15e9493c4f50b672fe801108d31ac6660d1d5787e0c71964a935a893aab12032 | Triage

Analysis

max time kernel
148s
max time network
153s
platform
windows7_x64
resource
win7
submitted
19-07-2020 19:52

Sharing

Report Analysis Logs

General

Target

zloader_1.18.3.0.vir.exe
Size

197KB
MD5

41176e654dc58bce22ab124c9bba4bd2
SHA1

8e6e1b7fda10c521d277010021f62d6fe656ef46
SHA256

15e9493c4f50b672fe801108d31ac6660d1d5787e0c71964a935a893aab12032
SHA512

c78b0833b271b086a455e4a36051e23b9c45dd7271b0753bcc2d34073113feedf48d7ec8ce21dcc34db70aca899fbbf5975bd3051af3afc4bf22d1832aea09d8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

zloader_1.18.3.0.vir.exe

description	pid	process	target process
PID 1124 wrote to memory of 1072	1124	zloader_1.18.3.0.vir.exe	explorer.exe
PID 1124 wrote to memory of 1072	1124	zloader_1.18.3.0.vir.exe	explorer.exe
PID 1124 wrote to memory of 1072	1124	zloader_1.18.3.0.vir.exe	explorer.exe
PID 1124 wrote to memory of 1072	1124	zloader_1.18.3.0.vir.exe	explorer.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

zloader_1.18.3.0.vir.exe

pid process

1124 zloader_1.18.3.0.vir.exe
1124 zloader_1.18.3.0.vir.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

explorer.exe

pid process

1072 explorer.exe
1072 explorer.exe
1072 explorer.exe
1072 explorer.exe
1072 explorer.exe
1072 explorer.exe

C:\Users\Admin\AppData\Local\Temp\zloader_1.18.3.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.18.3.0.vir.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
PID:1124

C:\Windows\SysWOW64\explorer.exe
explorer.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1072-0-0x0000000000000000-mapping.dmp

Download
memory/1072-1-0x0000000000130000-0x00000000003B1000-memory.dmp

Filesize
2.5MB

Download