04dc453eef135fdf917b2cfd671246cc9d4273f7c9c770fad407ef714bed02dc

Analysis

max time kernel
145s
max time network
150s
platform
windows10_x64
resource
win10
submitted
19/07/2020, 19:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zloader_1.15.0.0.vir.exe
Size 224KB
Sample200719-cqxt1x3fqx
SHA256 04dc453eef135fdf917b2cfd671246cc9d4273f7c9c770fad407ef714bed02dc
MD5 126dc987935804de8ceb101ae29c4922
SHA1 3a43fcba90ce677ddcf5d134e810d1954671b29d
SHA512 4ee2e69aed98892717d36240255fc4dfb6cd6326f82fda9124b59251ab963d7384cdc48ffce8a51ac81e578f34e7d49133b243aac4fa35ee7e50ad447b4a3af3
MD5 SHA1 SHA512

Score

8^/10

upx

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3832	zloader_1.15.0.0.vir.exe
3832	zloader_1.15.0.0.vir.exe

Suspicious use of WriteProcessMemory 276 IoCs

description	pid	Process	procid_target
PID 3832 wrote to memory of 3984	3832	zloader_1.15.0.0.vir.exe	67
PID 3832 wrote to memory of 3984	3832	zloader_1.15.0.0.vir.exe	67
PID 3832 wrote to memory of 3984	3832	zloader_1.15.0.0.vir.exe	67
PID 3832 wrote to memory of 3892	3832	zloader_1.15.0.0.vir.exe	69
PID 3832 wrote to memory of 3892	3832	zloader_1.15.0.0.vir.exe	69
PID 3832 wrote to memory of 3892	3832	zloader_1.15.0.0.vir.exe	69
PID 3832 wrote to memory of 3896	3832	zloader_1.15.0.0.vir.exe	70
PID 3832 wrote to memory of 3896	3832	zloader_1.15.0.0.vir.exe	70
PID 3832 wrote to memory of 3896	3832	zloader_1.15.0.0.vir.exe	70
PID 3832 wrote to memory of 3904	3832	zloader_1.15.0.0.vir.exe	71
PID 3832 wrote to memory of 3904	3832	zloader_1.15.0.0.vir.exe	71
PID 3832 wrote to memory of 3904	3832	zloader_1.15.0.0.vir.exe	71
PID 3832 wrote to memory of 3904	3832	zloader_1.15.0.0.vir.exe	71
PID 3832 wrote to memory of 3904	3832	zloader_1.15.0.0.vir.exe	71
PID 3832 wrote to memory of 3904	3832	zloader_1.15.0.0.vir.exe	71
PID 3832 wrote to memory of 3904	3832	zloader_1.15.0.0.vir.exe	71
PID 3832 wrote to memory of 3904	3832	zloader_1.15.0.0.vir.exe	71
PID 3832 wrote to memory of 3904	3832	zloader_1.15.0.0.vir.exe	71
PID 3832 wrote to memory of 3904	3832	zloader_1.15.0.0.vir.exe	71
PID 3832 wrote to memory of 3904	3832	zloader_1.15.0.0.vir.exe	71
PID 3832 wrote to memory of 3904	3832	zloader_1.15.0.0.vir.exe	71
PID 3832 wrote to memory of 3904	3832	zloader_1.15.0.0.vir.exe	71
PID 3832 wrote to memory of 3864	3832	zloader_1.15.0.0.vir.exe	72
PID 3832 wrote to memory of 3864	3832	zloader_1.15.0.0.vir.exe	72
PID 3832 wrote to memory of 3864	3832	zloader_1.15.0.0.vir.exe	72
PID 3832 wrote to memory of 3872	3832	zloader_1.15.0.0.vir.exe	73
PID 3832 wrote to memory of 3872	3832	zloader_1.15.0.0.vir.exe	73
PID 3832 wrote to memory of 3872	3832	zloader_1.15.0.0.vir.exe	73
PID 3832 wrote to memory of 3860	3832	zloader_1.15.0.0.vir.exe	74
PID 3832 wrote to memory of 3860	3832	zloader_1.15.0.0.vir.exe	74
PID 3832 wrote to memory of 3860	3832	zloader_1.15.0.0.vir.exe	74
PID 3832 wrote to memory of 3952	3832	zloader_1.15.0.0.vir.exe	75
PID 3832 wrote to memory of 3952	3832	zloader_1.15.0.0.vir.exe	75
PID 3832 wrote to memory of 3952	3832	zloader_1.15.0.0.vir.exe	75
PID 3832 wrote to memory of 3960	3832	zloader_1.15.0.0.vir.exe	76
PID 3832 wrote to memory of 3960	3832	zloader_1.15.0.0.vir.exe	76
PID 3832 wrote to memory of 3960	3832	zloader_1.15.0.0.vir.exe	76
PID 3832 wrote to memory of 3908	3832	zloader_1.15.0.0.vir.exe	77
PID 3832 wrote to memory of 3908	3832	zloader_1.15.0.0.vir.exe	77
PID 3832 wrote to memory of 3908	3832	zloader_1.15.0.0.vir.exe	77
PID 3832 wrote to memory of 3840	3832	zloader_1.15.0.0.vir.exe	78
PID 3832 wrote to memory of 3840	3832	zloader_1.15.0.0.vir.exe	78
PID 3832 wrote to memory of 3840	3832	zloader_1.15.0.0.vir.exe	78
PID 3832 wrote to memory of 1736	3832	zloader_1.15.0.0.vir.exe	79
PID 3832 wrote to memory of 1736	3832	zloader_1.15.0.0.vir.exe	79
PID 3832 wrote to memory of 1736	3832	zloader_1.15.0.0.vir.exe	79
PID 3832 wrote to memory of 3356	3832	zloader_1.15.0.0.vir.exe	80
PID 3832 wrote to memory of 3356	3832	zloader_1.15.0.0.vir.exe	80
PID 3832 wrote to memory of 3356	3832	zloader_1.15.0.0.vir.exe	80
PID 3832 wrote to memory of 3988	3832	zloader_1.15.0.0.vir.exe	81
PID 3832 wrote to memory of 3988	3832	zloader_1.15.0.0.vir.exe	81
PID 3832 wrote to memory of 3988	3832	zloader_1.15.0.0.vir.exe	81
PID 3832 wrote to memory of 3224	3832	zloader_1.15.0.0.vir.exe	82
PID 3832 wrote to memory of 3224	3832	zloader_1.15.0.0.vir.exe	82
PID 3832 wrote to memory of 3224	3832	zloader_1.15.0.0.vir.exe	82
PID 3832 wrote to memory of 3500	3832	zloader_1.15.0.0.vir.exe	83
PID 3832 wrote to memory of 3500	3832	zloader_1.15.0.0.vir.exe	83
PID 3832 wrote to memory of 3500	3832	zloader_1.15.0.0.vir.exe	83
PID 3832 wrote to memory of 3992	3832	zloader_1.15.0.0.vir.exe	84
PID 3832 wrote to memory of 3992	3832	zloader_1.15.0.0.vir.exe	84
PID 3832 wrote to memory of 3992	3832	zloader_1.15.0.0.vir.exe	84
PID 3832 wrote to memory of 3856	3832	zloader_1.15.0.0.vir.exe	85
PID 3832 wrote to memory of 3856	3832	zloader_1.15.0.0.vir.exe	85
PID 3832 wrote to memory of 3856	3832	zloader_1.15.0.0.vir.exe	85
PID 3832 wrote to memory of 4024	3832	zloader_1.15.0.0.vir.exe	86
PID 3832 wrote to memory of 4024	3832	zloader_1.15.0.0.vir.exe	86
PID 3832 wrote to memory of 4024	3832	zloader_1.15.0.0.vir.exe	86
PID 3832 wrote to memory of 4004	3832	zloader_1.15.0.0.vir.exe	87
PID 3832 wrote to memory of 4004	3832	zloader_1.15.0.0.vir.exe	87
PID 3832 wrote to memory of 4004	3832	zloader_1.15.0.0.vir.exe	87
PID 3832 wrote to memory of 1692	3832	zloader_1.15.0.0.vir.exe	88
PID 3832 wrote to memory of 1692	3832	zloader_1.15.0.0.vir.exe	88
PID 3832 wrote to memory of 1692	3832	zloader_1.15.0.0.vir.exe	88
PID 3832 wrote to memory of 392	3832	zloader_1.15.0.0.vir.exe	89
PID 3832 wrote to memory of 392	3832	zloader_1.15.0.0.vir.exe	89
PID 3832 wrote to memory of 392	3832	zloader_1.15.0.0.vir.exe	89
PID 3832 wrote to memory of 408	3832	zloader_1.15.0.0.vir.exe	90
PID 3832 wrote to memory of 408	3832	zloader_1.15.0.0.vir.exe	90
PID 3832 wrote to memory of 408	3832	zloader_1.15.0.0.vir.exe	90
PID 3832 wrote to memory of 2696	3832	zloader_1.15.0.0.vir.exe	91
PID 3832 wrote to memory of 2696	3832	zloader_1.15.0.0.vir.exe	91
PID 3832 wrote to memory of 2696	3832	zloader_1.15.0.0.vir.exe	91
PID 3832 wrote to memory of 748	3832	zloader_1.15.0.0.vir.exe	92
PID 3832 wrote to memory of 748	3832	zloader_1.15.0.0.vir.exe	92
PID 3832 wrote to memory of 748	3832	zloader_1.15.0.0.vir.exe	92
PID 3832 wrote to memory of 412	3832	zloader_1.15.0.0.vir.exe	93
PID 3832 wrote to memory of 412	3832	zloader_1.15.0.0.vir.exe	93
PID 3832 wrote to memory of 412	3832	zloader_1.15.0.0.vir.exe	93
PID 3832 wrote to memory of 3524	3832	zloader_1.15.0.0.vir.exe	94
PID 3832 wrote to memory of 3524	3832	zloader_1.15.0.0.vir.exe	94
PID 3832 wrote to memory of 3524	3832	zloader_1.15.0.0.vir.exe	94
PID 3832 wrote to memory of 2480	3832	zloader_1.15.0.0.vir.exe	96
PID 3832 wrote to memory of 2480	3832	zloader_1.15.0.0.vir.exe	96
PID 3832 wrote to memory of 2480	3832	zloader_1.15.0.0.vir.exe	96
PID 3832 wrote to memory of 384	3832	zloader_1.15.0.0.vir.exe	97
PID 3832 wrote to memory of 384	3832	zloader_1.15.0.0.vir.exe	97
PID 3832 wrote to memory of 384	3832	zloader_1.15.0.0.vir.exe	97
PID 3832 wrote to memory of 3140	3832	zloader_1.15.0.0.vir.exe	98
PID 3832 wrote to memory of 3140	3832	zloader_1.15.0.0.vir.exe	98
PID 3832 wrote to memory of 3140	3832	zloader_1.15.0.0.vir.exe	98
PID 3832 wrote to memory of 2532	3832	zloader_1.15.0.0.vir.exe	99
PID 3832 wrote to memory of 2532	3832	zloader_1.15.0.0.vir.exe	99
PID 3832 wrote to memory of 2532	3832	zloader_1.15.0.0.vir.exe	99
PID 3832 wrote to memory of 2660	3832	zloader_1.15.0.0.vir.exe	100
PID 3832 wrote to memory of 2660	3832	zloader_1.15.0.0.vir.exe	100
PID 3832 wrote to memory of 2660	3832	zloader_1.15.0.0.vir.exe	100
PID 3832 wrote to memory of 3924	3832	zloader_1.15.0.0.vir.exe	101
PID 3832 wrote to memory of 3924	3832	zloader_1.15.0.0.vir.exe	101
PID 3832 wrote to memory of 3924	3832	zloader_1.15.0.0.vir.exe	101
PID 3832 wrote to memory of 3688	3832	zloader_1.15.0.0.vir.exe	102
PID 3832 wrote to memory of 3688	3832	zloader_1.15.0.0.vir.exe	102
PID 3832 wrote to memory of 3688	3832	zloader_1.15.0.0.vir.exe	102
PID 3832 wrote to memory of 3608	3832	zloader_1.15.0.0.vir.exe	103
PID 3832 wrote to memory of 3608	3832	zloader_1.15.0.0.vir.exe	103
PID 3832 wrote to memory of 3608	3832	zloader_1.15.0.0.vir.exe	103
PID 3832 wrote to memory of 2236	3832	zloader_1.15.0.0.vir.exe	104
PID 3832 wrote to memory of 2236	3832	zloader_1.15.0.0.vir.exe	104
PID 3832 wrote to memory of 2236	3832	zloader_1.15.0.0.vir.exe	104
PID 3832 wrote to memory of 3044	3832	zloader_1.15.0.0.vir.exe	105
PID 3832 wrote to memory of 3044	3832	zloader_1.15.0.0.vir.exe	105
PID 3832 wrote to memory of 3044	3832	zloader_1.15.0.0.vir.exe	105
PID 3832 wrote to memory of 2076	3832	zloader_1.15.0.0.vir.exe	106
PID 3832 wrote to memory of 2076	3832	zloader_1.15.0.0.vir.exe	106
PID 3832 wrote to memory of 2076	3832	zloader_1.15.0.0.vir.exe	106
PID 3832 wrote to memory of 1516	3832	zloader_1.15.0.0.vir.exe	107
PID 3832 wrote to memory of 1516	3832	zloader_1.15.0.0.vir.exe	107
PID 3832 wrote to memory of 1516	3832	zloader_1.15.0.0.vir.exe	107
PID 3832 wrote to memory of 3028	3832	zloader_1.15.0.0.vir.exe	108
PID 3832 wrote to memory of 3028	3832	zloader_1.15.0.0.vir.exe	108
PID 3832 wrote to memory of 3028	3832	zloader_1.15.0.0.vir.exe	108
PID 3832 wrote to memory of 3732	3832	zloader_1.15.0.0.vir.exe	109
PID 3832 wrote to memory of 3732	3832	zloader_1.15.0.0.vir.exe	109
PID 3832 wrote to memory of 3732	3832	zloader_1.15.0.0.vir.exe	109
PID 3832 wrote to memory of 2552	3832	zloader_1.15.0.0.vir.exe	110
PID 3832 wrote to memory of 2552	3832	zloader_1.15.0.0.vir.exe	110
PID 3832 wrote to memory of 2552	3832	zloader_1.15.0.0.vir.exe	110
PID 3832 wrote to memory of 2564	3832	zloader_1.15.0.0.vir.exe	111
PID 3832 wrote to memory of 2564	3832	zloader_1.15.0.0.vir.exe	111
PID 3832 wrote to memory of 2564	3832	zloader_1.15.0.0.vir.exe	111
PID 3832 wrote to memory of 3800	3832	zloader_1.15.0.0.vir.exe	113
PID 3832 wrote to memory of 3800	3832	zloader_1.15.0.0.vir.exe	113
PID 3832 wrote to memory of 3800	3832	zloader_1.15.0.0.vir.exe	113
PID 3832 wrote to memory of 3848	3832	zloader_1.15.0.0.vir.exe	114
PID 3832 wrote to memory of 3848	3832	zloader_1.15.0.0.vir.exe	114
PID 3832 wrote to memory of 3848	3832	zloader_1.15.0.0.vir.exe	114
PID 3832 wrote to memory of 3352	3832	zloader_1.15.0.0.vir.exe	115
PID 3832 wrote to memory of 3352	3832	zloader_1.15.0.0.vir.exe	115
PID 3832 wrote to memory of 3352	3832	zloader_1.15.0.0.vir.exe	115
PID 3832 wrote to memory of 3956	3832	zloader_1.15.0.0.vir.exe	116
PID 3832 wrote to memory of 3956	3832	zloader_1.15.0.0.vir.exe	116
PID 3832 wrote to memory of 3956	3832	zloader_1.15.0.0.vir.exe	116
PID 3832 wrote to memory of 3168	3832	zloader_1.15.0.0.vir.exe	117
PID 3832 wrote to memory of 3168	3832	zloader_1.15.0.0.vir.exe	117
PID 3832 wrote to memory of 3168	3832	zloader_1.15.0.0.vir.exe	117
PID 3832 wrote to memory of 3300	3832	zloader_1.15.0.0.vir.exe	118
PID 3832 wrote to memory of 3300	3832	zloader_1.15.0.0.vir.exe	118
PID 3832 wrote to memory of 3300	3832	zloader_1.15.0.0.vir.exe	118
PID 3832 wrote to memory of 3228	3832	zloader_1.15.0.0.vir.exe	119
PID 3832 wrote to memory of 3228	3832	zloader_1.15.0.0.vir.exe	119
PID 3832 wrote to memory of 3228	3832	zloader_1.15.0.0.vir.exe	119
PID 3832 wrote to memory of 4060	3832	zloader_1.15.0.0.vir.exe	120
PID 3832 wrote to memory of 4060	3832	zloader_1.15.0.0.vir.exe	120
PID 3832 wrote to memory of 4060	3832	zloader_1.15.0.0.vir.exe	120
PID 3832 wrote to memory of 2572	3832	zloader_1.15.0.0.vir.exe	121
PID 3832 wrote to memory of 2572	3832	zloader_1.15.0.0.vir.exe	121
PID 3832 wrote to memory of 2572	3832	zloader_1.15.0.0.vir.exe	121
PID 3832 wrote to memory of 4108	3832	zloader_1.15.0.0.vir.exe	122
PID 3832 wrote to memory of 4108	3832	zloader_1.15.0.0.vir.exe	122
PID 3832 wrote to memory of 4108	3832	zloader_1.15.0.0.vir.exe	122
PID 3832 wrote to memory of 4120	3832	zloader_1.15.0.0.vir.exe	123
PID 3832 wrote to memory of 4120	3832	zloader_1.15.0.0.vir.exe	123
PID 3832 wrote to memory of 4120	3832	zloader_1.15.0.0.vir.exe	123
PID 3832 wrote to memory of 4128	3832	zloader_1.15.0.0.vir.exe	124
PID 3832 wrote to memory of 4128	3832	zloader_1.15.0.0.vir.exe	124
PID 3832 wrote to memory of 4128	3832	zloader_1.15.0.0.vir.exe	124
PID 3832 wrote to memory of 4136	3832	zloader_1.15.0.0.vir.exe	125
PID 3832 wrote to memory of 4136	3832	zloader_1.15.0.0.vir.exe	125
PID 3832 wrote to memory of 4136	3832	zloader_1.15.0.0.vir.exe	125
PID 3832 wrote to memory of 4144	3832	zloader_1.15.0.0.vir.exe	126
PID 3832 wrote to memory of 4144	3832	zloader_1.15.0.0.vir.exe	126
PID 3832 wrote to memory of 4144	3832	zloader_1.15.0.0.vir.exe	126
PID 3832 wrote to memory of 4152	3832	zloader_1.15.0.0.vir.exe	127
PID 3832 wrote to memory of 4152	3832	zloader_1.15.0.0.vir.exe	127
PID 3832 wrote to memory of 4152	3832	zloader_1.15.0.0.vir.exe	127
PID 3832 wrote to memory of 4160	3832	zloader_1.15.0.0.vir.exe	128
PID 3832 wrote to memory of 4160	3832	zloader_1.15.0.0.vir.exe	128
PID 3832 wrote to memory of 4160	3832	zloader_1.15.0.0.vir.exe	128
PID 3832 wrote to memory of 4168	3832	zloader_1.15.0.0.vir.exe	129
PID 3832 wrote to memory of 4168	3832	zloader_1.15.0.0.vir.exe	129
PID 3832 wrote to memory of 4168	3832	zloader_1.15.0.0.vir.exe	129
PID 3832 wrote to memory of 4176	3832	zloader_1.15.0.0.vir.exe	130
PID 3832 wrote to memory of 4176	3832	zloader_1.15.0.0.vir.exe	130
PID 3832 wrote to memory of 4176	3832	zloader_1.15.0.0.vir.exe	130
PID 3832 wrote to memory of 4184	3832	zloader_1.15.0.0.vir.exe	131
PID 3832 wrote to memory of 4184	3832	zloader_1.15.0.0.vir.exe	131
PID 3832 wrote to memory of 4184	3832	zloader_1.15.0.0.vir.exe	131
PID 3832 wrote to memory of 4192	3832	zloader_1.15.0.0.vir.exe	132
PID 3832 wrote to memory of 4192	3832	zloader_1.15.0.0.vir.exe	132
PID 3832 wrote to memory of 4192	3832	zloader_1.15.0.0.vir.exe	132
PID 3832 wrote to memory of 4200	3832	zloader_1.15.0.0.vir.exe	133
PID 3832 wrote to memory of 4200	3832	zloader_1.15.0.0.vir.exe	133
PID 3832 wrote to memory of 4200	3832	zloader_1.15.0.0.vir.exe	133
PID 3832 wrote to memory of 4208	3832	zloader_1.15.0.0.vir.exe	134
PID 3832 wrote to memory of 4208	3832	zloader_1.15.0.0.vir.exe	134
PID 3832 wrote to memory of 4208	3832	zloader_1.15.0.0.vir.exe	134
PID 3832 wrote to memory of 4216	3832	zloader_1.15.0.0.vir.exe	135
PID 3832 wrote to memory of 4216	3832	zloader_1.15.0.0.vir.exe	135
PID 3832 wrote to memory of 4216	3832	zloader_1.15.0.0.vir.exe	135
PID 3832 wrote to memory of 4228	3832	zloader_1.15.0.0.vir.exe	136
PID 3832 wrote to memory of 4228	3832	zloader_1.15.0.0.vir.exe	136
PID 3832 wrote to memory of 4228	3832	zloader_1.15.0.0.vir.exe	136
PID 3832 wrote to memory of 4236	3832	zloader_1.15.0.0.vir.exe	137
PID 3832 wrote to memory of 4236	3832	zloader_1.15.0.0.vir.exe	137
PID 3832 wrote to memory of 4236	3832	zloader_1.15.0.0.vir.exe	137
PID 3832 wrote to memory of 4244	3832	zloader_1.15.0.0.vir.exe	138
PID 3832 wrote to memory of 4244	3832	zloader_1.15.0.0.vir.exe	138
PID 3832 wrote to memory of 4244	3832	zloader_1.15.0.0.vir.exe	138
PID 3832 wrote to memory of 4252	3832	zloader_1.15.0.0.vir.exe	139
PID 3832 wrote to memory of 4252	3832	zloader_1.15.0.0.vir.exe	139
PID 3832 wrote to memory of 4252	3832	zloader_1.15.0.0.vir.exe	139
PID 3832 wrote to memory of 4260	3832	zloader_1.15.0.0.vir.exe	140
PID 3832 wrote to memory of 4260	3832	zloader_1.15.0.0.vir.exe	140
PID 3832 wrote to memory of 4260	3832	zloader_1.15.0.0.vir.exe	140
PID 3832 wrote to memory of 4268	3832	zloader_1.15.0.0.vir.exe	141
PID 3832 wrote to memory of 4268	3832	zloader_1.15.0.0.vir.exe	141
PID 3832 wrote to memory of 4268	3832	zloader_1.15.0.0.vir.exe	141
PID 3832 wrote to memory of 4276	3832	zloader_1.15.0.0.vir.exe	142
PID 3832 wrote to memory of 4276	3832	zloader_1.15.0.0.vir.exe	142
PID 3832 wrote to memory of 4276	3832	zloader_1.15.0.0.vir.exe	142
PID 3832 wrote to memory of 4284	3832	zloader_1.15.0.0.vir.exe	143
PID 3832 wrote to memory of 4284	3832	zloader_1.15.0.0.vir.exe	143
PID 3832 wrote to memory of 4284	3832	zloader_1.15.0.0.vir.exe	143
PID 3832 wrote to memory of 4292	3832	zloader_1.15.0.0.vir.exe	144
PID 3832 wrote to memory of 4292	3832	zloader_1.15.0.0.vir.exe	144
PID 3832 wrote to memory of 4292	3832	zloader_1.15.0.0.vir.exe	144
PID 3832 wrote to memory of 4300	3832	zloader_1.15.0.0.vir.exe	145
PID 3832 wrote to memory of 4300	3832	zloader_1.15.0.0.vir.exe	145
PID 3832 wrote to memory of 4300	3832	zloader_1.15.0.0.vir.exe	145
PID 3832 wrote to memory of 4308	3832	zloader_1.15.0.0.vir.exe	146
PID 3832 wrote to memory of 4308	3832	zloader_1.15.0.0.vir.exe	146
PID 3832 wrote to memory of 4308	3832	zloader_1.15.0.0.vir.exe	146
PID 3832 wrote to memory of 4316	3832	zloader_1.15.0.0.vir.exe	147
PID 3832 wrote to memory of 4316	3832	zloader_1.15.0.0.vir.exe	147
PID 3832 wrote to memory of 4316	3832	zloader_1.15.0.0.vir.exe	147
PID 3832 wrote to memory of 4324	3832	zloader_1.15.0.0.vir.exe	148
PID 3832 wrote to memory of 4324	3832	zloader_1.15.0.0.vir.exe	148
PID 3832 wrote to memory of 4324	3832	zloader_1.15.0.0.vir.exe	148
PID 3832 wrote to memory of 4332	3832	zloader_1.15.0.0.vir.exe	149
PID 3832 wrote to memory of 4332	3832	zloader_1.15.0.0.vir.exe	149
PID 3832 wrote to memory of 4332	3832	zloader_1.15.0.0.vir.exe	149
PID 3832 wrote to memory of 4340	3832	zloader_1.15.0.0.vir.exe	150
PID 3832 wrote to memory of 4340	3832	zloader_1.15.0.0.vir.exe	150
PID 3832 wrote to memory of 4340	3832	zloader_1.15.0.0.vir.exe	150
PID 3832 wrote to memory of 4348	3832	zloader_1.15.0.0.vir.exe	151
PID 3832 wrote to memory of 4348	3832	zloader_1.15.0.0.vir.exe	151
PID 3832 wrote to memory of 4348	3832	zloader_1.15.0.0.vir.exe	151
PID 3832 wrote to memory of 4356	3832	zloader_1.15.0.0.vir.exe	152
PID 3832 wrote to memory of 4356	3832	zloader_1.15.0.0.vir.exe	152
PID 3832 wrote to memory of 4356	3832	zloader_1.15.0.0.vir.exe	152
PID 3832 wrote to memory of 4364	3832	zloader_1.15.0.0.vir.exe	153
PID 3832 wrote to memory of 4364	3832	zloader_1.15.0.0.vir.exe	153
PID 3832 wrote to memory of 4364	3832	zloader_1.15.0.0.vir.exe	153
PID 3832 wrote to memory of 4364	3832	zloader_1.15.0.0.vir.exe	153
PID 3832 wrote to memory of 4364	3832	zloader_1.15.0.0.vir.exe	153
PID 3832 wrote to memory of 4364	3832	zloader_1.15.0.0.vir.exe	153
PID 3832 wrote to memory of 4364	3832	zloader_1.15.0.0.vir.exe	153
PID 3832 wrote to memory of 4364	3832	zloader_1.15.0.0.vir.exe	153
PID 3832 wrote to memory of 4364	3832	zloader_1.15.0.0.vir.exe	153
PID 3832 wrote to memory of 4364	3832	zloader_1.15.0.0.vir.exe	153
PID 3832 wrote to memory of 4364	3832	zloader_1.15.0.0.vir.exe	153
PID 3832 wrote to memory of 4364	3832	zloader_1.15.0.0.vir.exe	153
PID 3832 wrote to memory of 4364	3832	zloader_1.15.0.0.vir.exe	153
PID 4364 wrote to memory of 4396	4364	zloader_1.15.0.0.vir.exe	154
PID 4364 wrote to memory of 4396	4364	zloader_1.15.0.0.vir.exe	154
PID 4364 wrote to memory of 4396	4364	zloader_1.15.0.0.vir.exe	154
PID 3832 wrote to memory of 4364	3832	zloader_1.15.0.0.vir.exe	153

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3784	WerFault.exe
Token: SeBackupPrivilege	3784	WerFault.exe
Token: SeDebugPrivilege	3784	WerFault.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3832	zloader_1.15.0.0.vir.exe
3832	zloader_1.15.0.0.vir.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3832 set thread context of 3904	3832	zloader_1.15.0.0.vir.exe	71
PID 3832 set thread context of 4364	3832	zloader_1.15.0.0.vir.exe	153

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3784	3904	WerFault.exe	71

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4364	zloader_1.15.0.0.vir.exe
4364	zloader_1.15.0.0.vir.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3904-1-0x0000000000400000-0x00000000009DC000-memory.dmp	upx
behavioral2/memory/3904-3-0x0000000000400000-0x00000000009DC000-memory.dmp	upx

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
PID:3832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
  2⤵
  - Drops startup file
  PID:3984
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  PID:3892
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  PID:3896
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  PID:3904
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 536
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: EnumeratesProcesses
    - Program crash
    PID:3784
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:3864
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:3872
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:3860
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:3952
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:3960
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:3908
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:3840
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:1736
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:3356
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:3988
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:3224
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:3500
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:3992
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:3856
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:4024
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:4004
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:1692
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:392
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:408
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:2696
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:748
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:412
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:3524
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:2480
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:384
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:3140
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:2532
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:2660
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:3924
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:3688
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:3608
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:2236
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:3044
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:2076
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:1516
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:3028
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:3732
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:2552
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:2564
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:3800
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:3848
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:3352
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:3956
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:3168
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:3300
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:3228
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:4060
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:2572
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:4108
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:4120
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:4128
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:4136
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:4144
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:4152
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:4160
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:4168
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:4176
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:4184
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:4192
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:4200
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:4208
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:4216
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:4228
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:4236
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:4244
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:4252
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:4260
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:4268
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:4276
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:4284
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:4292
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:4300
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:4308
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:4316
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:4324
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:4332
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:4340
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:4348
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  PID:4356
- C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.0.0.vir.exe"
  2⤵
  - Suspicious behavior: MapViewOfSection
  PID:4364
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    PID:4396

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3784-4-0x0000000004870000-0x0000000004871000-memory.dmp

Download

memory/3784-11-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

Download

memory/3904-3-0x0000000000400000-0x00000000009DC000-memory.dmp

Download

memory/3904-1-0x0000000000400000-0x00000000009DC000-memory.dmp

Download

memory/4364-5-0x0000000000400000-0x0000000000484000-memory.dmp

Download

memory/4364-7-0x0000000000400000-0x0000000000484000-memory.dmp

Download

memory/4396-13-0x0000000000C20000-0x000000000105F000-memory.dmp

Download

memory/4396-17-0x0000000000C20000-0x000000000105F000-memory.dmp

Download