zloader | d73871ac75496c6892613fbcda7bb4ad9f3bc868a134933b640699f8d8da53ca

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 07:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpq4_vr4e8.exe
Size 292KB
Sample260602-h5htxahs3j
SHA256 d73871ac75496c6892613fbcda7bb4ad9f3bc868a134933b640699f8d8da53ca
MD5 75d2fed737e66dd5f524043bd0e99b55
SHA1 3930debcaa8745b5a66f55bae9190423b5313fbd
SHA512 f72ba481ddb4a2469abbe7e313a6b5d6ab28fbe5bd1c150b9b3c2137d0a4fb69154dcb854e0a834628cbefd29d75a18e491a7ee4df145567232bc8ea7fec18c3
SSDEEP 6144:p6dkR9l41itC9s6/P5unktruA8ehzIFbf/Vx:a0PCs6sUrEmOF
TLSH
T19554BF1173E1C572C09644315861E2B0533ABC62A974894F7BD8EF6B3E322D1EBB635E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

botnet discovery zloader trojan

Malware Config

Signatures

Family: Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5040	2264	WerFault.exe	79

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpq4_vr4e8.exe

C:\Users\Admin\AppData\Local\Temp\tmpq4_vr4e8.exe
"C:\Users\Admin\AppData\Local\Temp\tmpq4_vr4e8.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2264
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 296
  2⤵
  - Program crash
  PID:5040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2264 -ip 2264
1⤵
PID:5236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2264-2-0x0000000004010000-0x0000000004035000-memory.dmp

Download

memory/2264-1-0x00000000024B0000-0x00000000025B0000-memory.dmp