Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows7_x64 -
resource
win7 -
submitted
19-07-2020 19:26
Static task
static1
Behavioral task
behavioral1
Sample
zloader_1.7.1.0.vir.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
zloader_1.7.1.0.vir.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
zloader_1.7.1.0.vir.exe
-
Size
2.9MB
-
MD5
03915a1f03df164f48ac4dfd04d9c2c4
-
SHA1
b3668d82afdbf2995c4195973525b0b00b8e21b1
-
SHA256
7c73619ff8d5e4ed3b29b7ae71a69602df4071fd8c1029f9674e9978cdc03de9
-
SHA512
5337c6dbc5986470bd4d48919537f4142ea47c08f77f148c223b609e361e8c83c98a55a399fa0e376972d1d379c0dd0bc0185af9e6a4820f9add7b9513576c5f
Score
7/10
Malware Config
Signatures
-
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
zloader_1.7.1.0.vir.exepid process 1376 zloader_1.7.1.0.vir.exe 1376 zloader_1.7.1.0.vir.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Explorer.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\vaatured = "C:\\Users\\Admin\\AppData\\Roaming\\Arivdi\\okixo.exe" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\Currentversion\Run Explorer.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
Explorer.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
zloader_1.7.1.0.vir.exeexplorer.exeExplorer.EXEdescription pid process target process PID 1376 wrote to memory of 1040 1376 zloader_1.7.1.0.vir.exe explorer.exe PID 1376 wrote to memory of 1040 1376 zloader_1.7.1.0.vir.exe explorer.exe PID 1376 wrote to memory of 1040 1376 zloader_1.7.1.0.vir.exe explorer.exe PID 1376 wrote to memory of 1040 1376 zloader_1.7.1.0.vir.exe explorer.exe PID 1040 wrote to memory of 1208 1040 explorer.exe Explorer.EXE PID 1040 wrote to memory of 1208 1040 explorer.exe Explorer.EXE PID 1040 wrote to memory of 1208 1040 explorer.exe Explorer.EXE PID 1208 wrote to memory of 1084 1208 Explorer.EXE taskhost.exe PID 1208 wrote to memory of 1084 1208 Explorer.EXE taskhost.exe PID 1208 wrote to memory of 1140 1208 Explorer.EXE Dwm.exe PID 1208 wrote to memory of 1140 1208 Explorer.EXE Dwm.exe PID 1208 wrote to memory of 1768 1208 Explorer.EXE msiexec.exe PID 1208 wrote to memory of 1768 1208 Explorer.EXE msiexec.exe PID 1208 wrote to memory of 1768 1208 Explorer.EXE msiexec.exe PID 1208 wrote to memory of 1768 1208 Explorer.EXE msiexec.exe PID 1208 wrote to memory of 1768 1208 Explorer.EXE msiexec.exe PID 1208 wrote to memory of 1768 1208 Explorer.EXE msiexec.exe PID 1208 wrote to memory of 1768 1208 Explorer.EXE msiexec.exe -
Suspicious behavior: EnumeratesProcesses 1410 IoCs
Processes:
explorer.exeExplorer.EXEpid process 1040 explorer.exe 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Explorer.EXEdescription pid process Token: SeSecurityPrivilege 1208 Explorer.EXE Token: SeSecurityPrivilege 1208 Explorer.EXE Token: SeShutdownPrivilege 1208 Explorer.EXE -
Deletes itself 1 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE -
NTFS ADS 1 IoCs
Processes:
Explorer.EXEdescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Arivdi\okixo.exe:Zone.Identifier Explorer.EXE
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Deletes itself
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- NTFS ADS
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.7.1.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.7.1.0.vir.exe"2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"3⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1040-1-0x0000000000000000-mapping.dmp
-
memory/1040-2-0x0000000000870000-0x0000000000AF1000-memory.dmpFilesize
2.5MB
-
memory/1084-3-0x0000000001BC0000-0x0000000001BC1000-memory.dmpFilesize
4KB
-
memory/1376-0-0x0000000000401000-0x0000000000402000-memory.dmpFilesize
4KB
-
memory/1768-6-0x0000000000000000-mapping.dmp