8afa8c9fc4f0d3c24dfc03477fb93c5df5e1c75b3926e5127a3d4aca6fa43a83

Analysis

max time kernel
149s
max time network
151s
platform
windows10_x64
resource
win10
submitted
19-07-2020 19:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

zloader 2_1.0.14.0.vir.exe
Size

130KB
MD5

88adb0b457ea881c4b09ee65a8ee72f6
SHA1

45131fff959d36d51c5ba07b369ffa9a2db32499
SHA256

8afa8c9fc4f0d3c24dfc03477fb93c5df5e1c75b3926e5127a3d4aca6fa43a83
SHA512

8c6652257e18aa0adcc18c5a70783317d0ebdc00dbc66f83d715d3c02dff4dfe34e1313c5a859598996e8179132df274a497b2dd419baf78a0aca2af182c0b70

Score

8^/10

persistence

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

zloader 2_1.0.14.0.vir.exe

description	pid	process	target process
PID 3888 wrote to memory of 964	3888	zloader 2_1.0.14.0.vir.exe	msiexec.exe
PID 3888 wrote to memory of 964	3888	zloader 2_1.0.14.0.vir.exe	msiexec.exe
PID 3888 wrote to memory of 964	3888	zloader 2_1.0.14.0.vir.exe	msiexec.exe
PID 3888 wrote to memory of 964	3888	zloader 2_1.0.14.0.vir.exe	msiexec.exe
PID 3888 wrote to memory of 964	3888	zloader 2_1.0.14.0.vir.exe	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

zloader 2_1.0.14.0.vir.exe

description pid process target process

PID 3888 set thread context of 964 3888 zloader 2_1.0.14.0.vir.exe msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeSecurityPrivilege 964 msiexec.exe
Token: SeSecurityPrivilege 964 msiexec.exe
Blacklisted process makes network request 2 IoCs

Processes:

msiexec.exe

flow pid process

18 964 msiexec.exe
19 964 msiexec.exe

description	pid	process	target process
PID 3888 set thread context of 964	3888	zloader 2_1.0.14.0.vir.exe	msiexec.exe

description	pid	process
Token: SeSecurityPrivilege	964	msiexec.exe
Token: SeSecurityPrivilege	964	msiexec.exe

flow	pid	process
18	964	msiexec.exe
19	964	msiexec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Cobecuug = "C:\\Users\\Admin\\AppData\\Roaming\\Abbyf\\ydbaagoc.exe"	msiexec.exe

C:\Users\Admin\AppData\Local\Temp\zloader 2_1.0.14.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader 2_1.0.14.0.vir.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:3888

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
- Blacklisted process makes network request
- Adds Run key to start application
PID:964

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/964-0-0x0000000002E80000-0x0000000002EA6000-memory.dmp

Filesize
152KB

Download
memory/964-1-0x0000000000000000-mapping.dmp

Download