de9b33b92113cbd0ec51b9e13596f5320d45bbb7b0222a6a17ed2867a2ff68bb

Analysis

max time kernel
143s
max time network
118s
platform
windows7_x64
resource
win7
submitted
19-07-2020 17:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

zloader_2.1.0.0.vir.exe
Size

310KB
MD5

f25b450be296f859caee775f42da3721
SHA1

166361fd7c169863e2e0e8097f8c558e638fd1d6
SHA256

de9b33b92113cbd0ec51b9e13596f5320d45bbb7b0222a6a17ed2867a2ff68bb
SHA512

f4242f4af7ba7e645b6f47c0656821c88b8d97d73f0d0c7d583b04101017f156cf6cf5e74cc303c22227d7acc618365fb1b147cf163846cf6048fa48f09d91d8

Score

7^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\Vuep = "C:\\Users\\Admin\\AppData\\Roaming\\Sokos\\upabz.exe"	msiexec.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

zloader_2.1.0.0.vir.exe

description	pid	process	target process
PID 900 wrote to memory of 844	900	zloader_2.1.0.0.vir.exe	msiexec.exe
PID 900 wrote to memory of 844	900	zloader_2.1.0.0.vir.exe	msiexec.exe
PID 900 wrote to memory of 844	900	zloader_2.1.0.0.vir.exe	msiexec.exe
PID 900 wrote to memory of 844	900	zloader_2.1.0.0.vir.exe	msiexec.exe
PID 900 wrote to memory of 844	900	zloader_2.1.0.0.vir.exe	msiexec.exe
PID 900 wrote to memory of 844	900	zloader_2.1.0.0.vir.exe	msiexec.exe
PID 900 wrote to memory of 844	900	zloader_2.1.0.0.vir.exe	msiexec.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

zloader_2.1.0.0.vir.exe

pid process

900 zloader_2.1.0.0.vir.exe
900 zloader_2.1.0.0.vir.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeSecurityPrivilege 844 msiexec.exe
Token: SeSecurityPrivilege 844 msiexec.exe
Deletes itself 1 IoCs

Processes:

msiexec.exe

pid process

844 msiexec.exe

pid	process
900	zloader_2.1.0.0.vir.exe
900	zloader_2.1.0.0.vir.exe

description	pid	process
Token: SeSecurityPrivilege	844	msiexec.exe
Token: SeSecurityPrivilege	844	msiexec.exe

pid	process
844	msiexec.exe

C:\Users\Admin\AppData\Local\Temp\zloader_2.1.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_2.1.0.0.vir.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
PID:900

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
2⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Deletes itself
PID:844

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/844-1-0x0000000000000000-mapping.dmp

Download
memory/844-2-0x0000000000D60000-0x0000000000D74000-memory.dmp

Filesize
80KB

Download