9c01cf666c922c17867f4d2a85d090376c6f82e2c77b16de330d116f147fca59 | Triage

Analysis

max time kernel
62s
max time network
138s
platform
windows7_x64
resource
win7
submitted
19-07-2020 19:41

Sharing

Report Analysis Logs

General

Target

zeus 1_1.2.3.1.vir.exe
Size

532KB
MD5

0797dda9930e3b0a7345984d4fbb9509
SHA1

6c21660acf1c1af1eae98aececa607bed5305fe0
SHA256

9c01cf666c922c17867f4d2a85d090376c6f82e2c77b16de330d116f147fca59
SHA512

b12cede9810d8176706ae9f089176d16bfaadad3e5b01087629cc3d1f3374a72b7bb12cae12cf909d5ea892eab41e16ed95d3351f07ed3acfde8de30318caada

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1108 1104 WerFault.exe zeus 1_1.2.3.1.vir.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

zeus 1_1.2.3.1.vir.exe

description	pid	process	target process
PID 1104 wrote to memory of 1108	1104	zeus 1_1.2.3.1.vir.exe	WerFault.exe
PID 1104 wrote to memory of 1108	1104	zeus 1_1.2.3.1.vir.exe	WerFault.exe
PID 1104 wrote to memory of 1108	1104	zeus 1_1.2.3.1.vir.exe	WerFault.exe
PID 1104 wrote to memory of 1108	1104	zeus 1_1.2.3.1.vir.exe	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1108 WerFault.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1108 WerFault.exe
1108 WerFault.exe
1108 WerFault.exe
1108 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\zeus 1_1.2.3.1.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zeus 1_1.2.3.1.vir.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 96
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1108-0-0x0000000000000000-mapping.dmp

Download
memory/1108-1-0x0000000002120000-0x0000000002131000-memory.dmp

Filesize
68KB

Download
memory/1108-2-0x0000000002580000-0x0000000002591000-memory.dmp

Filesize
68KB

Download