Analysis
-
max time kernel
51s -
max time network
125s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
11-01-2022 10:45
General
-
Target
2C0BC274BC2FD9DAB82330B837711355170FC606.dll
-
Size
1.9MB
-
MD5
1b4eb327a40a14ac4afa627125b63056
-
SHA1
2c0bc274bc2fd9dab82330b837711355170fc606
-
SHA256
034f61d86de99210eb32a2dca27a3ad883f54750c46cdec4fcc53050b2f716eb
-
SHA512
b94770dbf4339677dde0583f0da87bba1fb1c5c0eb028f1697976b24d6298ed43a2d2d1062c8c13a569a3db3032856a37d640a94fe4461986c2d44d1c4c4c819
Malware Config
Extracted
zloader
9092us
9092us
https://asdfghdsajkl.com/gate.php
https://lkjhgfgsdshja.com/gate.php
https://kjdhsasghjds.com/gate.php
https://kdjwhqejqwij.com/gate.php
https://iasudjghnasd.com/gate.php
https://daksjuggdhwa.com/gate.php
https://dkisuaggdjhna.com/gate.php
https://eiqwuggejqw.com/gate.php
https://dquggwjhdmq.com/gate.php
https://djshggadasj.com/gate.php
-
build_id
157
Signatures
-
Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\2C0BC274BC2FD9DAB82330B837711355170FC606.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\2C0BC274BC2FD9DAB82330B837711355170FC606.dll2⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
-
Filesize
4KB
-
Filesize
1.9MB
-
Filesize
152KB
-
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
152KB