zloader | cdaca5b6aabd92a7b782c2d7b250cbc1b2ed4c5a78091271f788d58dedcd94f6

Analysis

max time kernel
82s
max time network
135s
platform
windows10_x64
resource
win10v20210408
submitted
12-08-2021 13:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9dd9b9eff47af724436e2abdcd5ce6c.exe.dll
Size

485KB
MD5

a9dd9b9eff47af724436e2abdcd5ce6c
SHA1

1a9c9258f0345f5edddd933a7bd15ec42be51f8e
SHA256

cdaca5b6aabd92a7b782c2d7b250cbc1b2ed4c5a78091271f788d58dedcd94f6
SHA512

28af95d398c6311bd593489019be39a23218d64d5236f765c4ecadf43bff07f0ab2aea10413ad7390e3805b09921cdd6c33db734023a6b91a1735125793aea52

Score

10^/10

zloader vasja vasja botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

vasja

Campaign

vasja

https://iqowijsdakm.com/gate.php

https://wiewjdmkfjn.com/gate.php

https://dksaoidiakjd.com/gate.php

https://iweuiqjdakjd.com/gate.php

https://yuidskadjna.com/gate.php

https://olksmadnbdj.com/gate.php

https://odsakmdfnbs.com/gate.php

https://odsakjmdnhsaj.com/gate.php

https://odjdnhsaj.com/gate.php

https://odoishsaj.com/gate.php

rc4.plain

rsa_pubkey.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 900 wrote to memory of 2644	900	regsvr32.exe	regsvr32.exe
PID 900 wrote to memory of 2644	900	regsvr32.exe	regsvr32.exe
PID 900 wrote to memory of 2644	900	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a9dd9b9eff47af724436e2abdcd5ce6c.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:900

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\a9dd9b9eff47af724436e2abdcd5ce6c.exe.dll
2⤵
PID:2644

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2644-114-0x0000000000000000-mapping.dmp

Download
memory/2644-115-0x00000000006E0000-0x00000000006E1000-memory.dmp

Filesize
4KB

Download
memory/2644-116-0x0000000010000000-0x0000000010129000-memory.dmp

Filesize
1.2MB

Download