Analysis
-
max time kernel
51s -
max time network
122s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
06-01-2022 10:54
General
-
Target
ca.dll
-
Size
1.7MB
-
MD5
ca0376cce08c82a5d4c476c4922c4779
-
SHA1
99644ab0f8d4dde1eb11b7ff88ebd66b21d73f24
-
SHA256
f0b6c677bac2de611e0866e849cebd64ec5454885fdd7be5bf0c1c5a17846e3a
-
SHA512
80ad7465be9cfb1e9eabe46e7218c28ffdb71c75b055b9f196f33ac70c3ec80c1e4e9b9ada03d6e4b49415ad1dcea81b2b343df52851f0c2c528131725405813
Malware Config
Extracted
zloader
return
return
https://asdfghdsajkl.com/gate.php
https://lkjhgfgsdshja.com/gate.php
https://kjdhsasghjds.com/gate.php
https://kdjwhqejqwij.com/gate.php
https://iasudjghnasd.com/gate.php
https://daksjuggdhwa.com/gate.php
https://dkisuaggdjhna.com/gate.php
https://eiqwuggejqw.com/gate.php
https://dquggwjhdmq.com/gate.php
https://djshggadasj.com/gate.php
-
build_id
157
Signatures
-
Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ca.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ca.dll,#12⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152KB
-
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
152KB
-
-
Filesize
4KB
-
Filesize
1.8MB