Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows7_x64 -
resource
win7 -
submitted
19-07-2020 17:36
Static task
static1
Behavioral task
behavioral1
Sample
vmzeus_3.3.1.0.vir.exe
Resource
win7
Behavioral task
behavioral2
Sample
vmzeus_3.3.1.0.vir.exe
Resource
win10v200430
General
-
Target
vmzeus_3.3.1.0.vir.exe
-
Size
300KB
-
MD5
c780cfbc40a338933120ec9efd6d6a0a
-
SHA1
63025be073538fbe61af35e70ae22918bfc172e5
-
SHA256
05fe1601534d962e745acf8c0c577a2dbf87be8e62ea6672be043605d5906716
-
SHA512
c35f2cd5be20fa9f82e24cb852d0d10a63df4e5f4aad09456c5fe28b5f5bde432939b1b998201c8bbfbe36d40fe42da2a25517bdc4716eca782a3887d2ec7d4b
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1904 cmd.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
XpersMediaCenterPrograms.exepid process 1880 XpersMediaCenterPrograms.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
XpersMediaCenterPrograms.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\Currentversion\Run XpersMediaCenterPrograms.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\{25D9E82A-3E97-E769-97E7-E0C19E6FAF62} XpersMediaCenterPrograms.exe -
Executes dropped EXE 2 IoCs
Processes:
XpersMediaCenterPrograms.exeXpersMediaCenterPrograms.exepid process 1844 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
vmzeus_3.3.1.0.vir.exevmzeus_3.3.1.0.vir.exeXpersMediaCenterPrograms.exedescription pid process target process PID 1768 wrote to memory of 1756 1768 vmzeus_3.3.1.0.vir.exe vmzeus_3.3.1.0.vir.exe PID 1768 wrote to memory of 1756 1768 vmzeus_3.3.1.0.vir.exe vmzeus_3.3.1.0.vir.exe PID 1768 wrote to memory of 1756 1768 vmzeus_3.3.1.0.vir.exe vmzeus_3.3.1.0.vir.exe PID 1768 wrote to memory of 1756 1768 vmzeus_3.3.1.0.vir.exe vmzeus_3.3.1.0.vir.exe PID 1768 wrote to memory of 1756 1768 vmzeus_3.3.1.0.vir.exe vmzeus_3.3.1.0.vir.exe PID 1768 wrote to memory of 1756 1768 vmzeus_3.3.1.0.vir.exe vmzeus_3.3.1.0.vir.exe PID 1768 wrote to memory of 1756 1768 vmzeus_3.3.1.0.vir.exe vmzeus_3.3.1.0.vir.exe PID 1768 wrote to memory of 1756 1768 vmzeus_3.3.1.0.vir.exe vmzeus_3.3.1.0.vir.exe PID 1768 wrote to memory of 1756 1768 vmzeus_3.3.1.0.vir.exe vmzeus_3.3.1.0.vir.exe PID 1756 wrote to memory of 1844 1756 vmzeus_3.3.1.0.vir.exe XpersMediaCenterPrograms.exe PID 1756 wrote to memory of 1844 1756 vmzeus_3.3.1.0.vir.exe XpersMediaCenterPrograms.exe PID 1756 wrote to memory of 1844 1756 vmzeus_3.3.1.0.vir.exe XpersMediaCenterPrograms.exe PID 1756 wrote to memory of 1844 1756 vmzeus_3.3.1.0.vir.exe XpersMediaCenterPrograms.exe PID 1844 wrote to memory of 1880 1844 XpersMediaCenterPrograms.exe XpersMediaCenterPrograms.exe PID 1844 wrote to memory of 1880 1844 XpersMediaCenterPrograms.exe XpersMediaCenterPrograms.exe PID 1844 wrote to memory of 1880 1844 XpersMediaCenterPrograms.exe XpersMediaCenterPrograms.exe PID 1844 wrote to memory of 1880 1844 XpersMediaCenterPrograms.exe XpersMediaCenterPrograms.exe PID 1844 wrote to memory of 1880 1844 XpersMediaCenterPrograms.exe XpersMediaCenterPrograms.exe PID 1844 wrote to memory of 1880 1844 XpersMediaCenterPrograms.exe XpersMediaCenterPrograms.exe PID 1844 wrote to memory of 1880 1844 XpersMediaCenterPrograms.exe XpersMediaCenterPrograms.exe PID 1844 wrote to memory of 1880 1844 XpersMediaCenterPrograms.exe XpersMediaCenterPrograms.exe PID 1844 wrote to memory of 1880 1844 XpersMediaCenterPrograms.exe XpersMediaCenterPrograms.exe PID 1756 wrote to memory of 1904 1756 vmzeus_3.3.1.0.vir.exe cmd.exe PID 1756 wrote to memory of 1904 1756 vmzeus_3.3.1.0.vir.exe cmd.exe PID 1756 wrote to memory of 1904 1756 vmzeus_3.3.1.0.vir.exe cmd.exe PID 1756 wrote to memory of 1904 1756 vmzeus_3.3.1.0.vir.exe cmd.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
vmzeus_3.3.1.0.vir.exeXpersMediaCenterPrograms.exedescription pid process target process PID 1768 set thread context of 1756 1768 vmzeus_3.3.1.0.vir.exe vmzeus_3.3.1.0.vir.exe PID 1844 set thread context of 1880 1844 XpersMediaCenterPrograms.exe XpersMediaCenterPrograms.exe -
Loads dropped DLL 2 IoCs
Processes:
vmzeus_3.3.1.0.vir.exepid process 1756 vmzeus_3.3.1.0.vir.exe 1756 vmzeus_3.3.1.0.vir.exe -
Suspicious behavior: EnumeratesProcesses 56 IoCs
Processes:
XpersMediaCenterPrograms.exepid process 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe 1880 XpersMediaCenterPrograms.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
vmzeus_3.3.1.0.vir.exeXpersMediaCenterPrograms.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\WINE vmzeus_3.3.1.0.vir.exe Key opened \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\WINE XpersMediaCenterPrograms.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
vmzeus_3.3.1.0.vir.exeXpersMediaCenterPrograms.exepid process 1768 vmzeus_3.3.1.0.vir.exe 1844 XpersMediaCenterPrograms.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\vmzeus_3.3.1.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\vmzeus_3.3.1.0.vir.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\vmzeus_3.3.1.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\vmzeus_3.3.1.0.vir.exe"2⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Identifies Wine through registry keys
-
C:\Users\Admin\AppData\Roaming\Media Center Programs\XpersMediaCenterPrograms.exe"C:\Users\Admin\AppData\Roaming\Media Center Programs\XpersMediaCenterPrograms.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Media Center Programs\XpersMediaCenterPrograms.exe"C:\Users\Admin\AppData\Roaming\Media Center Programs\XpersMediaCenterPrograms.exe"4⤵
- Suspicious use of FindShellTrayWindow
- Adds Run key to start application
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Identifies Wine through registry keys
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp80af592c.bat"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp80af592c.bat
-
C:\Users\Admin\AppData\Roaming\Media Center Programs\XpersMediaCenterPrograms.exe
-
C:\Users\Admin\AppData\Roaming\Media Center Programs\XpersMediaCenterPrograms.exe
-
C:\Users\Admin\AppData\Roaming\Media Center Programs\XpersMediaCenterPrograms.exe
-
\Users\Admin\AppData\Roaming\Media Center Programs\XpersMediaCenterPrograms.exe
-
\Users\Admin\AppData\Roaming\Media Center Programs\XpersMediaCenterPrograms.exe
-
memory/1756-2-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB
-
memory/1756-4-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB
-
memory/1756-3-0x00000000004116D7-mapping.dmp
-
memory/1844-7-0x0000000000000000-mapping.dmp
-
memory/1844-11-0x0000000000297000-0x0000000000298000-memory.dmpFilesize
4KB
-
memory/1880-14-0x00000000004116D7-mapping.dmp
-
memory/1904-17-0x0000000000000000-mapping.dmp