1d20f089698311891fac0a5cc2f3ecbfc1ce8e38d5e75a8a55b822324e8b1d35 | Triage

Analysis

max time kernel
150s
max time network
145s
platform
windows7_x64
resource
win7v200430
submitted
19-07-2020 16:49

Sharing

Report Analysis Logs

General

Target

zloader_1.15.5.0.vir.exe
Size

156KB
MD5

e477358e4fa411d0d426767a02d5a787
SHA1

d6c23371f6784f20b8f7052d6b69add87db0ecfb
SHA256

1d20f089698311891fac0a5cc2f3ecbfc1ce8e38d5e75a8a55b822324e8b1d35
SHA512

f1ffca1e5d4b0762aeea3728150c63d0ee0540ba8593e1dc49884ca0ce61fc2717cddbc718a9f5fa4f48cfa5204c685d1fe04f6c12819ce502ba0717051eac90

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

zloader_1.15.5.0.vir.exe

description	pid	process	target process
PID 1356 wrote to memory of 1412	1356	zloader_1.15.5.0.vir.exe	explorer.exe
PID 1356 wrote to memory of 1412	1356	zloader_1.15.5.0.vir.exe	explorer.exe
PID 1356 wrote to memory of 1412	1356	zloader_1.15.5.0.vir.exe	explorer.exe
PID 1356 wrote to memory of 1412	1356	zloader_1.15.5.0.vir.exe	explorer.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

zloader_1.15.5.0.vir.exe

pid process

1356 zloader_1.15.5.0.vir.exe
1356 zloader_1.15.5.0.vir.exe

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.5.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.5.0.vir.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
PID:1356

C:\Windows\SysWOW64\explorer.exe
explorer.exe
2⤵
PID:1412

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1412-0-0x0000000000000000-mapping.dmp

Download
memory/1412-1-0x0000000000910000-0x0000000000B91000-memory.dmp

Filesize
2.5MB

Download