zloader | 2d16dbdbbf095cf07cbb0ca6f52b805fbf017b0c17adddcc97501af0744a2249

Analysis

Target

2d16dbdbbf095cf07cbb0ca6f52b805fbf017b0c17adddcc97501af0744a2249.dll
Size

570KB
MD5

a0478e894c26cfbed2d863b09415b500
SHA1

353819c00d733c3528c0eddabb4e1d98a037bf12
SHA256

2d16dbdbbf095cf07cbb0ca6f52b805fbf017b0c17adddcc97501af0744a2249
SHA512

e61e63e6df8ab5396b2d20ae812e5a871234c47b91635f3e3ed51d2274ebe2303d0ea974fe4253e163217ef1091ff40e9870d1d785bd3503dc959fbd0cad393d

Score

10^/10

Family

zloader

Botnet

divader

Campaign

poll

https://fqnceas.su/gate.php

https://fqlocpeas.ru/gate.php

https://dksaiijn.ru/gate.php

https://dksafjasnf.su/gate.php

https://fjsafasfsa.ru/gate.php

https://fjskoijafsa.ru/gate.php

https://kochamkkkras.ru/gate.php

https://uookqihwdid.ru/gate.php

https://iqowijsdakm.ru/gate.php

https://wiewjdmkfjn.ru/gate.php

Attributes

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1944 wrote to memory of 1676	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 1676	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 1676	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 1676	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 1676	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 1676	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 1676	1944	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d16dbdbbf095cf07cbb0ca6f52b805fbf017b0c17adddcc97501af0744a2249.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d16dbdbbf095cf07cbb0ca6f52b805fbf017b0c17adddcc97501af0744a2249.dll,#1
  2⤵
  PID:1676
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec.exe
    3⤵
    PID:1636

memory/1636-58-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/1636-60-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/1636-61-0x0000000000000000-mapping.dmp

Download
memory/1636-63-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/1676-54-0x0000000000000000-mapping.dmp

Download
memory/1676-55-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download
memory/1676-56-0x00000000003C0000-0x000000000040B000-memory.dmp

Filesize
300KB

Download
memory/1676-57-0x0000000000230000-0x0000000000256000-memory.dmp

Filesize
152KB

Download