de9b33b92113cbd0ec51b9e13596f5320d45bbb7b0222a6a17ed2867a2ff68bb

Analysis

max time kernel
144s
max time network
39s
platform
windows10_x64
resource
win10v200430
submitted
19-07-2020 17:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

zloader_2.1.0.0.vir.exe
Size

310KB
MD5

f25b450be296f859caee775f42da3721
SHA1

166361fd7c169863e2e0e8097f8c558e638fd1d6
SHA256

de9b33b92113cbd0ec51b9e13596f5320d45bbb7b0222a6a17ed2867a2ff68bb
SHA512

f4242f4af7ba7e645b6f47c0656821c88b8d97d73f0d0c7d583b04101017f156cf6cf5e74cc303c22227d7acc618365fb1b147cf163846cf6048fa48f09d91d8

Score

7^/10

persistence

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

zloader_2.1.0.0.vir.exe

description	pid	process	target process
PID 1484 wrote to memory of 1600	1484	zloader_2.1.0.0.vir.exe	msiexec.exe
PID 1484 wrote to memory of 1600	1484	zloader_2.1.0.0.vir.exe	msiexec.exe
PID 1484 wrote to memory of 1600	1484	zloader_2.1.0.0.vir.exe	msiexec.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

zloader_2.1.0.0.vir.exe

pid process

1484 zloader_2.1.0.0.vir.exe
1484 zloader_2.1.0.0.vir.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeSecurityPrivilege 1600 msiexec.exe
Token: SeSecurityPrivilege 1600 msiexec.exe
Deletes itself 1 IoCs

Processes:

msiexec.exe

pid process

1600 msiexec.exe

pid	process
1484	zloader_2.1.0.0.vir.exe
1484	zloader_2.1.0.0.vir.exe

description	pid	process
Token: SeSecurityPrivilege	1600	msiexec.exe
Token: SeSecurityPrivilege	1600	msiexec.exe

pid	process
1600	msiexec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\Orwetabu = "C:\\Users\\Admin\\AppData\\Roaming\\Waagte\\foag.exe"	msiexec.exe

C:\Users\Admin\AppData\Local\Temp\zloader_2.1.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_2.1.0.0.vir.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
PID:1484

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
- Deletes itself
- Adds Run key to start application
PID:1600

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1484-0-0x000000000062F000-0x0000000000630000-memory.dmp

Filesize
4KB

Download
memory/1600-1-0x0000000000000000-mapping.dmp

Download
memory/1600-2-0x0000000000AB0000-0x0000000000AC2000-memory.dmp

Filesize
72KB

Download
memory/1600-3-0x0000000000AB0000-0x0000000000AC2000-memory.dmp

Filesize
72KB

Download