zloader | 079084e7c1bf1718ae6b10b285da7ed27cb4a48203846b60cecfbec502b666be

Analysis

Target

fyivybu.dll
Size

476KB
MD5

cc00b3639732518c892f67f5e662c134
SHA1

d8ef7b39e9263ee7118ecf427a793cf8909b2e70
SHA256

079084e7c1bf1718ae6b10b285da7ed27cb4a48203846b60cecfbec502b666be
SHA512

c6b0cf40120fb3d0cacba51209e219317f18e62d342913ef644ca21ec574424869760378e944f2db5891b3b3d637d7f4a6118cea7756ae3daaa18a04e7e7b91f

Score

10^/10

Family

zloader

Botnet

Jho

Campaign

25/03

https://wgyvjbse.pw/milagrecf.php

https://botiq.xyz/milagrecf.php

Attributes

rc4.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 2756 set thread context of 1176 2756 rundll32.exe msiexec.exe

description	pid	process	target process
PID 2756 set thread context of 1176	2756	rundll32.exe	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2704 wrote to memory of 2756	2704	rundll32.exe	rundll32.exe
PID 2704 wrote to memory of 2756	2704	rundll32.exe	rundll32.exe
PID 2704 wrote to memory of 2756	2704	rundll32.exe	rundll32.exe
PID 2756 wrote to memory of 1176	2756	rundll32.exe	msiexec.exe
PID 2756 wrote to memory of 1176	2756	rundll32.exe	msiexec.exe
PID 2756 wrote to memory of 1176	2756	rundll32.exe	msiexec.exe
PID 2756 wrote to memory of 1176	2756	rundll32.exe	msiexec.exe
PID 2756 wrote to memory of 1176	2756	rundll32.exe	msiexec.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fyivybu.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2704

memory/1176-119-0x0000000000660000-0x000000000068E000-memory.dmp

Filesize
184KB

Download
memory/1176-120-0x0000000000000000-mapping.dmp

Download
memory/1176-121-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/1176-122-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/2756-115-0x0000000000000000-mapping.dmp

Download
memory/2756-116-0x0000000073930000-0x000000007395E000-memory.dmp

Filesize
184KB

Download
memory/2756-117-0x0000000073930000-0x00000000739BD000-memory.dmp

Filesize
564KB

Download
memory/2756-118-0x0000000000940000-0x0000000000A8A000-memory.dmp

Filesize
1.3MB

Download