Analysis
-
max time kernel
103s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
29-03-2022 23:18
General
-
Target
f71190dc8f61cd12973cdcd12907b1bc4badde565923dc2e10b66b387977390a.dll
-
Size
387KB
-
MD5
6be160e07c67e20f34890c68e947f2be
-
SHA1
d283d4eeb4f4c2e1221999b41ed4d1f166fcca45
-
SHA256
f71190dc8f61cd12973cdcd12907b1bc4badde565923dc2e10b66b387977390a
-
SHA512
99b64158d7d379384e5566fccb59d1bad1df30a0364fe2bc94b069c0acda4ef762c9795c41f3a06a1d3c38c4ea38269105821b31a4e2bdd89d5f6303d60182df
Score
10/10
Malware Config
Extracted
Family
zloader
Botnet
nut
Campaign
17/11
C2
https://www.jaspalandassociates.com/logs.php
https://physiotherapywala.com/logs.php
https://proactivefacilities.com/logs.php
https://www.kabiraprints.in/logs.php
https://www.joinaslicagent.co.in/logs.php
https://mintcennelattti.ga/wp-smarts.php
Attributes
-
build_id
237
rc4.plain
rsa_pubkey.plain
Signatures
-
Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f71190dc8f61cd12973cdcd12907b1bc4badde565923dc2e10b66b387977390a.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f71190dc8f61cd12973cdcd12907b1bc4badde565923dc2e10b66b387977390a.dll,#12⤵
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
-
Filesize
452KB
-
Filesize
452KB
-
Filesize
152KB
-
-
Filesize
152KB
-
Filesize
152KB