zloader | 95a8370c36d81ea596d83892115ce6b90717396c8f657b17696c7eeb2dba1d2e

Target

tim.dll
Size

429KB
MD5

75784d297b3d6fb4d434b6890f6334ab
SHA1

dc945e57be6bdd3cc4894d6cff7dd90a76f6c416
SHA256

95a8370c36d81ea596d83892115ce6b90717396c8f657b17696c7eeb2dba1d2e
SHA512

f54baffc5b545aaa4d939505181466d7b78bb583fd32da6cbf8cea058fca8869e8bf7bf3272f43d09a7b24dc6e821c9aa0e3875dd2959173e704d57568915fa1

Score

10^/10

zloader tim tim botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

tim

Campaign

tim

https://iqowijsdakm.com/gate.php

https://wiewjdmkfjn.com/gate.php

https://dksaoidiakjd.com/gate.php

https://iweuiqjdakjd.com/gate.php

https://yuidskadjna.com/gate.php

https://olksmadnbdj.com/gate.php

https://odsakmdfnbs.com/gate.php

https://odsakjmdnhsaj.com/gate.php

https://odjdnhsaj.com/gate.php

https://odoishsaj.com/gate.php

rc4.plain

rsa_pubkey.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 1768	1032	regsvr32.exe	26
PID 1032 wrote to memory of 1768	1032	regsvr32.exe	26
PID 1032 wrote to memory of 1768	1032	regsvr32.exe	26
PID 1032 wrote to memory of 1768	1032	regsvr32.exe	26
PID 1032 wrote to memory of 1768	1032	regsvr32.exe	26
PID 1032 wrote to memory of 1768	1032	regsvr32.exe	26
PID 1032 wrote to memory of 1768	1032	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\tim.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\tim.dll
  2⤵
  - Drops file in Windows directory
  PID:1768
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec.exe
    3⤵
    PID:1428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1032-53-0x000007FEFB651000-0x000007FEFB653000-memory.dmp

Filesize
8KB

Download
memory/1428-60-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/1768-55-0x0000000075B51000-0x0000000075B53000-memory.dmp

Filesize
8KB

Download
memory/1768-56-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/1768-57-0x0000000010000000-0x0000000010072000-memory.dmp

Filesize
456KB

Download

Resubmissions

Analysis

Sharing

General