Analysis
- max time kernel
130s - max time network
131s - platform
windows10_x64 - resource
win10 - submitted
19/07/2020, 19:25
Static task
static1
Behavioral task
behavioral1
Sample
zloader_1.5.4.0.vir.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
zloader_1.5.4.0.vir.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target zloader_1.5.4.0.vir.exe
- Size 115KB
- Sample200719-wkpaeksdwx
- SHA256 cc59f4e889283e3dff30ef291a50234772901a99168cecc501f86e75dac3b7ef
- MD5 c39aabd5a338b76aaf1479baf5b50461
- SHA1 b04e684c0d733330d27bd6b456565b26690b49c3
- SHA512 b746dae281e43291590eccb9ef15aa10f40bfb527773080054835920432c2926133c19521df3b570d6e89cace0d8d228d6354e0a41f800a8918afd5def0d348f
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 53 IoCs
description pid Process procid_target PID 2460 wrote to memory of 3948 2460 zloader_1.5.4.0.vir.exe 67 PID 2460 wrote to memory of 3948 2460 zloader_1.5.4.0.vir.exe 67 PID 2460 wrote to memory of 3948 2460 zloader_1.5.4.0.vir.exe 67 PID 2460 wrote to memory of 3872 2460 zloader_1.5.4.0.vir.exe 69 PID 2460 wrote to memory of 3872 2460 zloader_1.5.4.0.vir.exe 69 PID 2460 wrote to memory of 3872 2460 zloader_1.5.4.0.vir.exe 69 PID 2460 wrote to memory of 3836 2460 zloader_1.5.4.0.vir.exe 70 PID 2460 wrote to memory of 3836 2460 zloader_1.5.4.0.vir.exe 70 PID 2460 wrote to memory of 3836 2460 zloader_1.5.4.0.vir.exe 70 PID 2460 wrote to memory of 3340 2460 zloader_1.5.4.0.vir.exe 71 PID 2460 wrote to memory of 3340 2460 zloader_1.5.4.0.vir.exe 71 PID 2460 wrote to memory of 3340 2460 zloader_1.5.4.0.vir.exe 71 PID 2460 wrote to memory of 3804 2460 zloader_1.5.4.0.vir.exe 72 PID 2460 wrote to memory of 3804 2460 zloader_1.5.4.0.vir.exe 72 PID 2460 wrote to memory of 3804 2460 zloader_1.5.4.0.vir.exe 72 PID 2460 wrote to memory of 3820 2460 zloader_1.5.4.0.vir.exe 73 PID 2460 wrote to memory of 3820 2460 zloader_1.5.4.0.vir.exe 73 PID 2460 wrote to memory of 3820 2460 zloader_1.5.4.0.vir.exe 73 PID 2460 wrote to memory of 3816 2460 zloader_1.5.4.0.vir.exe 74 PID 2460 wrote to memory of 3816 2460 zloader_1.5.4.0.vir.exe 74 PID 2460 wrote to memory of 3816 2460 zloader_1.5.4.0.vir.exe 74 PID 2460 wrote to memory of 3840 2460 zloader_1.5.4.0.vir.exe 75 PID 2460 wrote to memory of 3840 2460 zloader_1.5.4.0.vir.exe 75 PID 2460 wrote to memory of 3840 2460 zloader_1.5.4.0.vir.exe 75 PID 2460 wrote to memory of 3864 2460 zloader_1.5.4.0.vir.exe 76 PID 2460 wrote to memory of 3864 2460 zloader_1.5.4.0.vir.exe 76 PID 2460 wrote to memory of 3864 2460 zloader_1.5.4.0.vir.exe 76 PID 2460 wrote to memory of 3892 2460 zloader_1.5.4.0.vir.exe 77 PID 2460 wrote to memory of 3892 2460 zloader_1.5.4.0.vir.exe 77 PID 2460 wrote to memory of 3892 2460 zloader_1.5.4.0.vir.exe 77 PID 2460 wrote to memory of 3892 2460 zloader_1.5.4.0.vir.exe 77 PID 2460 wrote to memory of 3892 2460 zloader_1.5.4.0.vir.exe 77 PID 2460 wrote to memory of 3892 2460 zloader_1.5.4.0.vir.exe 77 PID 2460 wrote to memory of 3892 2460 zloader_1.5.4.0.vir.exe 77 PID 2460 wrote to memory of 3892 2460 zloader_1.5.4.0.vir.exe 77 PID 2460 wrote to memory of 3892 2460 zloader_1.5.4.0.vir.exe 77 PID 2460 wrote to memory of 3892 2460 zloader_1.5.4.0.vir.exe 77 PID 2460 wrote to memory of 3892 2460 zloader_1.5.4.0.vir.exe 77 PID 2460 wrote to memory of 3892 2460 zloader_1.5.4.0.vir.exe 77 PID 2460 wrote to memory of 3892 2460 zloader_1.5.4.0.vir.exe 77 PID 2460 wrote to memory of 3932 2460 zloader_1.5.4.0.vir.exe 78 PID 2460 wrote to memory of 3932 2460 zloader_1.5.4.0.vir.exe 78 PID 2460 wrote to memory of 3932 2460 zloader_1.5.4.0.vir.exe 78 PID 2460 wrote to memory of 3932 2460 zloader_1.5.4.0.vir.exe 78 PID 2460 wrote to memory of 3932 2460 zloader_1.5.4.0.vir.exe 78 PID 2460 wrote to memory of 3932 2460 zloader_1.5.4.0.vir.exe 78 PID 2460 wrote to memory of 3932 2460 zloader_1.5.4.0.vir.exe 78 PID 2460 wrote to memory of 3932 2460 zloader_1.5.4.0.vir.exe 78 PID 2460 wrote to memory of 3932 2460 zloader_1.5.4.0.vir.exe 78 PID 3932 wrote to memory of 4056 3932 zloader_1.5.4.0.vir.exe 80 PID 3932 wrote to memory of 4056 3932 zloader_1.5.4.0.vir.exe 80 PID 3932 wrote to memory of 4056 3932 zloader_1.5.4.0.vir.exe 80 PID 2460 wrote to memory of 3932 2460 zloader_1.5.4.0.vir.exe 78 - Program crash 1 IoCs
pid pid_target Process procid_target 2540 3892 WerFault.exe 77 - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 3932 zloader_1.5.4.0.vir.exe 3932 zloader_1.5.4.0.vir.exe -
resource yara_rule behavioral2/memory/3892-1-0x0000000000400000-0x00000000009DC000-memory.dmp upx behavioral2/memory/3892-4-0x0000000000400000-0x00000000009DC000-memory.dmp upx - Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2460 zloader_1.5.4.0.vir.exe 2460 zloader_1.5.4.0.vir.exe - Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 2460 zloader_1.5.4.0.vir.exe 2460 zloader_1.5.4.0.vir.exe 2540 WerFault.exe 2540 WerFault.exe 2540 WerFault.exe 2540 WerFault.exe 2540 WerFault.exe 2540 WerFault.exe 2540 WerFault.exe 2540 WerFault.exe 2540 WerFault.exe 2540 WerFault.exe 2540 WerFault.exe 2540 WerFault.exe 2540 WerFault.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2460 set thread context of 3892 2460 zloader_1.5.4.0.vir.exe 77 PID 2460 set thread context of 3932 2460 zloader_1.5.4.0.vir.exe 78 - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 2540 WerFault.exe Token: SeBackupPrivilege 2540 WerFault.exe Token: SeDebugPrivilege 2540 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.5.4.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.5.4.0.vir.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
PID:2460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\zloader_1.5.4.0.vir.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"2⤵
- Drops startup file
PID:3948
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵PID:3872
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵PID:3836
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵PID:3340
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵PID:3804
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵PID:3820
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵PID:3816
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵PID:3840
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵PID:3864
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵PID:3892
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3892 -s 5363⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2540
-
-
-
C:\Users\Admin\AppData\Local\Temp\zloader_1.5.4.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\zloader_1.5.4.0.vir.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
PID:3932 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"3⤵PID:4056
-
-