Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows10_x64 -
resource
win10 -
submitted
19-07-2020 17:24
Static task
static1
Behavioral task
behavioral1
Sample
zeus 2_2.0.2.2.vir.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
zeus 2_2.0.2.2.vir.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
zeus 2_2.0.2.2.vir.exe
-
Size
2.4MB
-
MD5
c65b1e129871b8583688f9a6c7aa724b
-
SHA1
ecb550ccbaafdae6790ae158931a1480c5290d13
-
SHA256
b0691fde64cadcfc7a521f2fda6975a14e0cdbbd46254950390f7f820310482f
-
SHA512
81e88e5bfb1ae07bef67faa698f4bf5474bfb837ebf63cceaf1c30d1490970dba1efc812b95e8fac88d12f07644056d3e60af92b899ca38cad8d9d3c89437276
Score
5/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
zeus 2_2.0.2.2.vir.exedescription pid process target process PID 3820 wrote to memory of 2168 3820 zeus 2_2.0.2.2.vir.exe zeus 2_2.0.2.2.vir.exe PID 3820 wrote to memory of 2168 3820 zeus 2_2.0.2.2.vir.exe zeus 2_2.0.2.2.vir.exe PID 3820 wrote to memory of 2168 3820 zeus 2_2.0.2.2.vir.exe zeus 2_2.0.2.2.vir.exe PID 3820 wrote to memory of 2168 3820 zeus 2_2.0.2.2.vir.exe zeus 2_2.0.2.2.vir.exe PID 3820 wrote to memory of 2168 3820 zeus 2_2.0.2.2.vir.exe zeus 2_2.0.2.2.vir.exe PID 3820 wrote to memory of 2168 3820 zeus 2_2.0.2.2.vir.exe zeus 2_2.0.2.2.vir.exe PID 3820 wrote to memory of 2168 3820 zeus 2_2.0.2.2.vir.exe zeus 2_2.0.2.2.vir.exe PID 3820 wrote to memory of 2168 3820 zeus 2_2.0.2.2.vir.exe zeus 2_2.0.2.2.vir.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
zeus 2_2.0.2.2.vir.exedescription pid process target process PID 3820 set thread context of 2168 3820 zeus 2_2.0.2.2.vir.exe zeus 2_2.0.2.2.vir.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.2.2.vir.exe"C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.2.2.vir.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.2.2.vir.exe"C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.2.2.vir.exe"2⤵