Analysis
-
max time kernel
1559s -
max time network
1566s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
25-11-2023 14:46
Behavioral task
behavioral1
Sample
ZLogger4.7.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
ZLogger4.7.exe
Resource
win10v2004-20231025-en
General
-
Target
ZLogger4.7.exe
-
Size
79.0MB
-
MD5
d0146ba4a2389891791ef2f1c0ac7a1c
-
SHA1
d101f0319da6dae09d406a7b0227b5e95725e16c
-
SHA256
9236a756a4f1d70338c934f0a0f0be119d6cc7319ee73a44a416cd2f17064987
-
SHA512
130a48c2edc56c56d77d8197a34a6af4b6764f69ab590599c697da1387deb3fda092571d55c85a3e76d3dd5c23ed64c53676d57b395ea5ee64576b93a0ea6400
-
SSDEEP
1572864:02MmiJR5QYHJiXGSk8IpG7V+VPhqoHZE7xHp5tWWfsnghowmaOllIWgawuBeWBg6:0ZmCxp0GSkB05awoHYJjlmghfxOllIR5
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
ZLogger4.7.exepid process 2672 ZLogger4.7.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI16322\python311.dll upx \Users\Admin\AppData\Local\Temp\_MEI16322\python311.dll upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
ZLogger4.7.exedescription pid process target process PID 1632 wrote to memory of 2672 1632 ZLogger4.7.exe ZLogger4.7.exe PID 1632 wrote to memory of 2672 1632 ZLogger4.7.exe ZLogger4.7.exe PID 1632 wrote to memory of 2672 1632 ZLogger4.7.exe ZLogger4.7.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD55f6fd64ec2d7d73ae49c34dd12cedb23
SHA1c6e0385a868f3153a6e8879527749db52dce4125
SHA256ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967
SHA512c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab
-
Filesize
1.6MB
MD55f6fd64ec2d7d73ae49c34dd12cedb23
SHA1c6e0385a868f3153a6e8879527749db52dce4125
SHA256ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967
SHA512c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab