zloader | 3ef112a50f77507aeae019061f763ac51fcca1177759ef18f31bbb42bc633bd6

Analysis

max time kernel
136s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
17/04/2022, 14:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ef112a50f77507aeae019061f763ac51fcca1177759ef18f31bbb42bc633bd6.dll
Size

269KB
MD5

93f753348d597c11766bbec6543e95a5
SHA1

128dbeb3464799d9ac4873a40c067691b9fb06e5
SHA256

3ef112a50f77507aeae019061f763ac51fcca1177759ef18f31bbb42bc633bd6
SHA512

e5df0a6513bc1b4201cd54e3d6ab12ad80724e0918ede61c9f070ae8b5b86bddd691bf053404c44deef132adc049272136233190711bf65c353b3dbbe02d06ba

Score

10^/10

zloader kev 15/10 botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

kev

Campaign

15/10

https://combotraining.fr/wpdrxl.php

https://jokilink.com/4wjgxc.php

https://latinosconstruction.com/adfuon.php

https://liciousbbl.com/vuadtm.php

https://kingbhavthanbetepos.tk/wp-smarts.php

https://piksellat.com/tcsrog.php

Attributes

build_id
169

rc4.plain

rsa_pubkey.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 624	4904	rundll32.exe	83
PID 4904 wrote to memory of 624	4904	rundll32.exe	83
PID 4904 wrote to memory of 624	4904	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ef112a50f77507aeae019061f763ac51fcca1177759ef18f31bbb42bc633bd6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ef112a50f77507aeae019061f763ac51fcca1177759ef18f31bbb42bc633bd6.dll,#1
  2⤵
  PID:624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/624-132-0x0000000074C90000-0x0000000074CE8000-memory.dmp

Filesize
352KB

Download
memory/624-131-0x0000000074C90000-0x0000000074CB6000-memory.dmp

Filesize
152KB

Download