Analysis
- max time kernel
150s - max time network
120s - platform
windows7_x64 - resource
win7 - submitted
19/07/2020, 17:25
Static task
static1
Behavioral task
behavioral1
Sample
vmzeus_3.3.6.1.vir.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
vmzeus_3.3.6.1.vir.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target vmzeus_3.3.6.1.vir.exe
- Size 272KB
- Sample200719-kdazz6r79a
- SHA256 7c267f393664ccc38c7a4fb521587e77db7fc7e3a157a9ef5c19783f03a67c76
- MD5 a3f3a635f17c595b5c8e5458ad502c0b
- SHA1 f84fba477343c28ae61228f1d9e3f42a7a52a9ba
- SHA512 cb1b143328dec2c54eea6132265633cbd5703648d3f18e80d36c0353c11ec4ccee8549b185e281eeb7062d48e2d2bc154e509efc407fb9bc2a57c2952bd1efb4
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 1752 TrayMozilla.exe 1880 TrayMozilla.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1880 TrayMozilla.exe - Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe 1880 TrayMozilla.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\Currentversion\Run TrayMozilla.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\{23ABD6B8-8B08-1FB5-9BBC-C56D1DC18ACE} = "C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\TrayMozilla.exe" TrayMozilla.exe - Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 1688 wrote to memory of 1780 1688 vmzeus_3.3.6.1.vir.exe 24 PID 1688 wrote to memory of 1780 1688 vmzeus_3.3.6.1.vir.exe 24 PID 1688 wrote to memory of 1780 1688 vmzeus_3.3.6.1.vir.exe 24 PID 1688 wrote to memory of 1780 1688 vmzeus_3.3.6.1.vir.exe 24 PID 1688 wrote to memory of 1780 1688 vmzeus_3.3.6.1.vir.exe 24 PID 1688 wrote to memory of 1780 1688 vmzeus_3.3.6.1.vir.exe 24 PID 1688 wrote to memory of 1780 1688 vmzeus_3.3.6.1.vir.exe 24 PID 1688 wrote to memory of 1780 1688 vmzeus_3.3.6.1.vir.exe 24 PID 1688 wrote to memory of 1780 1688 vmzeus_3.3.6.1.vir.exe 24 PID 1780 wrote to memory of 1752 1780 vmzeus_3.3.6.1.vir.exe 25 PID 1780 wrote to memory of 1752 1780 vmzeus_3.3.6.1.vir.exe 25 PID 1780 wrote to memory of 1752 1780 vmzeus_3.3.6.1.vir.exe 25 PID 1780 wrote to memory of 1752 1780 vmzeus_3.3.6.1.vir.exe 25 PID 1752 wrote to memory of 1880 1752 TrayMozilla.exe 26 PID 1752 wrote to memory of 1880 1752 TrayMozilla.exe 26 PID 1752 wrote to memory of 1880 1752 TrayMozilla.exe 26 PID 1752 wrote to memory of 1880 1752 TrayMozilla.exe 26 PID 1752 wrote to memory of 1880 1752 TrayMozilla.exe 26 PID 1752 wrote to memory of 1880 1752 TrayMozilla.exe 26 PID 1752 wrote to memory of 1880 1752 TrayMozilla.exe 26 PID 1752 wrote to memory of 1880 1752 TrayMozilla.exe 26 PID 1752 wrote to memory of 1880 1752 TrayMozilla.exe 26 PID 1780 wrote to memory of 1924 1780 vmzeus_3.3.6.1.vir.exe 27 PID 1780 wrote to memory of 1924 1780 vmzeus_3.3.6.1.vir.exe 27 PID 1780 wrote to memory of 1924 1780 vmzeus_3.3.6.1.vir.exe 27 PID 1780 wrote to memory of 1924 1780 vmzeus_3.3.6.1.vir.exe 27 - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1688 set thread context of 1780 1688 vmzeus_3.3.6.1.vir.exe 24 PID 1752 set thread context of 1880 1752 TrayMozilla.exe 26 - Deletes itself 1 IoCs
pid Process 1924 cmd.exe - Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\WINE vmzeus_3.3.6.1.vir.exe Key opened \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\WINE TrayMozilla.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1688 vmzeus_3.3.6.1.vir.exe 1752 TrayMozilla.exe - Loads dropped DLL 2 IoCs
pid Process 1780 vmzeus_3.3.6.1.vir.exe 1780 vmzeus_3.3.6.1.vir.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\vmzeus_3.3.6.1.vir.exe"C:\Users\Admin\AppData\Local\Temp\vmzeus_3.3.6.1.vir.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\vmzeus_3.3.6.1.vir.exe"C:\Users\Admin\AppData\Local\Temp\vmzeus_3.3.6.1.vir.exe"2⤵
- Suspicious use of WriteProcessMemory
- Identifies Wine through registry keys
- Loads dropped DLL
PID:1780 -
C:\Users\Admin\AppData\Roaming\Mozilla\TrayMozilla.exe"C:\Users\Admin\AppData\Roaming\Mozilla\TrayMozilla.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1752 -
C:\Users\Admin\AppData\Roaming\Mozilla\TrayMozilla.exe"C:\Users\Admin\AppData\Roaming\Mozilla\TrayMozilla.exe"4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious behavior: EnumeratesProcesses
- Adds Run key to start application
- Identifies Wine through registry keys
PID:1880
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp7fa39974.bat"3⤵
- Deletes itself
PID:1924
-
-