zloader | 5192df66d6e6bec165322efcb90687347ded916bceb835c95e3191e735029984

Analysis

Target

5192df66d6e6bec165322efcb90687347ded916bceb835c95e3191e735029984.dll
Size

642KB
MD5

5708cab401d3a2dbca16c57d40659a5c
SHA1

f366e16d4c556e698f2b35c5b64123069d2b6af1
SHA256

5192df66d6e6bec165322efcb90687347ded916bceb835c95e3191e735029984
SHA512

01687a1aba85533a34a56e88a77b4140699c7dfa9e559cb4e5924db2d414d0f762fed84cc842c740234894fdfd2966c406fcd9e7ef7788dc0927f604fa6230aa

Score

10^/10

Family

zloader

Botnet

googleaktualizacija

Campaign

googleaktualizacija1

https://iqowijsdakm.ru/gate.php

https://wiewjdmkfjn.ru/gate.php

https://dksaoidiakjd.su/gate.php

https://iweuiqjdakjd.su/gate.php

https://yuidskadjna.su/gate.php

https://olksmadnbdj.su/gate.php

https://odsakmdfnbs.com/gate.php

https://odsakjmdnhsaj.com/gate.php

https://odjdnhsaj.com/gate.php

https://odoishsaj.com/gate.php

Attributes

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 836 wrote to memory of 1584	836	rundll32.exe	rundll32.exe
PID 836 wrote to memory of 1584	836	rundll32.exe	rundll32.exe
PID 836 wrote to memory of 1584	836	rundll32.exe	rundll32.exe
PID 836 wrote to memory of 1584	836	rundll32.exe	rundll32.exe
PID 836 wrote to memory of 1584	836	rundll32.exe	rundll32.exe
PID 836 wrote to memory of 1584	836	rundll32.exe	rundll32.exe
PID 836 wrote to memory of 1584	836	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5192df66d6e6bec165322efcb90687347ded916bceb835c95e3191e735029984.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:836

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5192df66d6e6bec165322efcb90687347ded916bceb835c95e3191e735029984.dll,#1
2⤵
PID:1584

memory/552-59-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/552-60-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/552-61-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/552-62-0x0000000000000000-mapping.dmp

Download
memory/552-64-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/1584-55-0x0000000000000000-mapping.dmp

Download
memory/1584-56-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/1584-57-0x0000000000270000-0x00000000002BB000-memory.dmp

Filesize
300KB

Download
memory/1584-58-0x00000000001D0000-0x00000000001F6000-memory.dmp

Filesize
152KB

Download