Overview

overview

10

Static

static

us12.23.dll

windows7_x64

10

us12.23.dll

windows10_x64

10

Analysis

  • max time kernel
    40s
  • max time network
    124s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    06/01/2022, 10:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    us12.23.dll
  • Size 1.9MB
  • Sample220106-mz5hyabeep
  • SHA256 034f61d86de99210eb32a2dca27a3ad883f54750c46cdec4fcc53050b2f716eb
  • MD5 SHA1 SHA512
Score
10/10
zloader9092us9092usbotnettrojan

Malware Config

Extracted

Family

  • zloader

Botnet

  • 9092us

Campaign

  • 9092us

C2

  • https://asdfghdsajkl.com/gate.php

  • https://lkjhgfgsdshja.com/gate.php

  • https://kjdhsasghjds.com/gate.php

  • https://kdjwhqejqwij.com/gate.php

  • https://iasudjghnasd.com/gate.php

  • https://daksjuggdhwa.com/gate.php

  • https://dkisuaggdjhna.com/gate.php

  • https://eiqwuggejqw.com/gate.php

  • https://dquggwjhdmq.com/gate.php

  • https://djshggadasj.com/gate.php

Attributes
  • build_id

    157

rc4.plain
rsa_pubkey.plain

Signatures

  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

    trojanbotnetzloader
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\us12.23.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3552
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\us12.23.dll
      2⤵
        PID:3420
        • C:\Windows\SysWOW64\msiexec.exe
          msiexec.exe
          3⤵
            PID:4452

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            memory/3420-117-0x0000000000340000-0x0000000000341000-memory.dmp
            Download

            memory/3420-118-0x0000000010000000-0x00000000101ED000-memory.dmp
            Download

            memory/4452-119-0x0000000000E20000-0x0000000000E46000-memory.dmp
            Download

            memory/4452-121-0x0000000000B30000-0x0000000000B31000-memory.dmp
            Download

            memory/4452-122-0x0000000000B30000-0x0000000000B31000-memory.dmp
            Download

            memory/4452-123-0x0000000000E20000-0x0000000000E46000-memory.dmp
            Download