Analysis
-
max time kernel
147s -
max time network
146s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
19-07-2020 17:14
Static task
static1
Behavioral task
behavioral1
Sample
zloader_1.15.10.0.vir.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
zloader_1.15.10.0.vir.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
zloader_1.15.10.0.vir.exe
-
Size
167KB
-
MD5
53acfcac60b225bf99796213b2fe5e39
-
SHA1
7b1a535c84e9fb9e6d3f8864d0bfe6d0bab17384
-
SHA256
d17e19456065af5ffa92cfe5b41e6dbb9b6d070b68ca33ce6473ed4c13599e0e
-
SHA512
2e075b0aa141904690fe82fee45af8d882e09d99aa0b7a478ec4a07e7e257729f77a9172f10313f3a33254e3c7b666b4d6c2926e219999426aed05d3a1858406
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
zloader_1.15.10.0.vir.exedescription pid process target process PID 3768 wrote to memory of 4064 3768 zloader_1.15.10.0.vir.exe explorer.exe PID 3768 wrote to memory of 4064 3768 zloader_1.15.10.0.vir.exe explorer.exe PID 3768 wrote to memory of 4064 3768 zloader_1.15.10.0.vir.exe explorer.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
zloader_1.15.10.0.vir.exepid process 3768 zloader_1.15.10.0.vir.exe 3768 zloader_1.15.10.0.vir.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
explorer.exepid process 4064 explorer.exe 4064 explorer.exe 4064 explorer.exe 4064 explorer.exe 4064 explorer.exe 4064 explorer.exe 4064 explorer.exe 4064 explorer.exe 4064 explorer.exe 4064 explorer.exe 4064 explorer.exe 4064 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.10.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.10.0.vir.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵
- Suspicious behavior: EnumeratesProcesses