zloader | cdaca5b6aabd92a7b782c2d7b250cbc1b2ed4c5a78091271f788d58dedcd94f6

Analysis

Target

a9dd9b9eff47af724436e2abdcd5ce6c.exe.dll
Size

485KB
MD5

a9dd9b9eff47af724436e2abdcd5ce6c
SHA1

1a9c9258f0345f5edddd933a7bd15ec42be51f8e
SHA256

cdaca5b6aabd92a7b782c2d7b250cbc1b2ed4c5a78091271f788d58dedcd94f6
SHA512

28af95d398c6311bd593489019be39a23218d64d5236f765c4ecadf43bff07f0ab2aea10413ad7390e3805b09921cdd6c33db734023a6b91a1735125793aea52

Score

10^/10

Family

zloader

Botnet

vasja

Campaign

vasja

https://iqowijsdakm.com/gate.php

https://wiewjdmkfjn.com/gate.php

https://dksaoidiakjd.com/gate.php

https://iweuiqjdakjd.com/gate.php

https://yuidskadjna.com/gate.php

https://olksmadnbdj.com/gate.php

https://odsakmdfnbs.com/gate.php

https://odsakjmdnhsaj.com/gate.php

https://odjdnhsaj.com/gate.php

https://odoishsaj.com/gate.php

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 4064 wrote to memory of 3476	4064	regsvr32.exe	regsvr32.exe
PID 4064 wrote to memory of 3476	4064	regsvr32.exe	regsvr32.exe
PID 4064 wrote to memory of 3476	4064	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a9dd9b9eff47af724436e2abdcd5ce6c.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4064

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\a9dd9b9eff47af724436e2abdcd5ce6c.exe.dll
2⤵
PID:3476

memory/2544-117-0x0000000000000000-mapping.dmp

Download
memory/2544-120-0x0000000002E60000-0x0000000002E86000-memory.dmp

Filesize
152KB

Download
memory/3476-114-0x0000000000000000-mapping.dmp

Download
memory/3476-116-0x0000000010000000-0x0000000010129000-memory.dmp

Filesize
1.2MB

Download
memory/3476-115-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download