Analysis
-
max time kernel
152s -
max time network
135s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
19-07-2020 17:20
Static task
static1
Behavioral task
behavioral1
Sample
zeus 2_2.1.0.4.vir.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
zeus 2_2.1.0.4.vir.exe
Resource
win10
General
-
Target
zeus 2_2.1.0.4.vir.exe
-
Size
208KB
-
MD5
1e72e82d0e512917ca34b3fd04f5ff67
-
SHA1
5fb5d35a75bb08e7e435aa3f0929108aa01aab63
-
SHA256
8ae8e3bb7106e318c4ab4f6dd0cbe79a63485531a91b4e86e15fec556ccf8e60
-
SHA512
faa558c475194402211c2eb8b91427f028309ceb9a0e7114cf2cd460727f3760a392655f28ba8a743a04fa893bd26231cb045029ae750453ff84e8e6ca93b48e
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
ehod.exepid process 308 ehod.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WinMail.exeWinMail.exepid process 764 WinMail.exe 1032 WinMail.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
WinMail.exeWinMail.exepid process 764 WinMail.exe 1032 WinMail.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
zeus 2_2.1.0.4.vir.exedescription pid process target process PID 1520 set thread context of 332 1520 zeus 2_2.1.0.4.vir.exe cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
ehod.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\Currentversion\Run ehod.exe Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\{6775E6B9-D437-97F1-CE28-8390A8310B57} = "C:\\Users\\Admin\\AppData\\Roaming\\Kuyx\\ehod.exe" ehod.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
zeus 2_2.1.0.4.vir.exeWinMail.execmd.exeWinMail.exedescription pid process Token: SeSecurityPrivilege 1520 zeus 2_2.1.0.4.vir.exe Token: SeSecurityPrivilege 1520 zeus 2_2.1.0.4.vir.exe Token: SeSecurityPrivilege 1520 zeus 2_2.1.0.4.vir.exe Token: SeManageVolumePrivilege 764 WinMail.exe Token: SeSecurityPrivilege 332 cmd.exe Token: SeManageVolumePrivilege 1032 WinMail.exe -
Loads dropped DLL 2 IoCs
Processes:
zeus 2_2.1.0.4.vir.exepid process 1520 zeus 2_2.1.0.4.vir.exe 1520 zeus 2_2.1.0.4.vir.exe -
Suspicious use of WriteProcessMemory 58 IoCs
Processes:
zeus 2_2.1.0.4.vir.exeehod.exedescription pid process target process PID 1520 wrote to memory of 308 1520 zeus 2_2.1.0.4.vir.exe ehod.exe PID 1520 wrote to memory of 308 1520 zeus 2_2.1.0.4.vir.exe ehod.exe PID 1520 wrote to memory of 308 1520 zeus 2_2.1.0.4.vir.exe ehod.exe PID 1520 wrote to memory of 308 1520 zeus 2_2.1.0.4.vir.exe ehod.exe PID 308 wrote to memory of 1092 308 ehod.exe taskhost.exe PID 308 wrote to memory of 1092 308 ehod.exe taskhost.exe PID 308 wrote to memory of 1092 308 ehod.exe taskhost.exe PID 308 wrote to memory of 1092 308 ehod.exe taskhost.exe PID 308 wrote to memory of 1092 308 ehod.exe taskhost.exe PID 308 wrote to memory of 1184 308 ehod.exe Dwm.exe PID 308 wrote to memory of 1184 308 ehod.exe Dwm.exe PID 308 wrote to memory of 1184 308 ehod.exe Dwm.exe PID 308 wrote to memory of 1184 308 ehod.exe Dwm.exe PID 308 wrote to memory of 1184 308 ehod.exe Dwm.exe PID 308 wrote to memory of 1236 308 ehod.exe Explorer.EXE PID 308 wrote to memory of 1236 308 ehod.exe Explorer.EXE PID 308 wrote to memory of 1236 308 ehod.exe Explorer.EXE PID 308 wrote to memory of 1236 308 ehod.exe Explorer.EXE PID 308 wrote to memory of 1236 308 ehod.exe Explorer.EXE PID 308 wrote to memory of 1520 308 ehod.exe zeus 2_2.1.0.4.vir.exe PID 308 wrote to memory of 1520 308 ehod.exe zeus 2_2.1.0.4.vir.exe PID 308 wrote to memory of 1520 308 ehod.exe zeus 2_2.1.0.4.vir.exe PID 308 wrote to memory of 1520 308 ehod.exe zeus 2_2.1.0.4.vir.exe PID 308 wrote to memory of 1520 308 ehod.exe zeus 2_2.1.0.4.vir.exe PID 308 wrote to memory of 764 308 ehod.exe WinMail.exe PID 308 wrote to memory of 764 308 ehod.exe WinMail.exe PID 308 wrote to memory of 764 308 ehod.exe WinMail.exe PID 308 wrote to memory of 764 308 ehod.exe WinMail.exe PID 308 wrote to memory of 764 308 ehod.exe WinMail.exe PID 1520 wrote to memory of 332 1520 zeus 2_2.1.0.4.vir.exe cmd.exe PID 1520 wrote to memory of 332 1520 zeus 2_2.1.0.4.vir.exe cmd.exe PID 1520 wrote to memory of 332 1520 zeus 2_2.1.0.4.vir.exe cmd.exe PID 1520 wrote to memory of 332 1520 zeus 2_2.1.0.4.vir.exe cmd.exe PID 1520 wrote to memory of 332 1520 zeus 2_2.1.0.4.vir.exe cmd.exe PID 1520 wrote to memory of 332 1520 zeus 2_2.1.0.4.vir.exe cmd.exe PID 1520 wrote to memory of 332 1520 zeus 2_2.1.0.4.vir.exe cmd.exe PID 1520 wrote to memory of 332 1520 zeus 2_2.1.0.4.vir.exe cmd.exe PID 1520 wrote to memory of 332 1520 zeus 2_2.1.0.4.vir.exe cmd.exe PID 308 wrote to memory of 784 308 ehod.exe DllHost.exe PID 308 wrote to memory of 784 308 ehod.exe DllHost.exe PID 308 wrote to memory of 784 308 ehod.exe DllHost.exe PID 308 wrote to memory of 784 308 ehod.exe DllHost.exe PID 308 wrote to memory of 784 308 ehod.exe DllHost.exe PID 308 wrote to memory of 836 308 ehod.exe DllHost.exe PID 308 wrote to memory of 836 308 ehod.exe DllHost.exe PID 308 wrote to memory of 836 308 ehod.exe DllHost.exe PID 308 wrote to memory of 836 308 ehod.exe DllHost.exe PID 308 wrote to memory of 836 308 ehod.exe DllHost.exe PID 308 wrote to memory of 1980 308 ehod.exe DllHost.exe PID 308 wrote to memory of 1980 308 ehod.exe DllHost.exe PID 308 wrote to memory of 1980 308 ehod.exe DllHost.exe PID 308 wrote to memory of 1980 308 ehod.exe DllHost.exe PID 308 wrote to memory of 1980 308 ehod.exe DllHost.exe PID 308 wrote to memory of 1536 308 ehod.exe DllHost.exe PID 308 wrote to memory of 1536 308 ehod.exe DllHost.exe PID 308 wrote to memory of 1536 308 ehod.exe DllHost.exe PID 308 wrote to memory of 1536 308 ehod.exe DllHost.exe PID 308 wrote to memory of 1536 308 ehod.exe DllHost.exe -
Processes:
zeus 2_2.1.0.4.vir.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Privacy zeus 2_2.1.0.4.vir.exe Set value (int) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" zeus 2_2.1.0.4.vir.exe -
NTFS ADS 1 IoCs
Processes:
WinMail.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\433513B6-00000001.eml:OECustomProperty WinMail.exe -
Suspicious behavior: EnumeratesProcesses 33 IoCs
Processes:
ehod.exepid process 308 ehod.exe 308 ehod.exe 308 ehod.exe 308 ehod.exe 308 ehod.exe 308 ehod.exe 308 ehod.exe 308 ehod.exe 308 ehod.exe 308 ehod.exe 308 ehod.exe 308 ehod.exe 308 ehod.exe 308 ehod.exe 308 ehod.exe 308 ehod.exe 308 ehod.exe 308 ehod.exe 308 ehod.exe 308 ehod.exe 308 ehod.exe 308 ehod.exe 308 ehod.exe 308 ehod.exe 308 ehod.exe 308 ehod.exe 308 ehod.exe 308 ehod.exe 308 ehod.exe 308 ehod.exe 308 ehod.exe 308 ehod.exe 308 ehod.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
WinMail.exeWinMail.exepid process 764 WinMail.exe 1032 WinMail.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 332 cmd.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\zeus 2_2.1.0.4.vir.exe"C:\Users\Admin\AppData\Local\Temp\zeus 2_2.1.0.4.vir.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
- Modifies Internet Explorer settings
-
C:\Users\Admin\AppData\Roaming\Kuyx\ehod.exe"C:\Users\Admin\AppData\Roaming\Kuyx\ehod.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpba6e61bc.bat"3⤵
- Suspicious use of AdjustPrivilegeToken
- Deletes itself
-
C:\Program Files\Windows Mail\WinMail.exe"C:\Program Files\Windows Mail\WinMail.exe" -Embedding1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of SendNotifyMessage
- Suspicious use of AdjustPrivilegeToken
- NTFS ADS
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\Windows Mail\WinMail.exe"C:\Program Files\Windows Mail\WinMail.exe" -Embedding1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of SendNotifyMessage
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E6024EAC88E6B6165D49FE3C95ADD735
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E6024EAC88E6B6165D49FE3C95ADD735
-
C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\WindowsMail.MSMessageStore
-
C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\edb.chk
-
C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\edb.log
-
C:\Users\Admin\AppData\Local\Temp\tmpba6e61bc.bat
-
C:\Users\Admin\AppData\Roaming\Iqqyy\ugxig.ere
-
C:\Users\Admin\AppData\Roaming\Kuyx\ehod.exe
-
C:\Users\Admin\AppData\Roaming\Kuyx\ehod.exe
-
\Users\Admin\AppData\Roaming\Kuyx\ehod.exe
-
\Users\Admin\AppData\Roaming\Kuyx\ehod.exe
-
memory/308-2-0x0000000000000000-mapping.dmp
-
memory/332-30-0x00000000000592E0-mapping.dmp
-
memory/332-28-0x0000000000050000-0x0000000000077000-memory.dmpFilesize
156KB
-
memory/764-40-0x0000000004950000-0x0000000004952000-memory.dmpFilesize
8KB
-
memory/764-48-0x0000000005680000-0x0000000005682000-memory.dmpFilesize
8KB
-
memory/764-19-0x00000000024D0000-0x00000000024D2000-memory.dmpFilesize
8KB
-
memory/764-20-0x0000000003E50000-0x0000000003E52000-memory.dmpFilesize
8KB
-
memory/764-21-0x0000000003E70000-0x0000000003E72000-memory.dmpFilesize
8KB
-
memory/764-22-0x0000000003E60000-0x0000000003E62000-memory.dmpFilesize
8KB
-
memory/764-23-0x0000000004000000-0x0000000004002000-memory.dmpFilesize
8KB
-
memory/764-24-0x0000000003E50000-0x0000000003E52000-memory.dmpFilesize
8KB
-
memory/764-31-0x0000000004040000-0x0000000004042000-memory.dmpFilesize
8KB
-
memory/764-32-0x00000000024E0000-0x00000000024E2000-memory.dmpFilesize
8KB
-
memory/764-33-0x00000000024D0000-0x00000000024D2000-memory.dmpFilesize
8KB
-
memory/764-34-0x0000000003E80000-0x0000000003E82000-memory.dmpFilesize
8KB
-
memory/764-35-0x0000000003E70000-0x0000000003E72000-memory.dmpFilesize
8KB
-
memory/764-36-0x0000000003FE0000-0x0000000003FE2000-memory.dmpFilesize
8KB
-
memory/764-37-0x0000000004890000-0x0000000004892000-memory.dmpFilesize
8KB
-
memory/764-38-0x0000000004920000-0x0000000004922000-memory.dmpFilesize
8KB
-
memory/764-39-0x0000000004930000-0x0000000004932000-memory.dmpFilesize
8KB
-
memory/764-17-0x00000000024E0000-0x00000000024E2000-memory.dmpFilesize
8KB
-
memory/764-41-0x00000000049F0000-0x00000000049F2000-memory.dmpFilesize
8KB
-
memory/764-42-0x0000000004A00000-0x0000000004A02000-memory.dmpFilesize
8KB
-
memory/764-43-0x0000000004B20000-0x0000000004B22000-memory.dmpFilesize
8KB
-
memory/764-44-0x0000000004B30000-0x0000000004B32000-memory.dmpFilesize
8KB
-
memory/764-45-0x0000000004B40000-0x0000000004B42000-memory.dmpFilesize
8KB
-
memory/764-46-0x0000000004BB0000-0x0000000004BB2000-memory.dmpFilesize
8KB
-
memory/764-47-0x0000000004CC0000-0x0000000004CC2000-memory.dmpFilesize
8KB
-
memory/764-18-0x0000000003FC0000-0x0000000003FC2000-memory.dmpFilesize
8KB
-
memory/764-49-0x0000000005690000-0x0000000005692000-memory.dmpFilesize
8KB
-
memory/764-50-0x0000000003B60000-0x0000000003B62000-memory.dmpFilesize
8KB
-
memory/764-51-0x0000000003E40000-0x0000000003E42000-memory.dmpFilesize
8KB
-
memory/764-52-0x0000000004980000-0x0000000004982000-memory.dmpFilesize
8KB
-
memory/764-53-0x0000000004990000-0x0000000004992000-memory.dmpFilesize
8KB
-
memory/764-54-0x00000000049A0000-0x00000000049A2000-memory.dmpFilesize
8KB
-
memory/764-55-0x00000000049B0000-0x00000000049B2000-memory.dmpFilesize
8KB
-
memory/764-56-0x00000000049C0000-0x00000000049C2000-memory.dmpFilesize
8KB
-
memory/764-57-0x0000000003910000-0x0000000003A10000-memory.dmpFilesize
1024KB
-
memory/764-59-0x0000000002120000-0x0000000002130000-memory.dmpFilesize
64KB
-
memory/764-65-0x00000000020C0000-0x00000000020D0000-memory.dmpFilesize
64KB
-
memory/764-16-0x00000000024F0000-0x00000000024F2000-memory.dmpFilesize
8KB
-
memory/764-15-0x00000000024D0000-0x00000000024D2000-memory.dmpFilesize
8KB
-
memory/764-11-0x0000000003A10000-0x0000000003B10000-memory.dmpFilesize
1024KB
-
memory/764-5-0x0000000003910000-0x0000000003A10000-memory.dmpFilesize
1024KB
-
memory/764-7-0x0000000003910000-0x0000000003B10000-memory.dmpFilesize
2.0MB
-
memory/764-9-0x0000000003910000-0x0000000003A10000-memory.dmpFilesize
1024KB
-
memory/764-10-0x0000000003910000-0x0000000003B10000-memory.dmpFilesize
2.0MB
-
memory/1032-87-0x0000000003DC0000-0x0000000003DC2000-memory.dmpFilesize
8KB
-
memory/1032-80-0x0000000003A10000-0x0000000003B10000-memory.dmpFilesize
1024KB
-
memory/1032-79-0x0000000003910000-0x0000000003B10000-memory.dmpFilesize
2.0MB
-
memory/1032-91-0x0000000003BF0000-0x0000000003BF2000-memory.dmpFilesize
8KB
-
memory/1032-92-0x0000000003910000-0x0000000003B10000-memory.dmpFilesize
2.0MB
-
memory/1032-93-0x0000000003A10000-0x0000000003B10000-memory.dmpFilesize
1024KB
-
memory/1032-78-0x0000000003910000-0x0000000003A10000-memory.dmpFilesize
1024KB