zloader | 164d36f53bcb5f7a12e35853f30792a8c106488c71b5a2145486b998cfaf804a | Triage

Analysis

max time kernel
158s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
08-05-2022 15:56

Sharing

Report Analysis Logs

General

Target

164d36f53bcb5f7a12e35853f30792a8c106488c71b5a2145486b998cfaf804a.dll
Size

415KB
MD5

dbadd7d0d59eeb30ce5a7eda3f4a3336
SHA1

1e8d76eef202ef2aa6669f8a8e2b1a61b941671e
SHA256

164d36f53bcb5f7a12e35853f30792a8c106488c71b5a2145486b998cfaf804a
SHA512

5cbd1b97ed9a6a6432c5c950b49c9b2abc49f13ee5e53b2c202842084ce46630458692bca5fe4c2208d24fd9ed23be422e365b50ed6fd372a77924283e41a183

Score

10^/10

zloader october october08 botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

october

Campaign

october08

C2

http://sept9stuff10.com/web/post.php

http://sept9stuff11.com/web/post.php

Attributes

build_id
55

rc4.plain

rsa_pubkey.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 4548 wrote to memory of 4252	4548	regsvr32.exe	regsvr32.exe
PID 4548 wrote to memory of 4252	4548	regsvr32.exe	regsvr32.exe
PID 4548 wrote to memory of 4252	4548	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\164d36f53bcb5f7a12e35853f30792a8c106488c71b5a2145486b998cfaf804a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4548

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\164d36f53bcb5f7a12e35853f30792a8c106488c71b5a2145486b998cfaf804a.dll
2⤵
PID:4252

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4252-130-0x0000000000000000-mapping.dmp

Download
memory/4252-131-0x00000000751C0000-0x00000000751E8000-memory.dmp

Filesize
160KB

Download
memory/4252-132-0x00000000751C0000-0x0000000075287000-memory.dmp

Filesize
796KB

Download
memory/4252-133-0x00000000751C0000-0x0000000075287000-memory.dmp

Filesize
796KB

Download