zloader | 034f61d86de99210eb32a2dca27a3ad883f54750c46cdec4fcc53050b2f716eb

Analysis

Target

us12.23.dll
Size

1.9MB
MD5

1b4eb327a40a14ac4afa627125b63056
SHA1

2c0bc274bc2fd9dab82330b837711355170fc606
SHA256

034f61d86de99210eb32a2dca27a3ad883f54750c46cdec4fcc53050b2f716eb
SHA512

b94770dbf4339677dde0583f0da87bba1fb1c5c0eb028f1697976b24d6298ed43a2d2d1062c8c13a569a3db3032856a37d640a94fe4461986c2d44d1c4c4c819

Score

10^/10

Family

zloader

Botnet

9092us

Campaign

9092us

https://asdfghdsajkl.com/gate.php

https://lkjhgfgsdshja.com/gate.php

https://kjdhsasghjds.com/gate.php

https://kdjwhqejqwij.com/gate.php

https://iasudjghnasd.com/gate.php

https://daksjuggdhwa.com/gate.php

https://dkisuaggdjhna.com/gate.php

https://eiqwuggejqw.com/gate.php

https://dquggwjhdmq.com/gate.php

https://djshggadasj.com/gate.php

Attributes

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1692 wrote to memory of 1564	1692	regsvr32.exe	regsvr32.exe
PID 1692 wrote to memory of 1564	1692	regsvr32.exe	regsvr32.exe
PID 1692 wrote to memory of 1564	1692	regsvr32.exe	regsvr32.exe
PID 1692 wrote to memory of 1564	1692	regsvr32.exe	regsvr32.exe
PID 1692 wrote to memory of 1564	1692	regsvr32.exe	regsvr32.exe
PID 1692 wrote to memory of 1564	1692	regsvr32.exe	regsvr32.exe
PID 1692 wrote to memory of 1564	1692	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\us12.23.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1692

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\us12.23.dll
2⤵
PID:1564

memory/1248-59-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/1248-60-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/1248-61-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/1248-62-0x0000000000000000-mapping.dmp

Download
memory/1248-64-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/1564-55-0x0000000000000000-mapping.dmp

Download
memory/1564-56-0x0000000075B51000-0x0000000075B53000-memory.dmp

Filesize
8KB

Download
memory/1564-57-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/1564-58-0x0000000010000000-0x00000000101ED000-memory.dmp

Filesize
1.9MB

Download
memory/1692-54-0x000007FEFB9C1000-0x000007FEFB9C3000-memory.dmp

Filesize
8KB

Download