zloader | 9dae20bd687c2e790c928eb9b4989a213b9f23a23211e0a0383e531c04f80e5b

Analysis

Target

9dae20bd687c2e790c928eb9b4989a213b9f23a23211e0a0383e531c04f80e5b.dll
Size

323KB
MD5

8ef434c30c2839f2fd57ba23899c2467
SHA1

949164ad8e01020b4787ec5a560c5be44fd3e8fd
SHA256

9dae20bd687c2e790c928eb9b4989a213b9f23a23211e0a0383e531c04f80e5b
SHA512

64f19ce9e02dcf965565c882f8de28255f68d4989168650b383707609886ccb7b375f654ce325468189d0c9971c3da69d9d19f91a66f473f9bc909e879d98e5b

Score

10^/10

Family

zloader

Botnet

ivan

Campaign

ivan

https://iqowijsdakm.com/gate.php

https://wiewjdmkfjn.com/gate.php

https://dksaoidiakjd.com/gate.php

https://iweuiqjdakjd.com/gate.php

https://yuidskadjna.com/gate.php

https://olksmadnbdj.com/gate.php

https://odsakmdfnbs.com/gate.php

https://odsakjmdnhsaj.com/gate.php

https://odjdnhsaj.com/gate.php

https://odoishsaj.com/gate.php

Attributes

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1520 wrote to memory of 672	1520	regsvr32.exe	regsvr32.exe
PID 1520 wrote to memory of 672	1520	regsvr32.exe	regsvr32.exe
PID 1520 wrote to memory of 672	1520	regsvr32.exe	regsvr32.exe
PID 1520 wrote to memory of 672	1520	regsvr32.exe	regsvr32.exe
PID 1520 wrote to memory of 672	1520	regsvr32.exe	regsvr32.exe
PID 1520 wrote to memory of 672	1520	regsvr32.exe	regsvr32.exe
PID 1520 wrote to memory of 672	1520	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9dae20bd687c2e790c928eb9b4989a213b9f23a23211e0a0383e531c04f80e5b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\9dae20bd687c2e790c928eb9b4989a213b9f23a23211e0a0383e531c04f80e5b.dll
  2⤵
  PID:672
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec.exe
    3⤵
    PID:588

memory/588-61-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/588-60-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/588-62-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/588-63-0x0000000000000000-mapping.dmp

Download
memory/588-65-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/672-56-0x0000000000000000-mapping.dmp

Download
memory/672-57-0x0000000075C51000-0x0000000075C53000-memory.dmp

Filesize
8KB

Download
memory/672-58-0x0000000000770000-0x0000000000771000-memory.dmp

Filesize
4KB

Download
memory/672-59-0x0000000010000000-0x0000000010055000-memory.dmp

Filesize
340KB

Download
memory/1520-55-0x000007FEFBAB1000-0x000007FEFBAB3000-memory.dmp

Filesize
8KB

Download