Analysis
-
max time kernel
149s -
max time network
157s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
19-07-2020 19:51
Static task
static1
Behavioral task
behavioral1
Sample
zloader 2_1.0.12.0.vir.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
zloader 2_1.0.12.0.vir.exe
Resource
win10
General
-
Target
zloader 2_1.0.12.0.vir.exe
-
Size
165KB
-
MD5
fa1a19977598c3f020882a4fa32e04b7
-
SHA1
c902504f5377c31324e28801a67be6957e41271a
-
SHA256
97139bbaf34d92df333d9f791d12b11a8a273151edcaecb9ab7ec75bb034552f
-
SHA512
e8601a99fd078ce1084384205ea301806bafe000196fbef9bb39dbf6bc7c64e7d18bb630c11f101ae6a9776bf59ba5c9c20b1db46627d78db6a2f01912e6b06a
Malware Config
Extracted
zloader
vlenie2020
obnova20
https://dasifosafjasfhasf.com/gate.php
https://kasfajfsafhasfhaf.com/gate.php
https://fdsjfjdsfjdsjfdjsfh.com/gate.php
https://fdsjfjdsfjdsdsjajjs.com/gate.php
https://idisaudhasdhasdj.com/gate.php
https://dsjdjsjdsadhasdas.com/gate.php
https://dsdjfhdsufudhjas.com/gate.php
Signatures
-
Blacklisted process makes network request 12 IoCs
Processes:
msiexec.exeflow pid process 9 1808 msiexec.exe 10 1808 msiexec.exe 11 1808 msiexec.exe 12 1808 msiexec.exe 13 1808 msiexec.exe 18 1808 msiexec.exe 20 1808 msiexec.exe 22 1808 msiexec.exe 23 1808 msiexec.exe 24 1808 msiexec.exe 25 1808 msiexec.exe 26 1808 msiexec.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ucheo = "C:\\Users\\Admin\\AppData\\Roaming\\Daedcy\\yfahdo.exe" msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
zloader 2_1.0.12.0.vir.exedescription pid process target process PID 1032 set thread context of 1808 1032 zloader 2_1.0.12.0.vir.exe msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 1808 msiexec.exe Token: SeSecurityPrivilege 1808 msiexec.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
zloader 2_1.0.12.0.vir.exedescription pid process target process PID 1032 wrote to memory of 1808 1032 zloader 2_1.0.12.0.vir.exe msiexec.exe PID 1032 wrote to memory of 1808 1032 zloader 2_1.0.12.0.vir.exe msiexec.exe PID 1032 wrote to memory of 1808 1032 zloader 2_1.0.12.0.vir.exe msiexec.exe PID 1032 wrote to memory of 1808 1032 zloader 2_1.0.12.0.vir.exe msiexec.exe PID 1032 wrote to memory of 1808 1032 zloader 2_1.0.12.0.vir.exe msiexec.exe PID 1032 wrote to memory of 1808 1032 zloader 2_1.0.12.0.vir.exe msiexec.exe PID 1032 wrote to memory of 1808 1032 zloader 2_1.0.12.0.vir.exe msiexec.exe PID 1032 wrote to memory of 1808 1032 zloader 2_1.0.12.0.vir.exe msiexec.exe PID 1032 wrote to memory of 1808 1032 zloader 2_1.0.12.0.vir.exe msiexec.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\zloader 2_1.0.12.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader 2_1.0.12.0.vir.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe2⤵
- Blacklisted process makes network request
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1808-0-0x0000000000120000-0x0000000000148000-memory.dmpFilesize
160KB
-
memory/1808-1-0x00000000000D0000-0x00000000000D1000-memory.dmpFilesize
4KB
-
memory/1808-2-0x0000000000120000-0x0000000000148000-memory.dmpFilesize
160KB
-
memory/1808-3-0x0000000000000000-mapping.dmp