Analysis
- max time kernel
51s - max time network
126s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
07/01/2022, 09:55
General
- Target ca.dll
- Size 1.7MB
- Sample220107-lx1xascba3
- SHA256 f0b6c677bac2de611e0866e849cebd64ec5454885fdd7be5bf0c1c5a17846e3a
Malware Config
Extracted
-
zloader
-
return
-
return
-
https://asdfghdsajkl.com/gate.php
-
https://lkjhgfgsdshja.com/gate.php
-
https://kjdhsasghjds.com/gate.php
-
https://kdjwhqejqwij.com/gate.php
-
https://iasudjghnasd.com/gate.php
-
https://daksjuggdhwa.com/gate.php
-
https://dkisuaggdjhna.com/gate.php
-
https://eiqwuggejqw.com/gate.php
-
https://dquggwjhdmq.com/gate.php
-
https://djshggadasj.com/gate.php
-
build_id
157
Signatures
- Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ca.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ca.dll,#12⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2524-116-0x00000000003C0000-0x00000000003C1000-memory.dmp
memory/2524-117-0x0000000010000000-0x00000000101C8000-memory.dmp
memory/3412-118-0x0000000000670000-0x0000000000696000-memory.dmp
memory/3412-121-0x0000000000380000-0x0000000000381000-memory.dmp
memory/3412-120-0x0000000000380000-0x0000000000381000-memory.dmp
memory/3412-122-0x0000000000670000-0x0000000000696000-memory.dmp