Analysis
-
max time kernel
151s -
max time network
127s -
platform
windows7_x64 -
resource
win7 -
submitted
19-07-2020 19:26
Static task
static1
Behavioral task
behavioral1
Sample
zeus 2_2.0.9.9.vir.exe
Resource
win7
Behavioral task
behavioral2
Sample
zeus 2_2.0.9.9.vir.exe
Resource
win10
General
-
Target
zeus 2_2.0.9.9.vir.exe
-
Size
138KB
-
MD5
900568491ecc1da95ba6087e3d65d9ba
-
SHA1
c79aef469f13da247dd05ceaa8598bba2fd4beea
-
SHA256
0a98d7b4d1079a8819a6bd0898de2e00a5598c1e5233aa095bea36a18353b4bb
-
SHA512
a5b8dbd6098fc2961b0e3bc53556be2ec03b1ae7f6720a827d596f26ae8e93ac49775fc47e2757b407ae315a2e9667f59168df79e96422f2172cb233eab5b284
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
abert.exepid process 608 abert.exe 608 abert.exe 608 abert.exe 608 abert.exe 608 abert.exe 608 abert.exe 608 abert.exe 608 abert.exe 608 abert.exe 608 abert.exe 608 abert.exe 608 abert.exe 608 abert.exe 608 abert.exe 608 abert.exe 608 abert.exe 608 abert.exe 608 abert.exe 608 abert.exe 608 abert.exe 608 abert.exe 608 abert.exe 608 abert.exe 608 abert.exe 608 abert.exe 608 abert.exe 608 abert.exe 608 abert.exe 608 abert.exe 608 abert.exe 608 abert.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
WinMail.exepid process 1436 WinMail.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1876 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
abert.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\Currentversion\Run abert.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\{1CBD958B-C952-7BAE-DEE3-6D5495B8B8E1} = "C:\\Users\\Admin\\AppData\\Roaming\\Xemue\\abert.exe" abert.exe -
Suspicious use of WriteProcessMemory 48 IoCs
Processes:
zeus 2_2.0.9.9.vir.exeabert.exedescription pid process target process PID 1140 wrote to memory of 608 1140 zeus 2_2.0.9.9.vir.exe abert.exe PID 1140 wrote to memory of 608 1140 zeus 2_2.0.9.9.vir.exe abert.exe PID 1140 wrote to memory of 608 1140 zeus 2_2.0.9.9.vir.exe abert.exe PID 1140 wrote to memory of 608 1140 zeus 2_2.0.9.9.vir.exe abert.exe PID 608 wrote to memory of 1148 608 abert.exe taskhost.exe PID 608 wrote to memory of 1148 608 abert.exe taskhost.exe PID 608 wrote to memory of 1148 608 abert.exe taskhost.exe PID 608 wrote to memory of 1148 608 abert.exe taskhost.exe PID 608 wrote to memory of 1148 608 abert.exe taskhost.exe PID 608 wrote to memory of 1264 608 abert.exe Dwm.exe PID 608 wrote to memory of 1264 608 abert.exe Dwm.exe PID 608 wrote to memory of 1264 608 abert.exe Dwm.exe PID 608 wrote to memory of 1264 608 abert.exe Dwm.exe PID 608 wrote to memory of 1264 608 abert.exe Dwm.exe PID 608 wrote to memory of 1308 608 abert.exe Explorer.EXE PID 608 wrote to memory of 1308 608 abert.exe Explorer.EXE PID 608 wrote to memory of 1308 608 abert.exe Explorer.EXE PID 608 wrote to memory of 1308 608 abert.exe Explorer.EXE PID 608 wrote to memory of 1308 608 abert.exe Explorer.EXE PID 608 wrote to memory of 1140 608 abert.exe zeus 2_2.0.9.9.vir.exe PID 608 wrote to memory of 1140 608 abert.exe zeus 2_2.0.9.9.vir.exe PID 608 wrote to memory of 1140 608 abert.exe zeus 2_2.0.9.9.vir.exe PID 608 wrote to memory of 1140 608 abert.exe zeus 2_2.0.9.9.vir.exe PID 608 wrote to memory of 1140 608 abert.exe zeus 2_2.0.9.9.vir.exe PID 1140 wrote to memory of 1876 1140 zeus 2_2.0.9.9.vir.exe cmd.exe PID 1140 wrote to memory of 1876 1140 zeus 2_2.0.9.9.vir.exe cmd.exe PID 1140 wrote to memory of 1876 1140 zeus 2_2.0.9.9.vir.exe cmd.exe PID 1140 wrote to memory of 1876 1140 zeus 2_2.0.9.9.vir.exe cmd.exe PID 1140 wrote to memory of 1876 1140 zeus 2_2.0.9.9.vir.exe cmd.exe PID 1140 wrote to memory of 1876 1140 zeus 2_2.0.9.9.vir.exe cmd.exe PID 1140 wrote to memory of 1876 1140 zeus 2_2.0.9.9.vir.exe cmd.exe PID 1140 wrote to memory of 1876 1140 zeus 2_2.0.9.9.vir.exe cmd.exe PID 1140 wrote to memory of 1876 1140 zeus 2_2.0.9.9.vir.exe cmd.exe PID 608 wrote to memory of 2036 608 abert.exe DllHost.exe PID 608 wrote to memory of 2036 608 abert.exe DllHost.exe PID 608 wrote to memory of 2036 608 abert.exe DllHost.exe PID 608 wrote to memory of 2036 608 abert.exe DllHost.exe PID 608 wrote to memory of 2036 608 abert.exe DllHost.exe PID 608 wrote to memory of 2032 608 abert.exe DllHost.exe PID 608 wrote to memory of 2032 608 abert.exe DllHost.exe PID 608 wrote to memory of 2032 608 abert.exe DllHost.exe PID 608 wrote to memory of 2032 608 abert.exe DllHost.exe PID 608 wrote to memory of 2032 608 abert.exe DllHost.exe PID 608 wrote to memory of 1240 608 abert.exe DllHost.exe PID 608 wrote to memory of 1240 608 abert.exe DllHost.exe PID 608 wrote to memory of 1240 608 abert.exe DllHost.exe PID 608 wrote to memory of 1240 608 abert.exe DllHost.exe PID 608 wrote to memory of 1240 608 abert.exe DllHost.exe -
Executes dropped EXE 1 IoCs
Processes:
abert.exepid process 608 abert.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
WinMail.exepid process 1436 WinMail.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
WinMail.exepid process 1436 WinMail.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
zeus 2_2.0.9.9.vir.exedescription pid process target process PID 1140 set thread context of 1876 1140 zeus 2_2.0.9.9.vir.exe cmd.exe -
Processes:
zeus 2_2.0.9.9.vir.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" zeus 2_2.0.9.9.vir.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy zeus 2_2.0.9.9.vir.exe -
NTFS ADS 1 IoCs
Processes:
WinMail.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\58B342DD-00000001.eml:OECustomProperty WinMail.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
zeus 2_2.0.9.9.vir.exeWinMail.exedescription pid process Token: SeSecurityPrivilege 1140 zeus 2_2.0.9.9.vir.exe Token: SeSecurityPrivilege 1140 zeus 2_2.0.9.9.vir.exe Token: SeSecurityPrivilege 1140 zeus 2_2.0.9.9.vir.exe Token: SeManageVolumePrivilege 1436 WinMail.exe -
Loads dropped DLL 2 IoCs
Processes:
zeus 2_2.0.9.9.vir.exepid process 1140 zeus 2_2.0.9.9.vir.exe 1140 zeus 2_2.0.9.9.vir.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.9.9.vir.exe"C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.9.9.vir.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Xemue\abert.exe"C:\Users\Admin\AppData\Roaming\Xemue\abert.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpa753a2ae.bat"3⤵
- Deletes itself
-
C:\Program Files\Windows Mail\WinMail.exe"C:\Program Files\Windows Mail\WinMail.exe" -Embedding1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpa753a2ae.bat
-
C:\Users\Admin\AppData\Roaming\Ogdoo\geuwo.abn
-
C:\Users\Admin\AppData\Roaming\Xemue\abert.exe
-
C:\Users\Admin\AppData\Roaming\Xemue\abert.exe
-
\Users\Admin\AppData\Roaming\Xemue\abert.exe
-
\Users\Admin\AppData\Roaming\Xemue\abert.exe
-
memory/608-2-0x0000000000000000-mapping.dmp
-
memory/1436-5-0x00000000038A0000-0x00000000039A0000-memory.dmpFilesize
1024KB
-
memory/1436-7-0x00000000038A0000-0x0000000003AA0000-memory.dmpFilesize
2.0MB
-
memory/1436-9-0x00000000038A0000-0x00000000039A0000-memory.dmpFilesize
1024KB
-
memory/1436-10-0x00000000038A0000-0x0000000003AA0000-memory.dmpFilesize
2.0MB
-
memory/1436-11-0x00000000039A0000-0x0000000003AA0000-memory.dmpFilesize
1024KB
-
memory/1436-15-0x0000000003AD0000-0x0000000003AD2000-memory.dmpFilesize
8KB
-
memory/1436-16-0x0000000003AE0000-0x0000000003AE2000-memory.dmpFilesize
8KB
-
memory/1436-17-0x0000000003AF0000-0x0000000003AF2000-memory.dmpFilesize
8KB
-
memory/1436-18-0x0000000003AE0000-0x0000000003AE2000-memory.dmpFilesize
8KB
-
memory/1436-19-0x0000000003E20000-0x0000000003E22000-memory.dmpFilesize
8KB
-
memory/1436-20-0x0000000003EE0000-0x0000000003EE2000-memory.dmpFilesize
8KB
-
memory/1436-21-0x0000000003ED0000-0x0000000003ED2000-memory.dmpFilesize
8KB
-
memory/1436-22-0x0000000003AE0000-0x0000000003AE2000-memory.dmpFilesize
8KB
-
memory/1436-23-0x0000000003AE0000-0x0000000003AE2000-memory.dmpFilesize
8KB
-
memory/1436-24-0x0000000003ED0000-0x0000000003ED2000-memory.dmpFilesize
8KB
-
memory/1436-25-0x0000000003B40000-0x0000000003B42000-memory.dmpFilesize
8KB
-
memory/1436-26-0x0000000003EE0000-0x0000000003EE2000-memory.dmpFilesize
8KB
-
memory/1436-27-0x0000000003EB0000-0x0000000003EB2000-memory.dmpFilesize
8KB
-
memory/1436-28-0x0000000003F50000-0x0000000003F52000-memory.dmpFilesize
8KB
-
memory/1436-29-0x0000000003E20000-0x0000000003E22000-memory.dmpFilesize
8KB
-
memory/1436-30-0x0000000003EC0000-0x0000000003EC2000-memory.dmpFilesize
8KB
-
memory/1436-31-0x0000000003F10000-0x0000000003F12000-memory.dmpFilesize
8KB
-
memory/1436-32-0x0000000003ED0000-0x0000000003ED2000-memory.dmpFilesize
8KB
-
memory/1436-33-0x0000000004390000-0x0000000004392000-memory.dmpFilesize
8KB
-
memory/1436-34-0x0000000004420000-0x0000000004422000-memory.dmpFilesize
8KB
-
memory/1436-35-0x0000000004430000-0x0000000004432000-memory.dmpFilesize
8KB
-
memory/1436-36-0x0000000004450000-0x0000000004452000-memory.dmpFilesize
8KB
-
memory/1436-37-0x0000000004580000-0x0000000004582000-memory.dmpFilesize
8KB
-
memory/1436-38-0x0000000004590000-0x0000000004592000-memory.dmpFilesize
8KB
-
memory/1436-39-0x00000000045A0000-0x00000000045A2000-memory.dmpFilesize
8KB
-
memory/1436-40-0x00000000046B0000-0x00000000046B2000-memory.dmpFilesize
8KB
-
memory/1436-41-0x0000000004740000-0x0000000004742000-memory.dmpFilesize
8KB
-
memory/1436-42-0x0000000004930000-0x0000000004932000-memory.dmpFilesize
8KB
-
memory/1436-43-0x0000000004940000-0x0000000004942000-memory.dmpFilesize
8KB
-
memory/1436-44-0x0000000004950000-0x0000000004952000-memory.dmpFilesize
8KB
-
memory/1436-45-0x0000000004960000-0x0000000004962000-memory.dmpFilesize
8KB
-
memory/1436-46-0x0000000003DF0000-0x0000000003DF2000-memory.dmpFilesize
8KB
-
memory/1436-47-0x0000000003DE0000-0x0000000003DE2000-memory.dmpFilesize
8KB
-
memory/1436-48-0x0000000003DD0000-0x0000000003DD2000-memory.dmpFilesize
8KB
-
memory/1436-49-0x0000000003DC0000-0x0000000003DC2000-memory.dmpFilesize
8KB
-
memory/1436-50-0x0000000003DB0000-0x0000000003DB2000-memory.dmpFilesize
8KB
-
memory/1436-51-0x0000000003D70000-0x0000000003D72000-memory.dmpFilesize
8KB
-
memory/1436-52-0x0000000003CB0000-0x0000000003CB2000-memory.dmpFilesize
8KB
-
memory/1436-53-0x00000000038A0000-0x00000000039A0000-memory.dmpFilesize
1024KB
-
memory/1436-55-0x0000000002150000-0x0000000002160000-memory.dmpFilesize
64KB
-
memory/1436-61-0x0000000001F90000-0x0000000001FA0000-memory.dmpFilesize
64KB
-
memory/1876-67-0x0000000000050000-0x0000000000077000-memory.dmpFilesize
156KB
-
memory/1876-69-0x000000000006BE55-mapping.dmp