Analysis
-
max time kernel
144s -
max time network
133s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
19-07-2020 19:24
Static task
static1
Behavioral task
behavioral1
Sample
zloader_1.15.0.0.vir.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
zloader_1.15.0.0.vir.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
zloader_1.15.0.0.vir.exe
-
Size
224KB
-
MD5
126dc987935804de8ceb101ae29c4922
-
SHA1
3a43fcba90ce677ddcf5d134e810d1954671b29d
-
SHA256
04dc453eef135fdf917b2cfd671246cc9d4273f7c9c770fad407ef714bed02dc
-
SHA512
4ee2e69aed98892717d36240255fc4dfb6cd6326f82fda9124b59251ab963d7384cdc48ffce8a51ac81e578f34e7d49133b243aac4fa35ee7e50ad447b4a3af3
Score
8/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1084 1020 WerFault.exe iexplore.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WerFault.exedescription pid process Token: SeDebugPrivilege 1084 WerFault.exe -
Drops startup file 1 IoCs
Processes:
cmd.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
zloader_1.15.0.0.vir.exepid process 2068 zloader_1.15.0.0.vir.exe 2068 zloader_1.15.0.0.vir.exe -
Processes:
resource yara_rule behavioral1/memory/1020-1-0x0000000000400000-0x00000000009DC000-memory.dmp upx behavioral1/memory/1020-3-0x0000000000400000-0x00000000009DC000-memory.dmp upx -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
zloader_1.15.0.0.vir.exepid process 1512 zloader_1.15.0.0.vir.exe 1512 zloader_1.15.0.0.vir.exe -
Suspicious use of WriteProcessMemory 361 IoCs
Processes:
zloader_1.15.0.0.vir.exeiexplore.exedescription pid process target process PID 1512 wrote to memory of 476 1512 zloader_1.15.0.0.vir.exe cmd.exe PID 1512 wrote to memory of 476 1512 zloader_1.15.0.0.vir.exe cmd.exe PID 1512 wrote to memory of 476 1512 zloader_1.15.0.0.vir.exe cmd.exe PID 1512 wrote to memory of 476 1512 zloader_1.15.0.0.vir.exe cmd.exe PID 1512 wrote to memory of 528 1512 zloader_1.15.0.0.vir.exe iexplore.exe PID 1512 wrote to memory of 528 1512 zloader_1.15.0.0.vir.exe iexplore.exe PID 1512 wrote to memory of 528 1512 zloader_1.15.0.0.vir.exe iexplore.exe PID 1512 wrote to memory of 528 1512 zloader_1.15.0.0.vir.exe iexplore.exe PID 1512 wrote to memory of 784 1512 zloader_1.15.0.0.vir.exe iexplore.exe PID 1512 wrote to memory of 784 1512 zloader_1.15.0.0.vir.exe iexplore.exe PID 1512 wrote to memory of 784 1512 zloader_1.15.0.0.vir.exe iexplore.exe PID 1512 wrote to memory of 784 1512 zloader_1.15.0.0.vir.exe iexplore.exe PID 1512 wrote to memory of 1020 1512 zloader_1.15.0.0.vir.exe iexplore.exe PID 1512 wrote to memory of 1020 1512 zloader_1.15.0.0.vir.exe iexplore.exe PID 1512 wrote to memory of 1020 1512 zloader_1.15.0.0.vir.exe iexplore.exe PID 1512 wrote to memory of 1020 1512 zloader_1.15.0.0.vir.exe iexplore.exe PID 1512 wrote to memory of 1020 1512 zloader_1.15.0.0.vir.exe iexplore.exe PID 1512 wrote to memory of 1020 1512 zloader_1.15.0.0.vir.exe iexplore.exe PID 1512 wrote to memory of 1020 1512 zloader_1.15.0.0.vir.exe iexplore.exe PID 1512 wrote to memory of 1020 1512 zloader_1.15.0.0.vir.exe iexplore.exe PID 1512 wrote to memory of 1020 1512 zloader_1.15.0.0.vir.exe iexplore.exe PID 1512 wrote to memory of 1020 1512 zloader_1.15.0.0.vir.exe iexplore.exe PID 1512 wrote to memory of 1020 1512 zloader_1.15.0.0.vir.exe iexplore.exe PID 1512 wrote to memory of 1100 1512 zloader_1.15.0.0.vir.exe zloader_1.15.0.0.vir.exe PID 1512 wrote to memory of 1100 1512 zloader_1.15.0.0.vir.exe zloader_1.15.0.0.vir.exe PID 1512 wrote to memory of 1100 1512 zloader_1.15.0.0.vir.exe zloader_1.15.0.0.vir.exe PID 1512 wrote to memory of 1100 1512 zloader_1.15.0.0.vir.exe zloader_1.15.0.0.vir.exe PID 1512 wrote to memory of 1644 1512 zloader_1.15.0.0.vir.exe zloader_1.15.0.0.vir.exe PID 1512 wrote to memory of 1644 1512 zloader_1.15.0.0.vir.exe zloader_1.15.0.0.vir.exe PID 1512 wrote to memory of 1644 1512 zloader_1.15.0.0.vir.exe zloader_1.15.0.0.vir.exe PID 1512 wrote to memory of 1644 1512 zloader_1.15.0.0.vir.exe zloader_1.15.0.0.vir.exe PID 1512 wrote to memory of 1068 1512 zloader_1.15.0.0.vir.exe zloader_1.15.0.0.vir.exe PID 1512 wrote to memory of 1068 1512 zloader_1.15.0.0.vir.exe zloader_1.15.0.0.vir.exe PID 1512 wrote to memory of 1068 1512 zloader_1.15.0.0.vir.exe zloader_1.15.0.0.vir.exe PID 1512 wrote to memory of 1068 1512 zloader_1.15.0.0.vir.exe zloader_1.15.0.0.vir.exe PID 1020 wrote to memory of 1084 1020 iexplore.exe WerFault.exe PID 1020 wrote to memory of 1084 1020 iexplore.exe WerFault.exe PID 1020 wrote to memory of 1084 1020 iexplore.exe WerFault.exe PID 1020 wrote to memory of 1084 1020 iexplore.exe WerFault.exe PID 1512 wrote to memory of 1568 1512 zloader_1.15.0.0.vir.exe zloader_1.15.0.0.vir.exe PID 1512 wrote to memory of 1568 1512 zloader_1.15.0.0.vir.exe zloader_1.15.0.0.vir.exe PID 1512 wrote to memory of 1568 1512 zloader_1.15.0.0.vir.exe zloader_1.15.0.0.vir.exe PID 1512 wrote to memory of 1568 1512 zloader_1.15.0.0.vir.exe zloader_1.15.0.0.vir.exe PID 1512 wrote to memory of 1536 1512 zloader_1.15.0.0.vir.exe zloader_1.15.0.0.vir.exe PID 1512 wrote to memory of 1536 1512 zloader_1.15.0.0.vir.exe zloader_1.15.0.0.vir.exe PID 1512 wrote to memory of 1536 1512 zloader_1.15.0.0.vir.exe zloader_1.15.0.0.vir.exe PID 1512 wrote to memory of 1536 1512 zloader_1.15.0.0.vir.exe zloader_1.15.0.0.vir.exe PID 1512 wrote to memory of 1672 1512 zloader_1.15.0.0.vir.exe zloader_1.15.0.0.vir.exe PID 1512 wrote to memory of 1672 1512 zloader_1.15.0.0.vir.exe zloader_1.15.0.0.vir.exe PID 1512 wrote to memory of 1672 1512 zloader_1.15.0.0.vir.exe zloader_1.15.0.0.vir.exe PID 1512 wrote to memory of 1672 1512 zloader_1.15.0.0.vir.exe zloader_1.15.0.0.vir.exe PID 1512 wrote to memory of 1696 1512 zloader_1.15.0.0.vir.exe zloader_1.15.0.0.vir.exe PID 1512 wrote to memory of 1696 1512 zloader_1.15.0.0.vir.exe zloader_1.15.0.0.vir.exe PID 1512 wrote to memory of 1696 1512 zloader_1.15.0.0.vir.exe zloader_1.15.0.0.vir.exe PID 1512 wrote to memory of 1696 1512 zloader_1.15.0.0.vir.exe zloader_1.15.0.0.vir.exe PID 1512 wrote to memory of 1352 1512 zloader_1.15.0.0.vir.exe zloader_1.15.0.0.vir.exe PID 1512 wrote to memory of 1352 1512 zloader_1.15.0.0.vir.exe zloader_1.15.0.0.vir.exe PID 1512 wrote to memory of 1352 1512 zloader_1.15.0.0.vir.exe zloader_1.15.0.0.vir.exe PID 1512 wrote to memory of 1352 1512 zloader_1.15.0.0.vir.exe zloader_1.15.0.0.vir.exe PID 1512 wrote to memory of 1360 1512 zloader_1.15.0.0.vir.exe zloader_1.15.0.0.vir.exe PID 1512 wrote to memory of 1360 1512 zloader_1.15.0.0.vir.exe zloader_1.15.0.0.vir.exe PID 1512 wrote to memory of 1360 1512 zloader_1.15.0.0.vir.exe zloader_1.15.0.0.vir.exe PID 1512 wrote to memory of 1360 1512 zloader_1.15.0.0.vir.exe zloader_1.15.0.0.vir.exe PID 1512 wrote to memory of 1216 1512 zloader_1.15.0.0.vir.exe zloader_1.15.0.0.vir.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
zloader_1.15.0.0.vir.exeWerFault.exepid process 1512 zloader_1.15.0.0.vir.exe 1084 WerFault.exe 1084 WerFault.exe 1084 WerFault.exe 1084 WerFault.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
zloader_1.15.0.0.vir.exedescription pid process target process PID 1512 set thread context of 1020 1512 zloader_1.15.0.0.vir.exe iexplore.exe PID 1512 set thread context of 2068 1512 zloader_1.15.0.0.vir.exe zloader_1.15.0.0.vir.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"2⤵
- Drops startup file
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 1763⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"2⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/476-0-0x0000000000000000-mapping.dmp
-
memory/1020-1-0x0000000000400000-0x00000000009DC000-memory.dmpFilesize
5.9MB
-
memory/1020-2-0x000000000040D770-mapping.dmp
-
memory/1020-3-0x0000000000400000-0x00000000009DC000-memory.dmpFilesize
5.9MB
-
memory/1020-9-0x000000000040D770-mapping.dmp
-
memory/1084-7-0x0000000001DC0000-0x0000000001DD1000-memory.dmpFilesize
68KB
-
memory/1084-6-0x0000000001DC0000-0x0000000001DD1000-memory.dmpFilesize
68KB
-
memory/1084-5-0x0000000000000000-mapping.dmp
-
memory/1084-10-0x0000000002480000-0x0000000002491000-memory.dmpFilesize
68KB
-
memory/2068-12-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/2068-13-0x0000000000402193-mapping.dmp
-
memory/2068-14-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/2088-15-0x0000000000000000-mapping.dmp
-
memory/2088-16-0x0000000000CC0000-0x0000000000F41000-memory.dmpFilesize
2.5MB