zloader | 9b2e896b50b8658a5ff602db0913e50cb9fa2c6dd13f103a5f10f8d1b2021e68

General

Target

A25D33F3F8C2DA6DC35A64B16229D5F0692FB5C5.dll
Size

814KB
MD5

97de56e1708e4f34d65663d127fb8857
SHA1

a25d33f3f8c2da6dc35a64b16229d5f0692fb5c5
SHA256

9b2e896b50b8658a5ff602db0913e50cb9fa2c6dd13f103a5f10f8d1b2021e68
SHA512

4cdf3aee57a633b81860c5343e27aae77a087acee60b215939aeade815cdb0714ca8bcdd81f74f946d773c54e015e4eef727bacf8cce8cc7caf8d1cbc519b1d7

Score

10^/10

zloader 9092us 9092us botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

9092us

Campaign

9092us

C2

https://asdfghdsajkl.com/gate.php

https://lkjhgfgsdshja.com/gate.php

https://kjdhsasghjds.com/gate.php

https://kdjwhqejqwij.com/gate.php

https://iasudjghnasd.com/gate.php

https://daksjuggdhwa.com/gate.php

https://dkisuaggdjhna.com/gate.php

https://eiqwuggejqw.com/gate.php

https://dquggwjhdmq.com/gate.php

https://djshggadasj.com/gate.php

Attributes

build_id
157

rc4.plain

rsa_pubkey.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

regsvr32.exe

pid	process
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

regsvr32.exe

pid	process
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe
940	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1624 wrote to memory of 940	1624	regsvr32.exe	regsvr32.exe
PID 1624 wrote to memory of 940	1624	regsvr32.exe	regsvr32.exe
PID 1624 wrote to memory of 940	1624	regsvr32.exe	regsvr32.exe
PID 1624 wrote to memory of 940	1624	regsvr32.exe	regsvr32.exe
PID 1624 wrote to memory of 940	1624	regsvr32.exe	regsvr32.exe
PID 1624 wrote to memory of 940	1624	regsvr32.exe	regsvr32.exe
PID 1624 wrote to memory of 940	1624	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\A25D33F3F8C2DA6DC35A64B16229D5F0692FB5C5.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1624

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\A25D33F3F8C2DA6DC35A64B16229D5F0692FB5C5.dll
2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:940

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
3⤵
PID:652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/652-59-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/652-60-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/652-61-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/652-62-0x0000000000000000-mapping.dmp

Download
memory/652-64-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/940-55-0x0000000000000000-mapping.dmp

Download
memory/940-56-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download
memory/940-57-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/940-58-0x0000000010000000-0x00000000100D5000-memory.dmp

Filesize
852KB

Download
memory/1624-54-0x000007FEFBE11000-0x000007FEFBE13000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads