zloader | 6819b89e1dba92ee4c6eaa7e35880a6d8e1b51047ec4fed392d29a9aeb8e36b7

Analysis

Target

JavaN.dll
Size

242KB
MD5

348d6fd40a9e79a681048999873af548
SHA1

069f292e298dabc97a7946c25b8833abf0783dc1
SHA256

6819b89e1dba92ee4c6eaa7e35880a6d8e1b51047ec4fed392d29a9aeb8e36b7
SHA512

7d75ff10763fbf72f0b6a13dbb8f429b6820379f118afd303dad2e2e9c358ea1d220a3afe05d5d949608ee39135f86b27dede86c9062b0ee5b98d0b1591b001e

Score

10^/10

Family

zloader

Botnet

ivan

Campaign

ivan

https://iqowijsdakm.com/gate.php

https://wiewjdmkfjn.com/gate.php

https://dksaoidiakjd.com/gate.php

https://iweuiqjdakjd.com/gate.php

https://yuidskadjna.com/gate.php

https://olksmadnbdj.com/gate.php

https://odsakmdfnbs.com/gate.php

https://odsakjmdnhsaj.com/gate.php

https://odjdnhsaj.com/gate.php

https://odoishsaj.com/gate.php

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1116 wrote to memory of 2008	1116	regsvr32.exe	regsvr32.exe
PID 1116 wrote to memory of 2008	1116	regsvr32.exe	regsvr32.exe
PID 1116 wrote to memory of 2008	1116	regsvr32.exe	regsvr32.exe
PID 1116 wrote to memory of 2008	1116	regsvr32.exe	regsvr32.exe
PID 1116 wrote to memory of 2008	1116	regsvr32.exe	regsvr32.exe
PID 1116 wrote to memory of 2008	1116	regsvr32.exe	regsvr32.exe
PID 1116 wrote to memory of 2008	1116	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JavaN.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1116

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\JavaN.dll
2⤵
PID:2008

memory/1116-59-0x000007FEFC181000-0x000007FEFC183000-memory.dmp

Filesize
8KB

Download
memory/1412-64-0x0000000000000000-mapping.dmp

Download
memory/1412-66-0x00000000000D0000-0x00000000000F6000-memory.dmp

Filesize
152KB

Download
memory/2008-60-0x0000000000000000-mapping.dmp

Download
memory/2008-61-0x0000000075EF1000-0x0000000075EF3000-memory.dmp

Filesize
8KB

Download
memory/2008-62-0x00000000001F0000-0x0000000000270000-memory.dmp

Filesize
512KB

Download
memory/2008-63-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download