Overview

overview

1

Static

static

zloader_1....ir.exe

windows7_x64

1

zloader_1....ir.exe

windows10_x64

1

Analysis

  • max time kernel
    144s
  • max time network
    146s
  • platform
    windows10_x64
  • resource
    win10v200430
  • submitted
    19/07/2020, 19:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    zloader_1.15.4.0.vir.exe
  • Size 352KB
  • Sample200719-gmdwjefxja
  • SHA256 c7d7e6c6dc477e5fdb2b2a26eed1b53e77d455dbec8df800927a5bae69a2cc10
  • MD5 SHA1 SHA512
Score
1/10

Malware Config

Signatures

  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\zloader_1.15.4.0.vir.exe
    "C:\Users\Admin\AppData\Local\Temp\zloader_1.15.4.0.vir.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    • Suspicious behavior: MapViewOfSection
    PID:3656
    • C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      2⤵
        PID:1876
    • \??\c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s Netman
      1⤵
      • Modifies data under HKEY_USERS
      PID:516
    • \??\c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:676

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/1876-1-0x0000000000EB0000-0x00000000012EF000-memory.dmp
          Download

          memory/1876-2-0x0000000000EB0000-0x00000000012EF000-memory.dmp
          Download