Analysis
-
max time kernel
139s -
max time network
32s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
19-07-2020 17:20
Static task
static1
Behavioral task
behavioral1
Sample
zloader_1.14.7.0.vir.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
zloader_1.14.7.0.vir.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
zloader_1.14.7.0.vir.exe
-
Size
316KB
-
MD5
002b8030adf234692cf4fbb77c67799e
-
SHA1
611e8f1e727960c7ca2efeb24b867e9281ea665b
-
SHA256
95c0083088ecaae25b32782af71007fa871594391a22f0ecef4389a0c5fa91b5
-
SHA512
97852fa83736464f819766cffccfb7c896be38b2173e6520c0dda32cd8edaed67bcf7aa329c1c4782e1b7de4179c7747f751441c24bf84563db9fe49350043ee
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1040 1016 WerFault.exe zloader_1.14.7.0.vir.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
zloader_1.14.7.0.vir.exedescription pid process target process PID 1016 wrote to memory of 1040 1016 zloader_1.14.7.0.vir.exe WerFault.exe PID 1016 wrote to memory of 1040 1016 zloader_1.14.7.0.vir.exe WerFault.exe PID 1016 wrote to memory of 1040 1016 zloader_1.14.7.0.vir.exe WerFault.exe PID 1016 wrote to memory of 1040 1016 zloader_1.14.7.0.vir.exe WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WerFault.exedescription pid process Token: SeDebugPrivilege 1040 WerFault.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
WerFault.exepid process 1040 WerFault.exe 1040 WerFault.exe 1040 WerFault.exe 1040 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.14.7.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.14.7.0.vir.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 1482⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1040-0-0x0000000000000000-mapping.dmp
-
memory/1040-1-0x0000000001F80000-0x0000000001F91000-memory.dmpFilesize
68KB
-
memory/1040-2-0x0000000002580000-0x0000000002591000-memory.dmpFilesize
68KB
-
memory/1040-3-0x0000000002580000-0x0000000002591000-memory.dmpFilesize
68KB