eafbd21a0f9f082fa2e94e010569d7fa8512d978087c2633d652b865b922465a

Analysis

max time kernel
150s
max time network
145s
platform
windows10_x64
resource
win10v200430
submitted
19/07/2020, 19:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zloader 2_1.0.8.0.vir.exe
Size 243KB
Sample200719-67twab9dcn
SHA256 eafbd21a0f9f082fa2e94e010569d7fa8512d978087c2633d652b865b922465a
MD5 8e73a8a4a35ebfcc3e900ec4255cb296
SHA1 21e475e46bc909b91942f564803cd7f90046bb8d
SHA512 facc951d177237088cf316772cb600e0e9f88b4eda2eba43768db55b2e6642e59b059505104010ab4ec3527c6294e7332b36dc50c909bed706d3ce557314efb3
MD5 SHA1 SHA512

Score

8^/10

persistence

Malware Config

Signatures

Blacklisted process makes network request 5 IoCs

flow	pid	Process
26	2112	msiexec.exe
27	2112	msiexec.exe
28	2112	msiexec.exe
30	2112	msiexec.exe
31	2112	msiexec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ebdaugba = "C:\\Users\\Admin\\AppData\\Roaming\\Ifohef\\ydgoyc.exe"	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3944 set thread context of 2112	3944	zloader 2_1.0.8.0.vir.exe	72

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2112	msiexec.exe
Token: SeSecurityPrivilege	2112	msiexec.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3944 wrote to memory of 2112	3944	zloader 2_1.0.8.0.vir.exe	72
PID 3944 wrote to memory of 2112	3944	zloader 2_1.0.8.0.vir.exe	72
PID 3944 wrote to memory of 2112	3944	zloader 2_1.0.8.0.vir.exe	72
PID 3944 wrote to memory of 2112	3944	zloader 2_1.0.8.0.vir.exe	72
PID 3944 wrote to memory of 2112	3944	zloader 2_1.0.8.0.vir.exe	72

C:\Users\Admin\AppData\Local\Temp\zloader 2_1.0.8.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader 2_1.0.8.0.vir.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe
  2⤵
  - Blacklisted process makes network request
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:2112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2112-0-0x0000000003200000-0x000000000322A000-memory.dmp

Download