Analysis
-
max time kernel
69s -
max time network
149s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
08-11-2021 10:46
General
-
Target
9dae20bd687c2e790c928eb9b4989a213b9f23a23211e0a0383e531c04f80e5b.dll
-
Size
323KB
-
MD5
8ef434c30c2839f2fd57ba23899c2467
-
SHA1
949164ad8e01020b4787ec5a560c5be44fd3e8fd
-
SHA256
9dae20bd687c2e790c928eb9b4989a213b9f23a23211e0a0383e531c04f80e5b
-
SHA512
64f19ce9e02dcf965565c882f8de28255f68d4989168650b383707609886ccb7b375f654ce325468189d0c9971c3da69d9d19f91a66f473f9bc909e879d98e5b
Malware Config
Extracted
zloader
ivan
ivan
https://iqowijsdakm.com/gate.php
https://wiewjdmkfjn.com/gate.php
https://dksaoidiakjd.com/gate.php
https://iweuiqjdakjd.com/gate.php
https://yuidskadjna.com/gate.php
https://olksmadnbdj.com/gate.php
https://odsakmdfnbs.com/gate.php
https://odsakjmdnhsaj.com/gate.php
https://odjdnhsaj.com/gate.php
https://odoishsaj.com/gate.php
-
build_id
157
Signatures
-
Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\9dae20bd687c2e790c928eb9b4989a213b9f23a23211e0a0383e531c04f80e5b.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\9dae20bd687c2e790c928eb9b4989a213b9f23a23211e0a0383e531c04f80e5b.dll2⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152KB
-
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
152KB
-
-
Filesize
340KB
-
Filesize
4KB