Overview

overview

8

Static

static

zeusaes_2....ir.exe

windows7_x64

8

zeusaes_2....ir.exe

windows10_x64

7

Analysis

  • max time kernel
    151s
  • max time network
    57s
  • platform
    windows7_x64
  • resource
    win7v200430
  • submitted
    19-07-2020 16:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    zeusaes_2.9.5.1.vir.exe

  • Size

    359KB

  • MD5

    1f0d255ad2996e3f4b5ea1202568ec67

  • SHA1

    6092541a5fc6941ae98acc64024ee7e9fbb96a57

  • SHA256

    afe57674c53de398de18be61175e7cf55447e9c57cd3b4c82b035a9d65ec86f3

  • SHA512

    aa027325045f63f59e097b4b91e455475a57f5ad1fcced767b2628764cee9a00869cfca4a23225fddc62f2850ddd59209c86fe9d2a560eafd5fb58660d5bc605

Score
8/10
bootkitpersistence

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Loads dropped DLL 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\zeusaes_2.9.5.1.vir.exe
    "C:\Users\Admin\AppData\Local\Temp\zeusaes_2.9.5.1.vir.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • Loads dropped DLL
    PID:1400
    • C:\Users\Admin\AppData\Roaming\Qalufu\umfea.exe
      "C:\Users\Admin\AppData\Roaming\Qalufu\umfea.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Writes to the Master Boot Record (MBR)
      • Modifies registry class
      • Executes dropped EXE
      • Adds Run key to start application
      • Loads dropped DLL
      • Suspicious use of FindShellTrayWindow
      • Suspicious behavior: MapViewOfSection
      PID:240
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp6b3045e4.bat"
      2⤵
      • Deletes itself
      PID:1356

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1
T1067

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp6b3045e4.bat
    Download Submit
  • C:\Users\Admin\AppData\Roaming\Qalufu\umfea.exe
    Download Submit
  • C:\Users\Admin\AppData\Roaming\Qalufu\umfea.exe
    Download Submit
  • \Users\Admin\AppData\Local\Temp\libnspr4.dll
    Download Submit
  • \Users\Admin\AppData\Roaming\Qalufu\libnspr4.dll
    Download Submit
  • \Users\Admin\AppData\Roaming\Qalufu\umfea.exe
    Download Submit
  • \Users\Admin\AppData\Roaming\Qalufu\umfea.exe
    Download Submit
  • memory/240-3-0x0000000000000000-mapping.dmp
    Download
  • memory/240-31-0x00000000047E0000-0x0000000004806000-memory.dmp
    Filesize

    152KB

    Download
  • memory/240-33-0x00000000047E0000-0x0000000004806000-memory.dmp
    Filesize

    152KB

    Download
  • memory/240-36-0x00000000047E0000-0x0000000004806000-memory.dmp
    Filesize

    152KB

    Download
  • memory/240-39-0x00000000047E0000-0x0000000004806000-memory.dmp
    Filesize

    152KB

    Download
  • memory/240-68-0x00000000047E0000-0x0000000004806000-memory.dmp
    Filesize

    152KB

    Download
  • memory/1356-8-0x0000000000000000-mapping.dmp
    Download