Analysis
-
max time kernel
40s -
max time network
124s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
06-01-2022 10:55
General
-
Target
us12.23.dll
-
Size
1.9MB
-
MD5
1b4eb327a40a14ac4afa627125b63056
-
SHA1
2c0bc274bc2fd9dab82330b837711355170fc606
-
SHA256
034f61d86de99210eb32a2dca27a3ad883f54750c46cdec4fcc53050b2f716eb
-
SHA512
b94770dbf4339677dde0583f0da87bba1fb1c5c0eb028f1697976b24d6298ed43a2d2d1062c8c13a569a3db3032856a37d640a94fe4461986c2d44d1c4c4c819
Malware Config
Extracted
zloader
9092us
9092us
https://asdfghdsajkl.com/gate.php
https://lkjhgfgsdshja.com/gate.php
https://kjdhsasghjds.com/gate.php
https://kdjwhqejqwij.com/gate.php
https://iasudjghnasd.com/gate.php
https://daksjuggdhwa.com/gate.php
https://dkisuaggdjhna.com/gate.php
https://eiqwuggejqw.com/gate.php
https://dquggwjhdmq.com/gate.php
https://djshggadasj.com/gate.php
-
build_id
157
Signatures
-
Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\us12.23.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\us12.23.dll2⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
-
Filesize
4KB
-
Filesize
1.9MB
-
Filesize
152KB
-
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
152KB