Analysis
-
max time kernel
151s -
max time network
120s -
platform
windows7_x64 -
resource
win7 -
submitted
19-07-2020 17:19
Static task
static1
Behavioral task
behavioral1
Sample
vmzeus_3.3.6.0.vir.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
vmzeus_3.3.6.0.vir.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
vmzeus_3.3.6.0.vir.exe
-
Size
277KB
-
MD5
ec3bc944c4c8844d63acdba9e36e67c9
-
SHA1
01a74db6a1c8d2064de42c73555d2a3644dc369a
-
SHA256
bf63837b5da7be5191e1c0b79a827ce8649971297f355845ae968cc44c7d9162
-
SHA512
7fb8b88ad47525b284aa005a1b3045c89fd424eece83b599d4271ebc2499cae5a32e642df04427548ea9e33183b2829c04d6e1a3fc287aff6ac9d6d96648e660
Score
8/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 808 cmd.exe -
Suspicious behavior: EnumeratesProcesses 58 IoCs
Processes:
xpersIdentities.exepid process 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe 1408 xpersIdentities.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
vmzeus_3.3.6.0.vir.exexpersIdentities.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\WINE vmzeus_3.3.6.0.vir.exe Key opened \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\WINE xpersIdentities.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
xpersIdentities.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\Currentversion\Run xpersIdentities.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\{1CD77EEA-CD37-04BF-83B8-6413E209548B} = "C:\\Users\\Admin\\AppData\\Roaming\\Identities\\xpersIdentities.exe" xpersIdentities.exe -
Loads dropped DLL 1 IoCs
Processes:
vmzeus_3.3.6.0.vir.exepid process 1124 vmzeus_3.3.6.0.vir.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
vmzeus_3.3.6.0.vir.exedescription pid process target process PID 1124 wrote to memory of 1408 1124 vmzeus_3.3.6.0.vir.exe xpersIdentities.exe PID 1124 wrote to memory of 1408 1124 vmzeus_3.3.6.0.vir.exe xpersIdentities.exe PID 1124 wrote to memory of 1408 1124 vmzeus_3.3.6.0.vir.exe xpersIdentities.exe PID 1124 wrote to memory of 1408 1124 vmzeus_3.3.6.0.vir.exe xpersIdentities.exe PID 1124 wrote to memory of 808 1124 vmzeus_3.3.6.0.vir.exe cmd.exe PID 1124 wrote to memory of 808 1124 vmzeus_3.3.6.0.vir.exe cmd.exe PID 1124 wrote to memory of 808 1124 vmzeus_3.3.6.0.vir.exe cmd.exe PID 1124 wrote to memory of 808 1124 vmzeus_3.3.6.0.vir.exe cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
xpersIdentities.exepid process 1408 xpersIdentities.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
xpersIdentities.exepid process 1408 xpersIdentities.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\vmzeus_3.3.6.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\vmzeus_3.3.6.0.vir.exe"1⤵
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Identities\xpersIdentities.exe"C:\Users\Admin\AppData\Roaming\Identities\xpersIdentities.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Identifies Wine through registry keys
- Adds Run key to start application
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp64820f4f.bat"2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp64820f4f.bat
-
C:\Users\Admin\AppData\Roaming\Identities\xpersIdentities.exe
-
C:\Users\Admin\AppData\Roaming\Identities\xpersIdentities.exe
-
\Users\Admin\AppData\Roaming\Identities\xpersIdentities.exe
-
memory/808-4-0x0000000000000000-mapping.dmp
-
memory/1408-1-0x0000000000000000-mapping.dmp