zloader | 24c57cf9a9fd72827ced5f95796cf333089f076c660bf06b5e7d071a4d5fc102 | Triage™

Analysis

max time kernel
89s
max time network
113s
platform
windows10_x64
resource
win10v20210408
submitted
09/08/2021, 05:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c43c3c195e838ef81a36c1434fa7395c.dll
Size 952KB
Sample210809-nv795ae2pa
SHA256 24c57cf9a9fd72827ced5f95796cf333089f076c660bf06b5e7d071a4d5fc102
MD5 c43c3c195e838ef81a36c1434fa7395c
SHA1 c9accdc1204579d13440df22e4892fcc2082dc7c
SHA512 5ec2613176ddf8ca9ae331823cb7b62d436ea007850e60a9aeeee0bf23c827a2e3c1eb422594bdd3ec4c86f7688d91f3e8a3c6b2435c46078069c53947a1739f
MD5 SHA1 SHA512

Score

10^/10

zloader vasja vasja botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

vasja

Campaign

vasja

C2

https://iqowijsdakm.com/gate.php
https://wiewjdmkfjn.com/gate.php
https://dksaoidiakjd.com/gate.php
https://iweuiqjdakjd.com/gate.php
https://yuidskadjna.com/gate.php
https://olksmadnbdj.com/gate.php
https://odsakmdfnbs.com/gate.php
https://odsakjmdnhsaj.com/gate.php
https://odjdnhsaj.com/gate.php
https://odoishsaj.com/gate.php

rc4.plain

rsa_pubkey.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 568 wrote to memory of 892	568	regsvr32.exe	72
PID 568 wrote to memory of 892	568	regsvr32.exe	72
PID 568 wrote to memory of 892	568	regsvr32.exe	72

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c43c3c195e838ef81a36c1434fa7395c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:568
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c43c3c195e838ef81a36c1434fa7395c.dll
  2⤵
  PID:892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/892-115-0x00000000032E0000-0x00000000032E1000-memory.dmp

Download

memory/892-116-0x0000000010000000-0x0000000010155000-memory.dmp

Download