zloader | 92819abc5959ef5dcdec4ad5ffc638e8492d0deec4569fc9cef2501adec5474a

Analysis

Target

92819abc5959ef5dcdec4ad5ffc638e8492d0deec4569fc9cef2501adec5474a.dll
Size

276KB
MD5

bbfa105715b98f8de465c8afcb4130ef
SHA1

b73c7aed91aa18f558b1a9a378fea4e5535bdf4c
SHA256

92819abc5959ef5dcdec4ad5ffc638e8492d0deec4569fc9cef2501adec5474a
SHA512

ca8279c7b22805a19a02ea7a2793db800b987f9554233df2a709a3c136c8cf89c8c6d6944b05c5f09d0e39628ce39fd43a2861c83772a1cd2a9205401a3c214d

Score

10^/10

Family

zloader

Botnet

25/03

https://wgyvjbse.pw/milagrecf.php

https://botiq.xyz/milagrecf.php

Attributes

rc4.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1872 set thread context of 1232	1872	rundll32.exe	30

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 1872	1092	rundll32.exe	27
PID 1092 wrote to memory of 1872	1092	rundll32.exe	27
PID 1092 wrote to memory of 1872	1092	rundll32.exe	27
PID 1092 wrote to memory of 1872	1092	rundll32.exe	27
PID 1092 wrote to memory of 1872	1092	rundll32.exe	27
PID 1092 wrote to memory of 1872	1092	rundll32.exe	27
PID 1092 wrote to memory of 1872	1092	rundll32.exe	27
PID 1872 wrote to memory of 1232	1872	rundll32.exe	30
PID 1872 wrote to memory of 1232	1872	rundll32.exe	30
PID 1872 wrote to memory of 1232	1872	rundll32.exe	30
PID 1872 wrote to memory of 1232	1872	rundll32.exe	30
PID 1872 wrote to memory of 1232	1872	rundll32.exe	30
PID 1872 wrote to memory of 1232	1872	rundll32.exe	30
PID 1872 wrote to memory of 1232	1872	rundll32.exe	30
PID 1872 wrote to memory of 1232	1872	rundll32.exe	30
PID 1872 wrote to memory of 1232	1872	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\92819abc5959ef5dcdec4ad5ffc638e8492d0deec4569fc9cef2501adec5474a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\92819abc5959ef5dcdec4ad5ffc638e8492d0deec4569fc9cef2501adec5474a.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec.exe
    3⤵
    PID:1232

memory/1232-61-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/1232-60-0x0000000000090000-0x00000000000BE000-memory.dmp

Filesize
184KB

Download
memory/1232-62-0x0000000000090000-0x00000000000BE000-memory.dmp

Filesize
184KB

Download
memory/1232-64-0x0000000000090000-0x00000000000BE000-memory.dmp

Filesize
184KB

Download
memory/1872-54-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download
memory/1872-55-0x0000000000220000-0x000000000027A000-memory.dmp

Filesize
360KB

Download
memory/1872-58-0x0000000000220000-0x000000000027A000-memory.dmp

Filesize
360KB

Download
memory/1872-57-0x0000000000220000-0x000000000024E000-memory.dmp

Filesize
184KB

Download
memory/1872-59-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download