zloader | 00c1cc0ba66f03d31042842ba2852c7068735c88be975e14cf711f996226d2e3

Analysis

Target

00c1cc0ba66f03d31042842ba2852c7068735c88be975e14cf711f996226d2e3.dll
Size

1.6MB
MD5

e7cdb8bee224974ff5d78c85f53ca40c
SHA1

2ca1aa8088c8be1cce6000b51c4eac286e4d98f6
SHA256

00c1cc0ba66f03d31042842ba2852c7068735c88be975e14cf711f996226d2e3
SHA512

e8b50f0678c5e674195e38ce2508a2006b6d1e523d181970a522be684f499c5d2a30e7035cf496fefbf084cb480d2526f774441d8071168a80bf437a6f442c3e

Score

10^/10

Family

zloader

Botnet

kev

Campaign

28/10

https://cheerdak.com/wvje1k.php

https://hkq.cfc.myftpupload.com/fagho1.php

https://puraanvidya.com/tsmo2x.php

https://creatorclick.com/qtvjkv.php

https://tsapparel.com.my/n0by93.php

https://www.wise-network.net/wp-parsing.php

https://logtetuseslo.tk/wp-smarts.php

Attributes

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1728 wrote to memory of 1924	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 1924	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 1924	1728	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00c1cc0ba66f03d31042842ba2852c7068735c88be975e14cf711f996226d2e3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1728

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00c1cc0ba66f03d31042842ba2852c7068735c88be975e14cf711f996226d2e3.dll,#1
2⤵
PID:1924

memory/1924-130-0x0000000000000000-mapping.dmp

Download
memory/1924-131-0x0000000075130000-0x0000000075156000-memory.dmp

Filesize
152KB

Download
memory/1924-132-0x0000000075130000-0x00000000752D4000-memory.dmp

Filesize
1.6MB

Download
memory/5096-133-0x0000000000000000-mapping.dmp

Download
memory/5096-134-0x0000000000DC0000-0x0000000000DE6000-memory.dmp

Filesize
152KB

Download
memory/5096-135-0x0000000000DC0000-0x0000000000DE6000-memory.dmp

Filesize
152KB

Download