Analysis
-
max time kernel
151s -
max time network
67s -
platform
windows7_x64 -
resource
win7 -
submitted
19-07-2020 19:23
Static task
static1
Behavioral task
behavioral1
Sample
zeus 2_2.0.7.4.vir.exe
Resource
win7
Behavioral task
behavioral2
Sample
zeus 2_2.0.7.4.vir.exe
Resource
win10v200430
General
-
Target
zeus 2_2.0.7.4.vir.exe
-
Size
162KB
-
MD5
6fb3388f5895cc7bb376cc924f80abc4
-
SHA1
39b43ab5879e192ceb55b43e096102c024d0dfbf
-
SHA256
24a6c19ce12087f82b0253f92422231801022728d2b909d2fb561bdeb62806db
-
SHA512
105895f432176116581e2f53655354231c801c647cfe2e6b0fae7348fbb4e08d332f8c427926128508e5b38ea18acde354cf43f1392ce88334c62f191c4d1706
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
zeus 2_2.0.7.4.vir.exepid process 1156 zeus 2_2.0.7.4.vir.exe -
Suspicious use of WriteProcessMemory 48 IoCs
Processes:
zeus 2_2.0.7.4.vir.exeaqny.exedescription pid process target process PID 1156 wrote to memory of 1196 1156 zeus 2_2.0.7.4.vir.exe aqny.exe PID 1156 wrote to memory of 1196 1156 zeus 2_2.0.7.4.vir.exe aqny.exe PID 1156 wrote to memory of 1196 1156 zeus 2_2.0.7.4.vir.exe aqny.exe PID 1156 wrote to memory of 1196 1156 zeus 2_2.0.7.4.vir.exe aqny.exe PID 1196 wrote to memory of 1096 1196 aqny.exe taskhost.exe PID 1196 wrote to memory of 1096 1196 aqny.exe taskhost.exe PID 1196 wrote to memory of 1096 1196 aqny.exe taskhost.exe PID 1196 wrote to memory of 1096 1196 aqny.exe taskhost.exe PID 1196 wrote to memory of 1096 1196 aqny.exe taskhost.exe PID 1196 wrote to memory of 1160 1196 aqny.exe Dwm.exe PID 1196 wrote to memory of 1160 1196 aqny.exe Dwm.exe PID 1196 wrote to memory of 1160 1196 aqny.exe Dwm.exe PID 1196 wrote to memory of 1160 1196 aqny.exe Dwm.exe PID 1196 wrote to memory of 1160 1196 aqny.exe Dwm.exe PID 1196 wrote to memory of 1248 1196 aqny.exe Explorer.EXE PID 1196 wrote to memory of 1248 1196 aqny.exe Explorer.EXE PID 1196 wrote to memory of 1248 1196 aqny.exe Explorer.EXE PID 1196 wrote to memory of 1248 1196 aqny.exe Explorer.EXE PID 1196 wrote to memory of 1248 1196 aqny.exe Explorer.EXE PID 1196 wrote to memory of 1156 1196 aqny.exe zeus 2_2.0.7.4.vir.exe PID 1196 wrote to memory of 1156 1196 aqny.exe zeus 2_2.0.7.4.vir.exe PID 1196 wrote to memory of 1156 1196 aqny.exe zeus 2_2.0.7.4.vir.exe PID 1196 wrote to memory of 1156 1196 aqny.exe zeus 2_2.0.7.4.vir.exe PID 1196 wrote to memory of 1156 1196 aqny.exe zeus 2_2.0.7.4.vir.exe PID 1156 wrote to memory of 1952 1156 zeus 2_2.0.7.4.vir.exe cmd.exe PID 1156 wrote to memory of 1952 1156 zeus 2_2.0.7.4.vir.exe cmd.exe PID 1156 wrote to memory of 1952 1156 zeus 2_2.0.7.4.vir.exe cmd.exe PID 1156 wrote to memory of 1952 1156 zeus 2_2.0.7.4.vir.exe cmd.exe PID 1156 wrote to memory of 1952 1156 zeus 2_2.0.7.4.vir.exe cmd.exe PID 1156 wrote to memory of 1952 1156 zeus 2_2.0.7.4.vir.exe cmd.exe PID 1156 wrote to memory of 1952 1156 zeus 2_2.0.7.4.vir.exe cmd.exe PID 1156 wrote to memory of 1952 1156 zeus 2_2.0.7.4.vir.exe cmd.exe PID 1156 wrote to memory of 1952 1156 zeus 2_2.0.7.4.vir.exe cmd.exe PID 1196 wrote to memory of 2040 1196 aqny.exe DllHost.exe PID 1196 wrote to memory of 2040 1196 aqny.exe DllHost.exe PID 1196 wrote to memory of 2040 1196 aqny.exe DllHost.exe PID 1196 wrote to memory of 2040 1196 aqny.exe DllHost.exe PID 1196 wrote to memory of 2040 1196 aqny.exe DllHost.exe PID 1196 wrote to memory of 368 1196 aqny.exe DllHost.exe PID 1196 wrote to memory of 368 1196 aqny.exe DllHost.exe PID 1196 wrote to memory of 368 1196 aqny.exe DllHost.exe PID 1196 wrote to memory of 368 1196 aqny.exe DllHost.exe PID 1196 wrote to memory of 368 1196 aqny.exe DllHost.exe PID 1196 wrote to memory of 1364 1196 aqny.exe DllHost.exe PID 1196 wrote to memory of 1364 1196 aqny.exe DllHost.exe PID 1196 wrote to memory of 1364 1196 aqny.exe DllHost.exe PID 1196 wrote to memory of 1364 1196 aqny.exe DllHost.exe PID 1196 wrote to memory of 1364 1196 aqny.exe DllHost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
WinMail.exepid process 1244 WinMail.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
WinMail.exepid process 1244 WinMail.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
WinMail.exepid process 1244 WinMail.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
zeus 2_2.0.7.4.vir.exedescription pid process target process PID 1156 set thread context of 1952 1156 zeus 2_2.0.7.4.vir.exe cmd.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1952 cmd.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
zeus 2_2.0.7.4.vir.exeWinMail.exedescription pid process Token: SeSecurityPrivilege 1156 zeus 2_2.0.7.4.vir.exe Token: SeSecurityPrivilege 1156 zeus 2_2.0.7.4.vir.exe Token: SeSecurityPrivilege 1156 zeus 2_2.0.7.4.vir.exe Token: SeManageVolumePrivilege 1244 WinMail.exe -
NTFS ADS 1 IoCs
Processes:
WinMail.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\1BBE4239-00000001.eml:OECustomProperty WinMail.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
aqny.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\Currentversion\Run aqny.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\{0438F235-2985-56A3-A26A-A9E043FFE304} = "C:\\Users\\Admin\\AppData\\Roaming\\Eryluz\\aqny.exe" aqny.exe -
Processes:
zeus 2_2.0.7.4.vir.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy zeus 2_2.0.7.4.vir.exe Set value (int) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" zeus 2_2.0.7.4.vir.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
Processes:
aqny.exepid process 1196 aqny.exe 1196 aqny.exe 1196 aqny.exe 1196 aqny.exe 1196 aqny.exe 1196 aqny.exe 1196 aqny.exe 1196 aqny.exe 1196 aqny.exe 1196 aqny.exe 1196 aqny.exe 1196 aqny.exe 1196 aqny.exe 1196 aqny.exe 1196 aqny.exe 1196 aqny.exe 1196 aqny.exe 1196 aqny.exe 1196 aqny.exe 1196 aqny.exe 1196 aqny.exe 1196 aqny.exe 1196 aqny.exe 1196 aqny.exe 1196 aqny.exe 1196 aqny.exe 1196 aqny.exe 1196 aqny.exe 1196 aqny.exe 1196 aqny.exe 1196 aqny.exe 1196 aqny.exe -
Executes dropped EXE 1 IoCs
Processes:
aqny.exepid process 1196 aqny.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.7.4.vir.exe"C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.7.4.vir.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Modifies Internet Explorer settings
-
C:\Users\Admin\AppData\Roaming\Eryluz\aqny.exe"C:\Users\Admin\AppData\Roaming\Eryluz\aqny.exe"3⤵
- Suspicious use of WriteProcessMemory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp8037376e.bat"3⤵
- Deletes itself
-
C:\Program Files\Windows Mail\WinMail.exe"C:\Program Files\Windows Mail\WinMail.exe" -Embedding1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of AdjustPrivilegeToken
- NTFS ADS
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp8037376e.bat
-
C:\Users\Admin\AppData\Roaming\Eryluz\aqny.exe
-
C:\Users\Admin\AppData\Roaming\Eryluz\aqny.exe
-
C:\Users\Admin\AppData\Roaming\Uxevp\vyfa.gaa
-
\Users\Admin\AppData\Roaming\Eryluz\aqny.exe
-
memory/1196-1-0x0000000000000000-mapping.dmp
-
memory/1244-4-0x0000000003A10000-0x0000000003B10000-memory.dmpFilesize
1024KB
-
memory/1244-6-0x0000000003A10000-0x0000000003C10000-memory.dmpFilesize
2.0MB
-
memory/1244-8-0x0000000003A10000-0x0000000003B10000-memory.dmpFilesize
1024KB
-
memory/1244-9-0x0000000003A10000-0x0000000003C10000-memory.dmpFilesize
2.0MB
-
memory/1244-10-0x0000000003B10000-0x0000000003C10000-memory.dmpFilesize
1024KB
-
memory/1244-14-0x00000000024D0000-0x00000000024D2000-memory.dmpFilesize
8KB
-
memory/1244-15-0x00000000024F0000-0x00000000024F2000-memory.dmpFilesize
8KB
-
memory/1244-16-0x00000000024E0000-0x00000000024E2000-memory.dmpFilesize
8KB
-
memory/1244-17-0x0000000003ED0000-0x0000000003ED2000-memory.dmpFilesize
8KB
-
memory/1244-18-0x00000000024D0000-0x00000000024D2000-memory.dmpFilesize
8KB
-
memory/1244-19-0x0000000003CE0000-0x0000000003CE2000-memory.dmpFilesize
8KB
-
memory/1244-20-0x0000000002740000-0x0000000002742000-memory.dmpFilesize
8KB
-
memory/1244-21-0x0000000003DF0000-0x0000000003DF2000-memory.dmpFilesize
8KB
-
memory/1244-22-0x0000000002740000-0x0000000002742000-memory.dmpFilesize
8KB
-
memory/1244-23-0x0000000003ED0000-0x0000000003ED2000-memory.dmpFilesize
8KB
-
memory/1244-24-0x0000000003F50000-0x0000000003F52000-memory.dmpFilesize
8KB
-
memory/1244-25-0x0000000003FD0000-0x0000000003FD2000-memory.dmpFilesize
8KB
-
memory/1244-26-0x0000000004130000-0x0000000004132000-memory.dmpFilesize
8KB
-
memory/1244-27-0x0000000004250000-0x0000000004252000-memory.dmpFilesize
8KB
-
memory/1244-28-0x0000000004570000-0x0000000004572000-memory.dmpFilesize
8KB
-
memory/1244-29-0x0000000003DF0000-0x0000000003DF2000-memory.dmpFilesize
8KB
-
memory/1244-30-0x00000000024D0000-0x00000000024D2000-memory.dmpFilesize
8KB
-
memory/1244-31-0x0000000003E00000-0x0000000003E02000-memory.dmpFilesize
8KB
-
memory/1244-32-0x0000000003E10000-0x0000000003E12000-memory.dmpFilesize
8KB
-
memory/1244-33-0x0000000003F30000-0x0000000003F32000-memory.dmpFilesize
8KB
-
memory/1244-34-0x0000000003EF0000-0x0000000003EF2000-memory.dmpFilesize
8KB
-
memory/1244-35-0x0000000004550000-0x0000000004552000-memory.dmpFilesize
8KB
-
memory/1244-36-0x0000000004540000-0x0000000004542000-memory.dmpFilesize
8KB
-
memory/1244-37-0x0000000003DF0000-0x0000000003DF2000-memory.dmpFilesize
8KB
-
memory/1244-38-0x0000000004250000-0x0000000004252000-memory.dmpFilesize
8KB
-
memory/1244-39-0x0000000004120000-0x0000000004122000-memory.dmpFilesize
8KB
-
memory/1244-40-0x0000000004570000-0x0000000004572000-memory.dmpFilesize
8KB
-
memory/1244-41-0x0000000003F50000-0x0000000003F52000-memory.dmpFilesize
8KB
-
memory/1244-42-0x0000000003CB0000-0x0000000003CB2000-memory.dmpFilesize
8KB
-
memory/1244-43-0x0000000004170000-0x0000000004172000-memory.dmpFilesize
8KB
-
memory/1244-44-0x0000000004190000-0x0000000004192000-memory.dmpFilesize
8KB
-
memory/1244-45-0x00000000041A0000-0x00000000041A2000-memory.dmpFilesize
8KB
-
memory/1244-46-0x0000000004580000-0x0000000004582000-memory.dmpFilesize
8KB
-
memory/1244-47-0x0000000004520000-0x0000000004522000-memory.dmpFilesize
8KB
-
memory/1244-48-0x00000000041B0000-0x00000000041B2000-memory.dmpFilesize
8KB
-
memory/1244-49-0x0000000003A10000-0x0000000003B10000-memory.dmpFilesize
1024KB
-
memory/1244-51-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/1244-57-0x0000000000390000-0x00000000003A0000-memory.dmpFilesize
64KB
-
memory/1952-63-0x0000000000050000-0x0000000000077000-memory.dmpFilesize
156KB
-
memory/1952-65-0x0000000000055FC4-mapping.dmp