8afa8c9fc4f0d3c24dfc03477fb93c5df5e1c75b3926e5127a3d4aca6fa43a83

Analysis

max time kernel
149s
max time network
151s
platform
windows10_x64
resource
win10
submitted
19/07/2020, 19:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zloader 2_1.0.14.0.vir.exe
Size 130KB
Sample200719-wrt25yszze
SHA256 8afa8c9fc4f0d3c24dfc03477fb93c5df5e1c75b3926e5127a3d4aca6fa43a83
MD5 88adb0b457ea881c4b09ee65a8ee72f6
SHA1 45131fff959d36d51c5ba07b369ffa9a2db32499
SHA512 8c6652257e18aa0adcc18c5a70783317d0ebdc00dbc66f83d715d3c02dff4dfe34e1313c5a859598996e8179132df274a497b2dd419baf78a0aca2af182c0b70
MD5 SHA1 SHA512

Score

8^/10

persistence

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3888 wrote to memory of 964	3888	zloader 2_1.0.14.0.vir.exe	73
PID 3888 wrote to memory of 964	3888	zloader 2_1.0.14.0.vir.exe	73
PID 3888 wrote to memory of 964	3888	zloader 2_1.0.14.0.vir.exe	73
PID 3888 wrote to memory of 964	3888	zloader 2_1.0.14.0.vir.exe	73
PID 3888 wrote to memory of 964	3888	zloader 2_1.0.14.0.vir.exe	73

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3888 set thread context of 964	3888	zloader 2_1.0.14.0.vir.exe	73

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	964	msiexec.exe
Token: SeSecurityPrivilege	964	msiexec.exe

Blacklisted process makes network request 2 IoCs

flow	pid	Process
18	964	msiexec.exe
19	964	msiexec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Cobecuug = "C:\\Users\\Admin\\AppData\\Roaming\\Abbyf\\ydbaagoc.exe"	msiexec.exe

C:\Users\Admin\AppData\Local\Temp\zloader 2_1.0.14.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader 2_1.0.14.0.vir.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:3888
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Blacklisted process makes network request
  - Adds Run key to start application
  PID:964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/964-0-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Download