Analysis
- max time kernel
79s - max time network
126s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
07/12/2021, 04:13
General
- Target ca.dll
- Size 1.7MB
- Sample211207-es72gsage2
- SHA256 f0b6c677bac2de611e0866e849cebd64ec5454885fdd7be5bf0c1c5a17846e3a
Malware Config
Extracted
-
zloader
-
return
-
return
-
https://asdfghdsajkl.com/gate.php
-
https://lkjhgfgsdshja.com/gate.php
-
https://kjdhsasghjds.com/gate.php
-
https://kdjwhqejqwij.com/gate.php
-
https://iasudjghnasd.com/gate.php
-
https://daksjuggdhwa.com/gate.php
-
https://dkisuaggdjhna.com/gate.php
-
https://eiqwuggejqw.com/gate.php
-
https://dquggwjhdmq.com/gate.php
-
https://djshggadasj.com/gate.php
-
build_id
157
Signatures
- Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ca.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ca.dll,#12⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1924-121-0x0000000000400000-0x0000000000426000-memory.dmp
memory/1924-123-0x0000000000100000-0x0000000000101000-memory.dmp
memory/1924-124-0x0000000000100000-0x0000000000101000-memory.dmp
memory/1924-125-0x0000000000400000-0x0000000000426000-memory.dmp
memory/3996-119-0x00000000001E0000-0x00000000001E1000-memory.dmp
memory/3996-120-0x0000000010000000-0x00000000101C8000-memory.dmp