04dc453eef135fdf917b2cfd671246cc9d4273f7c9c770fad407ef714bed02dc

General

Target

zloader_1.15.0.0.vir.exe
Size

224KB
MD5

126dc987935804de8ceb101ae29c4922
SHA1

3a43fcba90ce677ddcf5d134e810d1954671b29d
SHA256

04dc453eef135fdf917b2cfd671246cc9d4273f7c9c770fad407ef714bed02dc
SHA512

4ee2e69aed98892717d36240255fc4dfb6cd6326f82fda9124b59251ab963d7384cdc48ffce8a51ac81e578f34e7d49133b243aac4fa35ee7e50ad447b4a3af3

Score

8^/10

upx

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

zloader_1.15.0.0.vir.exe

pid process

3832 zloader_1.15.0.0.vir.exe
3832 zloader_1.15.0.0.vir.exe

Suspicious use of WriteProcessMemory 276 IoCs

Processes:

zloader_1.15.0.0.vir.exe

description	pid	process	target process
PID 3832 wrote to memory of 3984	3832	zloader_1.15.0.0.vir.exe	cmd.exe
PID 3832 wrote to memory of 3984	3832	zloader_1.15.0.0.vir.exe	cmd.exe
PID 3832 wrote to memory of 3984	3832	zloader_1.15.0.0.vir.exe	cmd.exe
PID 3832 wrote to memory of 3892	3832	zloader_1.15.0.0.vir.exe	iexplore.exe
PID 3832 wrote to memory of 3892	3832	zloader_1.15.0.0.vir.exe	iexplore.exe
PID 3832 wrote to memory of 3892	3832	zloader_1.15.0.0.vir.exe	iexplore.exe
PID 3832 wrote to memory of 3896	3832	zloader_1.15.0.0.vir.exe	iexplore.exe
PID 3832 wrote to memory of 3896	3832	zloader_1.15.0.0.vir.exe	iexplore.exe
PID 3832 wrote to memory of 3896	3832	zloader_1.15.0.0.vir.exe	iexplore.exe
PID 3832 wrote to memory of 3904	3832	zloader_1.15.0.0.vir.exe	iexplore.exe
PID 3832 wrote to memory of 3904	3832	zloader_1.15.0.0.vir.exe	iexplore.exe
PID 3832 wrote to memory of 3904	3832	zloader_1.15.0.0.vir.exe	iexplore.exe
PID 3832 wrote to memory of 3904	3832	zloader_1.15.0.0.vir.exe	iexplore.exe
PID 3832 wrote to memory of 3904	3832	zloader_1.15.0.0.vir.exe	iexplore.exe
PID 3832 wrote to memory of 3904	3832	zloader_1.15.0.0.vir.exe	iexplore.exe
PID 3832 wrote to memory of 3904	3832	zloader_1.15.0.0.vir.exe	iexplore.exe
PID 3832 wrote to memory of 3904	3832	zloader_1.15.0.0.vir.exe	iexplore.exe
PID 3832 wrote to memory of 3904	3832	zloader_1.15.0.0.vir.exe	iexplore.exe
PID 3832 wrote to memory of 3904	3832	zloader_1.15.0.0.vir.exe	iexplore.exe
PID 3832 wrote to memory of 3904	3832	zloader_1.15.0.0.vir.exe	iexplore.exe
PID 3832 wrote to memory of 3904	3832	zloader_1.15.0.0.vir.exe	iexplore.exe
PID 3832 wrote to memory of 3904	3832	zloader_1.15.0.0.vir.exe	iexplore.exe
PID 3832 wrote to memory of 3864	3832	zloader_1.15.0.0.vir.exe	zloader_1.15.0.0.vir.exe
PID 3832 wrote to memory of 3864	3832	zloader_1.15.0.0.vir.exe	zloader_1.15.0.0.vir.exe
PID 3832 wrote to memory of 3864	3832	zloader_1.15.0.0.vir.exe	zloader_1.15.0.0.vir.exe
PID 3832 wrote to memory of 3872	3832	zloader_1.15.0.0.vir.exe	zloader_1.15.0.0.vir.exe
PID 3832 wrote to memory of 3872	3832	zloader_1.15.0.0.vir.exe	zloader_1.15.0.0.vir.exe
PID 3832 wrote to memory of 3872	3832	zloader_1.15.0.0.vir.exe	zloader_1.15.0.0.vir.exe
PID 3832 wrote to memory of 3860	3832	zloader_1.15.0.0.vir.exe	zloader_1.15.0.0.vir.exe
PID 3832 wrote to memory of 3860	3832	zloader_1.15.0.0.vir.exe	zloader_1.15.0.0.vir.exe
PID 3832 wrote to memory of 3860	3832	zloader_1.15.0.0.vir.exe	zloader_1.15.0.0.vir.exe
PID 3832 wrote to memory of 3952	3832	zloader_1.15.0.0.vir.exe	zloader_1.15.0.0.vir.exe
PID 3832 wrote to memory of 3952	3832	zloader_1.15.0.0.vir.exe	zloader_1.15.0.0.vir.exe
PID 3832 wrote to memory of 3952	3832	zloader_1.15.0.0.vir.exe	zloader_1.15.0.0.vir.exe
PID 3832 wrote to memory of 3960	3832	zloader_1.15.0.0.vir.exe	zloader_1.15.0.0.vir.exe
PID 3832 wrote to memory of 3960	3832	zloader_1.15.0.0.vir.exe	zloader_1.15.0.0.vir.exe
PID 3832 wrote to memory of 3960	3832	zloader_1.15.0.0.vir.exe	zloader_1.15.0.0.vir.exe
PID 3832 wrote to memory of 3908	3832	zloader_1.15.0.0.vir.exe	zloader_1.15.0.0.vir.exe
PID 3832 wrote to memory of 3908	3832	zloader_1.15.0.0.vir.exe	zloader_1.15.0.0.vir.exe
PID 3832 wrote to memory of 3908	3832	zloader_1.15.0.0.vir.exe	zloader_1.15.0.0.vir.exe
PID 3832 wrote to memory of 3840	3832	zloader_1.15.0.0.vir.exe	zloader_1.15.0.0.vir.exe
PID 3832 wrote to memory of 3840	3832	zloader_1.15.0.0.vir.exe	zloader_1.15.0.0.vir.exe
PID 3832 wrote to memory of 3840	3832	zloader_1.15.0.0.vir.exe	zloader_1.15.0.0.vir.exe
PID 3832 wrote to memory of 1736	3832	zloader_1.15.0.0.vir.exe	zloader_1.15.0.0.vir.exe
PID 3832 wrote to memory of 1736	3832	zloader_1.15.0.0.vir.exe	zloader_1.15.0.0.vir.exe
PID 3832 wrote to memory of 1736	3832	zloader_1.15.0.0.vir.exe	zloader_1.15.0.0.vir.exe
PID 3832 wrote to memory of 3356	3832	zloader_1.15.0.0.vir.exe	zloader_1.15.0.0.vir.exe
PID 3832 wrote to memory of 3356	3832	zloader_1.15.0.0.vir.exe	zloader_1.15.0.0.vir.exe
PID 3832 wrote to memory of 3356	3832	zloader_1.15.0.0.vir.exe	zloader_1.15.0.0.vir.exe
PID 3832 wrote to memory of 3988	3832	zloader_1.15.0.0.vir.exe	zloader_1.15.0.0.vir.exe
PID 3832 wrote to memory of 3988	3832	zloader_1.15.0.0.vir.exe	zloader_1.15.0.0.vir.exe
PID 3832 wrote to memory of 3988	3832	zloader_1.15.0.0.vir.exe	zloader_1.15.0.0.vir.exe
PID 3832 wrote to memory of 3224	3832	zloader_1.15.0.0.vir.exe	zloader_1.15.0.0.vir.exe
PID 3832 wrote to memory of 3224	3832	zloader_1.15.0.0.vir.exe	zloader_1.15.0.0.vir.exe
PID 3832 wrote to memory of 3224	3832	zloader_1.15.0.0.vir.exe	zloader_1.15.0.0.vir.exe
PID 3832 wrote to memory of 3500	3832	zloader_1.15.0.0.vir.exe	zloader_1.15.0.0.vir.exe
PID 3832 wrote to memory of 3500	3832	zloader_1.15.0.0.vir.exe	zloader_1.15.0.0.vir.exe
PID 3832 wrote to memory of 3500	3832	zloader_1.15.0.0.vir.exe	zloader_1.15.0.0.vir.exe
PID 3832 wrote to memory of 3992	3832	zloader_1.15.0.0.vir.exe	zloader_1.15.0.0.vir.exe
PID 3832 wrote to memory of 3992	3832	zloader_1.15.0.0.vir.exe	zloader_1.15.0.0.vir.exe
PID 3832 wrote to memory of 3992	3832	zloader_1.15.0.0.vir.exe	zloader_1.15.0.0.vir.exe
PID 3832 wrote to memory of 3856	3832	zloader_1.15.0.0.vir.exe	zloader_1.15.0.0.vir.exe
PID 3832 wrote to memory of 3856	3832	zloader_1.15.0.0.vir.exe	zloader_1.15.0.0.vir.exe
PID 3832 wrote to memory of 3856	3832	zloader_1.15.0.0.vir.exe	zloader_1.15.0.0.vir.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3784 WerFault.exe
Token: SeBackupPrivilege 3784 WerFault.exe
Token: SeDebugPrivilege 3784 WerFault.exe
Drops startup file 1 IoCs

Processes:

cmd.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe

description	pid	process
Token: SeRestorePrivilege	3784	WerFault.exe
Token: SeBackupPrivilege	3784	WerFault.exe
Token: SeDebugPrivilege	3784	WerFault.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

zloader_1.15.0.0.vir.exeWerFault.exe

pid	process
3832	zloader_1.15.0.0.vir.exe
3832	zloader_1.15.0.0.vir.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

zloader_1.15.0.0.vir.exe

description	pid	process	target process
PID 3832 set thread context of 3904	3832	zloader_1.15.0.0.vir.exe	iexplore.exe
PID 3832 set thread context of 4364	3832	zloader_1.15.0.0.vir.exe	zloader_1.15.0.0.vir.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3784 3904 WerFault.exe iexplore.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

zloader_1.15.0.0.vir.exe

pid process

4364 zloader_1.15.0.0.vir.exe
4364 zloader_1.15.0.0.vir.exe

pid	pid_target	process	target process
3784	3904	WerFault.exe	iexplore.exe

pid	process
4364	zloader_1.15.0.0.vir.exe
4364	zloader_1.15.0.0.vir.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3904-1-0x0000000000400000-0x00000000009DC000-memory.dmp	upx
behavioral2/memory/3904-3-0x0000000000400000-0x00000000009DC000-memory.dmp	upx

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
PID:3832

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
2⤵
- Drops startup file
PID:3984

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
2⤵
PID:3892

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
2⤵
PID:3896

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
2⤵
PID:3904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 536
3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Program crash
PID:3784

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:3864

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:3872

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:3860

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:3952

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:3960

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:3908

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:3840

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:1736

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:3356

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:3988

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:3224

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:3500

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:3992

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:3856

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:4024

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:4004

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:1692

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:392

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:408

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:2696

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:748

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:412

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:3524

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:2480

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:384

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:3140

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:2532

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:2660

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:3924

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:3688

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:3608

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:2236

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:3044

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:2076

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:1516

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:3028

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:3732

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:2552

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:2564

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:3800

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:3848

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:3352

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:3956

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:3168

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:3300

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:3228

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:4060

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:2572

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:4108

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:4120

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:4128

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:4136

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:4144

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:4152

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:4160

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:4168

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:4176

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:4184

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:4192

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:4200

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:4208

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:4216

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:4228

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:4236

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:4244

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:4252

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:4260

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:4268

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:4276

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:4284

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:4292

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:4300

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:4308

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:4316

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:4324

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:4332

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:4340

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:4348

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
PID:4356

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
2⤵
- Suspicious behavior: MapViewOfSection
PID:4364

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:4396

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3784-4-0x0000000004870000-0x0000000004871000-memory.dmp

Filesize
4KB

Download
memory/3784-11-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

Filesize
4KB

Download
memory/3904-9-0x000000000040D770-mapping.dmp

Download
memory/3904-3-0x0000000000400000-0x00000000009DC000-memory.dmp

Filesize
5.9MB

Download
memory/3904-2-0x000000000040D770-mapping.dmp

Download
memory/3904-8-0x000000000040D770-mapping.dmp

Download
memory/3904-10-0x000000000040D770-mapping.dmp

Download
memory/3904-1-0x0000000000400000-0x00000000009DC000-memory.dmp

Filesize
5.9MB

Download
memory/3984-0-0x0000000000000000-mapping.dmp

Download
memory/4364-5-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/4364-6-0x0000000000402193-mapping.dmp

Download
memory/4364-7-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/4396-12-0x0000000000000000-mapping.dmp

Download
memory/4396-13-0x0000000000C20000-0x000000000105F000-memory.dmp

Filesize
4.2MB

Download
memory/4396-17-0x0000000000C20000-0x000000000105F000-memory.dmp

Filesize
4.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads