zloader | 3ef112a50f77507aeae019061f763ac51fcca1177759ef18f31bbb42bc633bd6

Analysis

max time kernel
131s
max time network
47s
platform
windows7_x64
resource
win7-20220414-en
submitted
17-04-2022 14:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ef112a50f77507aeae019061f763ac51fcca1177759ef18f31bbb42bc633bd6.dll
Size

269KB
MD5

93f753348d597c11766bbec6543e95a5
SHA1

128dbeb3464799d9ac4873a40c067691b9fb06e5
SHA256

3ef112a50f77507aeae019061f763ac51fcca1177759ef18f31bbb42bc633bd6
SHA512

e5df0a6513bc1b4201cd54e3d6ab12ad80724e0918ede61c9f070ae8b5b86bddd691bf053404c44deef132adc049272136233190711bf65c353b3dbbe02d06ba

Score

10^/10

zloader kev 15/10 botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

kev

Campaign

15/10

https://combotraining.fr/wpdrxl.php

https://jokilink.com/4wjgxc.php

https://latinosconstruction.com/adfuon.php

https://liciousbbl.com/vuadtm.php

https://kingbhavthanbetepos.tk/wp-smarts.php

https://piksellat.com/tcsrog.php

Attributes

build_id
169

rc4.plain

rsa_pubkey.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1664 wrote to memory of 1960	1664	rundll32.exe	rundll32.exe
PID 1664 wrote to memory of 1960	1664	rundll32.exe	rundll32.exe
PID 1664 wrote to memory of 1960	1664	rundll32.exe	rundll32.exe
PID 1664 wrote to memory of 1960	1664	rundll32.exe	rundll32.exe
PID 1664 wrote to memory of 1960	1664	rundll32.exe	rundll32.exe
PID 1664 wrote to memory of 1960	1664	rundll32.exe	rundll32.exe
PID 1664 wrote to memory of 1960	1664	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ef112a50f77507aeae019061f763ac51fcca1177759ef18f31bbb42bc633bd6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1664

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ef112a50f77507aeae019061f763ac51fcca1177759ef18f31bbb42bc633bd6.dll,#1
2⤵
PID:1960

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
1⤵
PID:1160

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1160-61-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/1160-59-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/1160-62-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/1160-63-0x0000000000000000-mapping.dmp

Download
memory/1160-65-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/1960-54-0x0000000000000000-mapping.dmp

Download
memory/1960-55-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download
memory/1960-57-0x0000000074830000-0x0000000074888000-memory.dmp

Filesize
352KB

Download
memory/1960-56-0x0000000074830000-0x0000000074856000-memory.dmp

Filesize
152KB

Download
memory/1960-58-0x0000000074830000-0x0000000074888000-memory.dmp

Filesize
352KB

Download