Analysis

  • max time kernel
    93s
  • max time network
    131s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    20-05-2022 23:44

General

  • Target

    45f3f5d22895889574eb220c91242129153c6d85374d08665348c3bbe3414543.dll

  • Size

    485KB

  • MD5

    e4a088773d56d0f6e7d1582f100b5137

  • SHA1

    5cf878a09b2de0b664467b928ad03453e5c1491e

  • SHA256

    45f3f5d22895889574eb220c91242129153c6d85374d08665348c3bbe3414543

  • SHA512

    eea5d926f100f5ae136e2ea5c71530ff087349ed89aa069b1cc4490ca8bb0432e1013e953de6c56befd660acd673d388aeef3e9db0ced7cbd4dd71ed432f0f6d

Malware Config

Extracted

Family

zloader

Botnet

r1

Campaign

r1

C2

http://bsraotpeiimmrnchcqvr.com/LKhwojehDgwegSDG/gateJKjdsh.php

http://exqnbgauiphxqdeecitw.com/LKhwojehDgwegSDG/gateJKjdsh.php

http://fpbkvirfkfvufpbkvgty.com/LKhwojehDgwegSDG/gateJKjdsh.php

http://hikowojacckxccgglhvy.com/LKhwojehDgwegSDG/gateJKjdsh.php

http://kdrowkrjhrdmbxkthljt.com/LKhwojehDgwegSDG/gateJKjdsh.php

http://nvlmtlisfmcfgimicstx.com/LKhwojehDgwegSDG/gateJKjdsh.php

http://syohvyctqfcgakxepsou.com/LKhwojehDgwegSDG/gateJKjdsh.php

http://wdwrhikolxfwyyhwwfut.com/LKhwojehDgwegSDG/gateJKjdsh.php

Attributes
  • build_id

    17

rc4.plain
rsa_pubkey.plain

Signatures

  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\45f3f5d22895889574eb220c91242129153c6d85374d08665348c3bbe3414543.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4744
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\45f3f5d22895889574eb220c91242129153c6d85374d08665348c3bbe3414543.dll
      2⤵
        PID:788

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/788-133-0x0000000000000000-mapping.dmp
    • memory/788-135-0x0000000074990000-0x0000000074A1B000-memory.dmp
      Filesize

      556KB

    • memory/788-134-0x0000000074990000-0x00000000749BD000-memory.dmp
      Filesize

      180KB

    • memory/788-136-0x0000000074990000-0x0000000074A1B000-memory.dmp
      Filesize

      556KB