990502dc9b86fe4196af4a62985eb0a5ef56e06b9fa8bdf4ade2b9b668.dll,#1
2⤵
PID:1076

memory/1076-59-0x0000000000000000-mapping.dmp

Download
memory/1076-60-0x0000000075FF1000-0x0000000075FF3000-memory.dmp

Filesize
8KB

Download
memory/1076-61-0x0000000000120000-0x0000000000142000-memory.dmp

Filesize
136KB

Download
memory/1076-62-0x0000000010000000-0x0000000010050000-memory.dmp

Filesize
320KB

Download
memory/1268-63-0x0000000000000000-mapping.dmp

Download
memory/1268-65-0x0000000000110000-0x0000000000136000-memory.dmp

Filesize
152KB

Download