zloader | 049d162b68a4c2ebbc872a0a8805080e5db84cfeb398339c09c4be1617e37451

Analysis

Target

049d162b68a4c2ebbc872a0a8805080e5db84cfeb398339c09c4be1617e37451.dll
Size

380KB
MD5

e9679d6f35338721f38ba3af845bf73a
SHA1

a2815a8f4431bb2895672c43c4ef4cb7d8523fe0
SHA256

049d162b68a4c2ebbc872a0a8805080e5db84cfeb398339c09c4be1617e37451
SHA512

379a777e11b1c7a6e499cfd6a00e003ff2c64c6bdec4c6f4170f84e4092ea9e5a392dced381c7d977bc5f8454f1c6aa6548df814e92eaf6effbd6b4c34ece56e

Score

10^/10

Family

zloader

Botnet

vasja

Campaign

vasja

https://iqowijsdakm.com/gate.php

https://wiewjdmkfjn.com/gate.php

https://dksaoidiakjd.com/gate.php

https://iweuiqjdakjd.com/gate.php

https://yuidskadjna.com/gate.php

https://olksmadnbdj.com/gate.php

https://odsakmdfnbs.com/gate.php

https://odsakjmdnhsaj.com/gate.php

https://odjdnhsaj.com/gate.php

https://odoishsaj.com/gate.php

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1104 wrote to memory of 1928	1104	regsvr32.exe	regsvr32.exe
PID 1104 wrote to memory of 1928	1104	regsvr32.exe	regsvr32.exe
PID 1104 wrote to memory of 1928	1104	regsvr32.exe	regsvr32.exe
PID 1104 wrote to memory of 1928	1104	regsvr32.exe	regsvr32.exe
PID 1104 wrote to memory of 1928	1104	regsvr32.exe	regsvr32.exe
PID 1104 wrote to memory of 1928	1104	regsvr32.exe	regsvr32.exe
PID 1104 wrote to memory of 1928	1104	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\049d162b68a4c2ebbc872a0a8805080e5db84cfeb398339c09c4be1617e37451.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1104

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\049d162b68a4c2ebbc872a0a8805080e5db84cfeb398339c09c4be1617e37451.dll
2⤵
PID:1928

memory/1104-59-0x000007FEFC181000-0x000007FEFC183000-memory.dmp

Filesize
8KB

Download
memory/1520-64-0x0000000000000000-mapping.dmp

Download
memory/1520-66-0x00000000000D0000-0x00000000000F6000-memory.dmp

Filesize
152KB

Download
memory/1928-60-0x0000000000000000-mapping.dmp

Download
memory/1928-61-0x0000000075EF1000-0x0000000075EF3000-memory.dmp

Filesize
8KB

Download
memory/1928-62-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/1928-63-0x0000000010000000-0x00000000100EC000-memory.dmp

Filesize
944KB

Download