zloader | fe92ba37ac1124c880983da60dd4b32bc8d82a180c5784bb72f9a0df41950a17

Analysis

Target

fe92ba37ac1124c880983da60dd4b32bc8d82a180c5784bb72f9a0df41950a17.dll
Size

652KB
MD5

3164bff4a716e80bd44e623135f93f82
SHA1

f1b87e225d149464eee3781808dd9ccf293d221b
SHA256

fe92ba37ac1124c880983da60dd4b32bc8d82a180c5784bb72f9a0df41950a17
SHA512

0165f96a030e97160a65a4e75a2663ae0447a0d3990a007a2bc27c510bb836eba127224219dbaa91d728c77e0686d064ea10fb871f74325158d8fb0d88c68da9

Score

10^/10

Family

zloader

Botnet

oct

Campaign

oct23

http://wingtonwelbemdon.com/web/post.php

http://donburitimesofindia.com/web/post.php

http://celtictimesofkarishan.com/web/post.php

http://welcometothehotelsoflifes.com/web/post.php

http://wheredidtheelllcctoncsgo.com/web/post.php

http://myworld2002020999.com/web/post.php

Attributes

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4004 wrote to memory of 2996	4004	rundll32.exe	rundll32.exe
PID 4004 wrote to memory of 2996	4004	rundll32.exe	rundll32.exe
PID 4004 wrote to memory of 2996	4004	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe92ba37ac1124c880983da60dd4b32bc8d82a180c5784bb72f9a0df41950a17.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4004

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe92ba37ac1124c880983da60dd4b32bc8d82a180c5784bb72f9a0df41950a17.dll,#1
2⤵
PID:2996

memory/2996-130-0x0000000000000000-mapping.dmp

Download
memory/2996-132-0x0000000074AD0000-0x0000000074B80000-memory.dmp

Filesize
704KB

Download
memory/2996-131-0x0000000074AD0000-0x0000000074AF5000-memory.dmp

Filesize
148KB

Download
memory/2996-133-0x0000000074AD0000-0x0000000074B80000-memory.dmp

Filesize
704KB

Download
memory/4800-134-0x0000000000000000-mapping.dmp

Download
memory/4800-135-0x0000000000580000-0x00000000005A5000-memory.dmp

Filesize
148KB

Download
memory/4800-136-0x0000000000580000-0x00000000005A5000-memory.dmp

Filesize
148KB

Download