zloader | 2d16dbdbbf095cf07cbb0ca6f52b805fbf017b0c17adddcc97501af0744a2249

Analysis

max time kernel
111s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
03-05-2022 20:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d16dbdbbf095cf07cbb0ca6f52b805fbf017b0c17adddcc97501af0744a2249.dll
Size

570KB
MD5

a0478e894c26cfbed2d863b09415b500
SHA1

353819c00d733c3528c0eddabb4e1d98a037bf12
SHA256

2d16dbdbbf095cf07cbb0ca6f52b805fbf017b0c17adddcc97501af0744a2249
SHA512

e61e63e6df8ab5396b2d20ae812e5a871234c47b91635f3e3ed51d2274ebe2303d0ea974fe4253e163217ef1091ff40e9870d1d785bd3503dc959fbd0cad393d

Score

10^/10

zloader divader poll botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

divader

Campaign

poll

https://fqnceas.su/gate.php

https://fqlocpeas.ru/gate.php

https://dksaiijn.ru/gate.php

https://dksafjasnf.su/gate.php

https://fjsafasfsa.ru/gate.php

https://fjskoijafsa.ru/gate.php

https://kochamkkkras.ru/gate.php

https://uookqihwdid.ru/gate.php

https://iqowijsdakm.ru/gate.php

https://wiewjdmkfjn.ru/gate.php

Attributes

build_id
128

rc4.plain

rsa_pubkey.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 3940	4684	rundll32.exe	80
PID 4684 wrote to memory of 3940	4684	rundll32.exe	80
PID 4684 wrote to memory of 3940	4684	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d16dbdbbf095cf07cbb0ca6f52b805fbf017b0c17adddcc97501af0744a2249.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d16dbdbbf095cf07cbb0ca6f52b805fbf017b0c17adddcc97501af0744a2249.dll,#1
  2⤵
  PID:3940
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec.exe
    3⤵
    PID:4976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3940-132-0x0000000002550000-0x000000000259B000-memory.dmp

Filesize
300KB

Download
memory/3940-133-0x0000000002620000-0x0000000002646000-memory.dmp

Filesize
152KB

Download
memory/4976-135-0x00000000008E0000-0x0000000000906000-memory.dmp

Filesize
152KB

Download
memory/4976-136-0x00000000008E0000-0x0000000000906000-memory.dmp

Filesize
152KB

Download