Analysis

  • max time kernel
    152s
  • max time network
    83s
  • platform
    windows7_x64
  • resource
    win7v200430
  • submitted
    19-07-2020 19:31

General

  • Target

    zeusaes_2.7.7.3.vir.exe

  • Size

    218KB

  • MD5

    354f372a0e38336f3a6c9e341f8ed271

  • SHA1

    6ece6eae832907eeffcc69d886ae0b2d644ba3c0

  • SHA256

    87c779ed21a3c5abb368edd0472968f7f4f3c839fa8ac6ed058bfbee6c6c056a

  • SHA512

    ac5b918460674f1ea3a9126ee4d70e9748f4b768c71f9b9f1d69fe31f0a8fd2e58217f56a50129c8d78c2bc05077863e56caf07f119cd861108d77a377b38f0a

Score
8/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Executes dropped EXE 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\zeusaes_2.7.7.3.vir.exe
    "C:\Users\Admin\AppData\Local\Temp\zeusaes_2.7.7.3.vir.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    • Suspicious use of SetThreadContext
    PID:1312
    • C:\Users\Admin\AppData\Local\Temp\zeusaes_2.7.7.3.vir.exe
      "C:\Users\Admin\AppData\Local\Temp\zeusaes_2.7.7.3.vir.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      • Suspicious use of AdjustPrivilegeToken
      • Loads dropped DLL
      PID:872
      • C:\Users\Admin\AppData\Roaming\Iddaq\pywo.exe
        "C:\Users\Admin\AppData\Roaming\Iddaq\pywo.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        • Suspicious use of SetThreadContext
        • Executes dropped EXE
        PID:780
        • C:\Users\Admin\AppData\Roaming\Iddaq\pywo.exe
          "C:\Users\Admin\AppData\Roaming\Iddaq\pywo.exe"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          • Executes dropped EXE
          PID:1824
          • C:\Windows\explorer.exe
            "C:\Windows\explorer.exe"
            5⤵
              PID:1792
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp258583b9.bat"
          3⤵
          • Deletes itself
          PID:1840

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    1
    T1112

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp258583b9.bat
    • C:\Users\Admin\AppData\Roaming\Iddaq\pywo.exe
    • C:\Users\Admin\AppData\Roaming\Iddaq\pywo.exe
    • C:\Users\Admin\AppData\Roaming\Iddaq\pywo.exe
    • \Users\Admin\AppData\Roaming\Iddaq\pywo.exe
    • \Users\Admin\AppData\Roaming\Iddaq\pywo.exe
    • memory/780-5-0x0000000000000000-mapping.dmp
    • memory/872-0-0x0000000000400000-0x000000000042C000-memory.dmp
      Filesize

      176KB

    • memory/872-1-0x000000000041322D-mapping.dmp
    • memory/872-2-0x0000000000400000-0x000000000042C000-memory.dmp
      Filesize

      176KB

    • memory/1824-9-0x000000000041322D-mapping.dmp
    • memory/1840-12-0x0000000000000000-mapping.dmp