zloader | c12fdcad28de4408e7fd22c39ba6a1c6bc592fb1c1a61a83aaa59893c103c3f0

Analysis

Target

us.dll
Size

2.2MB
MD5

d2ab32cb696a12c4d3411d2712272d98
SHA1

fb2ba905ea5340fe06734924953a1333fae9385b
SHA256

c12fdcad28de4408e7fd22c39ba6a1c6bc592fb1c1a61a83aaa59893c103c3f0
SHA512

3027118fe1bdc127c44bf25b72dd076e850e81e96c92810ca46b8e80bd29223527ba8cbd71908e66cf0a72a55bfbf59934260f9442822b8e1de85844e66be856

Score

10^/10

Family

zloader

Botnet

9092us

Campaign

9092us

https://asdfghdsajkl.com/gate.php

https://lkjhgfgsdshja.com/gate.php

https://kjdhsasghjds.com/gate.php

https://kdjwhqejqwij.com/gate.php

https://iasudjghnasd.com/gate.php

https://daksjuggdhwa.com/gate.php

https://dkisuaggdjhna.com/gate.php

https://eiqwuggejqw.com/gate.php

https://dquggwjhdmq.com/gate.php

https://djshggadasj.com/gate.php

Attributes

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1556 wrote to memory of 1600	1556	regsvr32.exe	regsvr32.exe
PID 1556 wrote to memory of 1600	1556	regsvr32.exe	regsvr32.exe
PID 1556 wrote to memory of 1600	1556	regsvr32.exe	regsvr32.exe
PID 1556 wrote to memory of 1600	1556	regsvr32.exe	regsvr32.exe
PID 1556 wrote to memory of 1600	1556	regsvr32.exe	regsvr32.exe
PID 1556 wrote to memory of 1600	1556	regsvr32.exe	regsvr32.exe
PID 1556 wrote to memory of 1600	1556	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\us.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1556

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\us.dll
2⤵
PID:1600

memory/1288-59-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/1288-60-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/1288-61-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/1288-62-0x0000000000000000-mapping.dmp

Download
memory/1288-64-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/1556-54-0x000007FEFC2D1000-0x000007FEFC2D3000-memory.dmp

Filesize
8KB

Download
memory/1600-55-0x0000000000000000-mapping.dmp

Download
memory/1600-56-0x0000000075801000-0x0000000075803000-memory.dmp

Filesize
8KB

Download
memory/1600-57-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/1600-58-0x0000000010000000-0x0000000010245000-memory.dmp

Filesize
2.3MB

Download