Analysis
-
max time kernel
51s -
max time network
148s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
13-12-2021 08:59
General
-
Target
dbc9134eea10cc88289908e112cde9a69334c779a3a659da17d3656f48a7f844.dll
-
Size
507KB
-
MD5
e37ed649a3777bff725e4a0074a9c8e3
-
SHA1
7a57118ee3122c9bdb45cf7a9b2efd72fe258771
-
SHA256
dbc9134eea10cc88289908e112cde9a69334c779a3a659da17d3656f48a7f844
-
SHA512
62ac3aad9932a3159c02ef66b7da48c7f4d596e936dc67afe8902554cfc3fbab71c21419b95c67617222f06747f96a9906d280a4049c82a2f9bbab769739c569
Malware Config
Extracted
zloader
9092us
9092us
https://asdfghdsajkl.com/gate.php
https://lkjhgfgsdshja.com/gate.php
https://kjdhsasghjds.com/gate.php
https://kdjwhqejqwij.com/gate.php
https://iasudjghnasd.com/gate.php
https://daksjuggdhwa.com/gate.php
https://dkisuaggdjhna.com/gate.php
https://eiqwuggejqw.com/gate.php
https://dquggwjhdmq.com/gate.php
https://djshggadasj.com/gate.php
-
build_id
157
Signatures
-
Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\dbc9134eea10cc88289908e112cde9a69334c779a3a659da17d3656f48a7f844.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\dbc9134eea10cc88289908e112cde9a69334c779a3a659da17d3656f48a7f844.dll2⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152KB
-
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
152KB
-
-
Filesize
4KB
-
Filesize
628KB