7c267f393664ccc38c7a4fb521587e77db7fc7e3a157a9ef5c19783f03a67c76

General

Target
vmzeus_3.3.6.1.vir.exe
Size 272KB
Sample200719-kdazz6r79a
SHA256 7c267f393664ccc38c7a4fb521587e77db7fc7e3a157a9ef5c19783f03a67c76
MD5 a3f3a635f17c595b5c8e5458ad502c0b
SHA1 f84fba477343c28ae61228f1d9e3f42a7a52a9ba
SHA512 cb1b143328dec2c54eea6132265633cbd5703648d3f18e80d36c0353c11ec4ccee8549b185e281eeb7062d48e2d2bc154e509efc407fb9bc2a57c2952bd1efb4
MD5 SHA1 SHA512

Score

8^/10

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\Currentversion\Run	SunCtrl.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\{B32D0ED6-4FC6-0B3C-5A4C-32DC45E58783} = "C:\\Users\\Admin\\AppData\\Roaming\\Sun\\SunCtrl.exe"	SunCtrl.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1612	vmzeus_3.3.6.1.vir.exe
1820	SunCtrl.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 3712	1612	vmzeus_3.3.6.1.vir.exe	68
PID 1612 wrote to memory of 3712	1612	vmzeus_3.3.6.1.vir.exe	68
PID 1612 wrote to memory of 3712	1612	vmzeus_3.3.6.1.vir.exe	68
PID 1612 wrote to memory of 3712	1612	vmzeus_3.3.6.1.vir.exe	68
PID 1612 wrote to memory of 3712	1612	vmzeus_3.3.6.1.vir.exe	68
PID 1612 wrote to memory of 3712	1612	vmzeus_3.3.6.1.vir.exe	68
PID 1612 wrote to memory of 3712	1612	vmzeus_3.3.6.1.vir.exe	68
PID 1612 wrote to memory of 3712	1612	vmzeus_3.3.6.1.vir.exe	68
PID 3712 wrote to memory of 1820	3712	vmzeus_3.3.6.1.vir.exe	69
PID 3712 wrote to memory of 1820	3712	vmzeus_3.3.6.1.vir.exe	69
PID 3712 wrote to memory of 1820	3712	vmzeus_3.3.6.1.vir.exe	69
PID 1820 wrote to memory of 3612	1820	SunCtrl.exe	74
PID 1820 wrote to memory of 3612	1820	SunCtrl.exe	74
PID 1820 wrote to memory of 3612	1820	SunCtrl.exe	74
PID 1820 wrote to memory of 3612	1820	SunCtrl.exe	74
PID 1820 wrote to memory of 3612	1820	SunCtrl.exe	74
PID 1820 wrote to memory of 3612	1820	SunCtrl.exe	74
PID 1820 wrote to memory of 3612	1820	SunCtrl.exe	74
PID 1820 wrote to memory of 3612	1820	SunCtrl.exe	74
PID 3712 wrote to memory of 3988	3712	vmzeus_3.3.6.1.vir.exe	75
PID 3712 wrote to memory of 3988	3712	vmzeus_3.3.6.1.vir.exe	75
PID 3712 wrote to memory of 3988	3712	vmzeus_3.3.6.1.vir.exe	75

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1612 set thread context of 3712	1612	vmzeus_3.3.6.1.vir.exe	68
PID 1820 set thread context of 3612	1820	SunCtrl.exe	74

Executes dropped EXE 2 IoCs

pid	Process
1820	SunCtrl.exe
3612	SunCtrl.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3612	SunCtrl.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\WINE	vmzeus_3.3.6.1.vir.exe
Key opened	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\WINE	SunCtrl.exe