zloader | a08fa77833ace89dbc789d804f9f5632fec0b64a301567e07f495e98c33bee42

Analysis

max time kernel
4294150s
max time network
132s
platform
windows7_x64
resource
win7-20220310-en
submitted
19-03-2022 18:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a08fa77833ace89dbc789d804f9f5632fec0b64a301567e07f495e98c33bee42.dll
Size

437KB
MD5

afe7a69ba07d6d8c7779b8d99277a87c
SHA1

fa203f36e976c3ef1fbad3c9b5a55117497e5768
SHA256

a08fa77833ace89dbc789d804f9f5632fec0b64a301567e07f495e98c33bee42
SHA512

d347c0169a0edb846ac11b49b28b709327917e3e35d36ccc356b9377ee72982926485e1895797ac599a347782fcdcc1e1511352461138bc2a617c9da437ccef3

Score

10^/10

zloader googleaktualizacija googleaktualizacija2 botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

googleaktualizacija

Campaign

googleaktualizacija2

https://iqowijsdakm.com/gate.php

https://wiewjdmkfjn.com/gate.php

https://dksaoidiakjd.com/gate.php

https://iweuiqjdakjd.com/gate.php

https://yuidskadjna.com/gate.php

https://olksmadnbdj.com/gate.php

https://odsakmdfnbs.com/gate.php

https://odsakjmdnhsaj.com/gate.php

https://odjdnhsaj.com/gate.php

https://odoishsaj.com/gate.php

Attributes

build_id
156

rc4.plain

rsa_pubkey.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1992 wrote to memory of 1268	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 1268	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 1268	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 1268	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 1268	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 1268	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 1268	1992	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a08fa77833ace89dbc789d804f9f5632fec0b64a301567e07f495e98c33bee42.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1992

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a08fa77833ace89dbc789d804f9f5632fec0b64a301567e07f495e98c33bee42.dll,#1
2⤵
PID:1268

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
3⤵
PID:1680

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1268-54-0x00000000765D1000-0x00000000765D3000-memory.dmp

Filesize
8KB

Download
memory/1268-55-0x0000000000260000-0x0000000000282000-memory.dmp

Filesize
136KB

Download
memory/1268-56-0x0000000010000000-0x000000001006E000-memory.dmp

Filesize
440KB

Download
memory/1680-57-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/1680-59-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/1680-61-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/1680-63-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download