Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows7_x64 -
resource
win7 -
submitted
19-07-2020 19:43
Static task
static1
Behavioral task
behavioral1
Sample
zeus 2_2.0.8.7.vir.exe
Resource
win7
Behavioral task
behavioral2
Sample
zeus 2_2.0.8.7.vir.exe
Resource
win10v200430
General
-
Target
zeus 2_2.0.8.7.vir.exe
-
Size
167KB
-
MD5
e34aa6622bf3aa5756056b33dfe10c51
-
SHA1
ff4e3404180790b539934e965fb11a6738ae5796
-
SHA256
e0d7c01881a50147f93ec0cec80b257bc05fed7a248eba2f2bc03a26e94c3129
-
SHA512
9558aaa77de25433ae6fed69d0ca6911b7c1fdf8e3d819a787292f75d20462b8830352dc52b3387187913f20a74a055b4f8527e8523ca96cb66ff0b584d9b4ab
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
zeus 2_2.0.8.7.vir.exedescription pid process target process PID 1420 set thread context of 1912 1420 zeus 2_2.0.8.7.vir.exe cmd.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1912 cmd.exe -
Processes:
zeus 2_2.0.8.7.vir.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy zeus 2_2.0.8.7.vir.exe Set value (int) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" zeus 2_2.0.8.7.vir.exe -
NTFS ADS 1 IoCs
Processes:
WinMail.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\096E7330-00000001.eml:OECustomProperty WinMail.exe -
Suspicious use of WriteProcessMemory 83 IoCs
Processes:
zeus 2_2.0.8.7.vir.exeguzis.exedescription pid process target process PID 1420 wrote to memory of 1464 1420 zeus 2_2.0.8.7.vir.exe guzis.exe PID 1420 wrote to memory of 1464 1420 zeus 2_2.0.8.7.vir.exe guzis.exe PID 1420 wrote to memory of 1464 1420 zeus 2_2.0.8.7.vir.exe guzis.exe PID 1420 wrote to memory of 1464 1420 zeus 2_2.0.8.7.vir.exe guzis.exe PID 1464 wrote to memory of 1152 1464 guzis.exe taskhost.exe PID 1464 wrote to memory of 1152 1464 guzis.exe taskhost.exe PID 1464 wrote to memory of 1152 1464 guzis.exe taskhost.exe PID 1464 wrote to memory of 1152 1464 guzis.exe taskhost.exe PID 1464 wrote to memory of 1152 1464 guzis.exe taskhost.exe PID 1464 wrote to memory of 1232 1464 guzis.exe Dwm.exe PID 1464 wrote to memory of 1232 1464 guzis.exe Dwm.exe PID 1464 wrote to memory of 1232 1464 guzis.exe Dwm.exe PID 1464 wrote to memory of 1232 1464 guzis.exe Dwm.exe PID 1464 wrote to memory of 1232 1464 guzis.exe Dwm.exe PID 1464 wrote to memory of 1296 1464 guzis.exe Explorer.EXE PID 1464 wrote to memory of 1296 1464 guzis.exe Explorer.EXE PID 1464 wrote to memory of 1296 1464 guzis.exe Explorer.EXE PID 1464 wrote to memory of 1296 1464 guzis.exe Explorer.EXE PID 1464 wrote to memory of 1296 1464 guzis.exe Explorer.EXE PID 1464 wrote to memory of 1420 1464 guzis.exe zeus 2_2.0.8.7.vir.exe PID 1464 wrote to memory of 1420 1464 guzis.exe zeus 2_2.0.8.7.vir.exe PID 1464 wrote to memory of 1420 1464 guzis.exe zeus 2_2.0.8.7.vir.exe PID 1464 wrote to memory of 1420 1464 guzis.exe zeus 2_2.0.8.7.vir.exe PID 1464 wrote to memory of 1420 1464 guzis.exe zeus 2_2.0.8.7.vir.exe PID 1464 wrote to memory of 604 1464 guzis.exe WinMail.exe PID 1464 wrote to memory of 604 1464 guzis.exe WinMail.exe PID 1464 wrote to memory of 604 1464 guzis.exe WinMail.exe PID 1464 wrote to memory of 604 1464 guzis.exe WinMail.exe PID 1464 wrote to memory of 604 1464 guzis.exe WinMail.exe PID 1420 wrote to memory of 1912 1420 zeus 2_2.0.8.7.vir.exe cmd.exe PID 1420 wrote to memory of 1912 1420 zeus 2_2.0.8.7.vir.exe cmd.exe PID 1420 wrote to memory of 1912 1420 zeus 2_2.0.8.7.vir.exe cmd.exe PID 1420 wrote to memory of 1912 1420 zeus 2_2.0.8.7.vir.exe cmd.exe PID 1420 wrote to memory of 1912 1420 zeus 2_2.0.8.7.vir.exe cmd.exe PID 1420 wrote to memory of 1912 1420 zeus 2_2.0.8.7.vir.exe cmd.exe PID 1420 wrote to memory of 1912 1420 zeus 2_2.0.8.7.vir.exe cmd.exe PID 1420 wrote to memory of 1912 1420 zeus 2_2.0.8.7.vir.exe cmd.exe PID 1420 wrote to memory of 1912 1420 zeus 2_2.0.8.7.vir.exe cmd.exe PID 1464 wrote to memory of 828 1464 guzis.exe DllHost.exe PID 1464 wrote to memory of 828 1464 guzis.exe DllHost.exe PID 1464 wrote to memory of 828 1464 guzis.exe DllHost.exe PID 1464 wrote to memory of 828 1464 guzis.exe DllHost.exe PID 1464 wrote to memory of 828 1464 guzis.exe DllHost.exe PID 1464 wrote to memory of 1104 1464 guzis.exe DllHost.exe PID 1464 wrote to memory of 1104 1464 guzis.exe DllHost.exe PID 1464 wrote to memory of 1104 1464 guzis.exe DllHost.exe PID 1464 wrote to memory of 1104 1464 guzis.exe DllHost.exe PID 1464 wrote to memory of 1104 1464 guzis.exe DllHost.exe PID 1464 wrote to memory of 1620 1464 guzis.exe DllHost.exe PID 1464 wrote to memory of 1620 1464 guzis.exe DllHost.exe PID 1464 wrote to memory of 1620 1464 guzis.exe DllHost.exe PID 1464 wrote to memory of 1620 1464 guzis.exe DllHost.exe PID 1464 wrote to memory of 1620 1464 guzis.exe DllHost.exe PID 1464 wrote to memory of 332 1464 guzis.exe DllHost.exe PID 1464 wrote to memory of 332 1464 guzis.exe DllHost.exe PID 1464 wrote to memory of 332 1464 guzis.exe DllHost.exe PID 1464 wrote to memory of 332 1464 guzis.exe DllHost.exe PID 1464 wrote to memory of 332 1464 guzis.exe DllHost.exe PID 1464 wrote to memory of 1772 1464 guzis.exe DllHost.exe PID 1464 wrote to memory of 1772 1464 guzis.exe DllHost.exe PID 1464 wrote to memory of 1772 1464 guzis.exe DllHost.exe PID 1464 wrote to memory of 1772 1464 guzis.exe DllHost.exe PID 1464 wrote to memory of 1772 1464 guzis.exe DllHost.exe PID 1464 wrote to memory of 1572 1464 guzis.exe DllHost.exe -
Executes dropped EXE 1 IoCs
Processes:
guzis.exepid process 1464 guzis.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
WinMail.exepid process 604 WinMail.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
WinMail.exepid process 604 WinMail.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
WinMail.exepid process 604 WinMail.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
guzis.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\{5508DCD2-4009-7A19-AC5B-6B1820602CFA} = "C:\\Users\\Admin\\AppData\\Roaming\\Pounv\\guzis.exe" guzis.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\Currentversion\Run guzis.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
zeus 2_2.0.8.7.vir.exeWinMail.exedescription pid process Token: SeSecurityPrivilege 1420 zeus 2_2.0.8.7.vir.exe Token: SeSecurityPrivilege 1420 zeus 2_2.0.8.7.vir.exe Token: SeSecurityPrivilege 1420 zeus 2_2.0.8.7.vir.exe Token: SeManageVolumePrivilege 604 WinMail.exe -
Loads dropped DLL 1 IoCs
Processes:
zeus 2_2.0.8.7.vir.exepid process 1420 zeus 2_2.0.8.7.vir.exe -
Suspicious behavior: EnumeratesProcesses 38 IoCs
Processes:
guzis.exepid process 1464 guzis.exe 1464 guzis.exe 1464 guzis.exe 1464 guzis.exe 1464 guzis.exe 1464 guzis.exe 1464 guzis.exe 1464 guzis.exe 1464 guzis.exe 1464 guzis.exe 1464 guzis.exe 1464 guzis.exe 1464 guzis.exe 1464 guzis.exe 1464 guzis.exe 1464 guzis.exe 1464 guzis.exe 1464 guzis.exe 1464 guzis.exe 1464 guzis.exe 1464 guzis.exe 1464 guzis.exe 1464 guzis.exe 1464 guzis.exe 1464 guzis.exe 1464 guzis.exe 1464 guzis.exe 1464 guzis.exe 1464 guzis.exe 1464 guzis.exe 1464 guzis.exe 1464 guzis.exe 1464 guzis.exe 1464 guzis.exe 1464 guzis.exe 1464 guzis.exe 1464 guzis.exe 1464 guzis.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.7.vir.exe"C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.7.vir.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Pounv\guzis.exe"C:\Users\Admin\AppData\Roaming\Pounv\guzis.exe"3⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpfefab1a7.bat"3⤵
- Deletes itself
-
C:\Program Files\Windows Mail\WinMail.exe"C:\Program Files\Windows Mail\WinMail.exe" -Embedding1⤵
- NTFS ADS
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpfefab1a7.bat
-
C:\Users\Admin\AppData\Roaming\Pounv\guzis.exe
-
C:\Users\Admin\AppData\Roaming\Pounv\guzis.exe
-
C:\Users\Admin\AppData\Roaming\Yhix\nyhun.wuo
-
\Users\Admin\AppData\Roaming\Pounv\guzis.exe
-
memory/604-4-0x00000000038D0000-0x00000000039D0000-memory.dmpFilesize
1024KB
-
memory/604-6-0x00000000038D0000-0x0000000003AD0000-memory.dmpFilesize
2.0MB
-
memory/604-8-0x00000000038D0000-0x00000000039D0000-memory.dmpFilesize
1024KB
-
memory/604-9-0x00000000038D0000-0x0000000003AD0000-memory.dmpFilesize
2.0MB
-
memory/604-10-0x00000000039D0000-0x0000000003AD0000-memory.dmpFilesize
1024KB
-
memory/604-14-0x0000000003AD0000-0x0000000003AD2000-memory.dmpFilesize
8KB
-
memory/604-15-0x0000000003AE0000-0x0000000003AE2000-memory.dmpFilesize
8KB
-
memory/604-16-0x0000000003AF0000-0x0000000003AF2000-memory.dmpFilesize
8KB
-
memory/604-17-0x0000000003B40000-0x0000000003B42000-memory.dmpFilesize
8KB
-
memory/604-18-0x0000000003D90000-0x0000000003D92000-memory.dmpFilesize
8KB
-
memory/604-19-0x0000000003AE0000-0x0000000003AE2000-memory.dmpFilesize
8KB
-
memory/604-20-0x0000000003C70000-0x0000000003C72000-memory.dmpFilesize
8KB
-
memory/604-21-0x0000000003C40000-0x0000000003C42000-memory.dmpFilesize
8KB
-
memory/604-22-0x0000000003AE0000-0x0000000003AE2000-memory.dmpFilesize
8KB
-
memory/604-23-0x0000000003C70000-0x0000000003C72000-memory.dmpFilesize
8KB
-
memory/604-24-0x0000000003E80000-0x0000000003E82000-memory.dmpFilesize
8KB
-
memory/604-25-0x0000000003D60000-0x0000000003D62000-memory.dmpFilesize
8KB
-
memory/604-26-0x0000000003D80000-0x0000000003D82000-memory.dmpFilesize
8KB
-
memory/604-27-0x0000000003C70000-0x0000000003C72000-memory.dmpFilesize
8KB
-
memory/604-28-0x0000000004370000-0x0000000004372000-memory.dmpFilesize
8KB
-
memory/604-29-0x0000000004380000-0x0000000004382000-memory.dmpFilesize
8KB
-
memory/604-30-0x00000000044D0000-0x00000000044D2000-memory.dmpFilesize
8KB
-
memory/604-31-0x0000000004570000-0x0000000004572000-memory.dmpFilesize
8KB
-
memory/604-32-0x0000000004590000-0x0000000004592000-memory.dmpFilesize
8KB
-
memory/604-33-0x00000000045A0000-0x00000000045A2000-memory.dmpFilesize
8KB
-
memory/604-34-0x0000000004630000-0x0000000004632000-memory.dmpFilesize
8KB
-
memory/604-35-0x0000000004640000-0x0000000004642000-memory.dmpFilesize
8KB
-
memory/604-36-0x0000000004650000-0x0000000004652000-memory.dmpFilesize
8KB
-
memory/604-37-0x0000000004C90000-0x0000000004C92000-memory.dmpFilesize
8KB
-
memory/604-38-0x0000000004C80000-0x0000000004C82000-memory.dmpFilesize
8KB
-
memory/604-39-0x0000000004C20000-0x0000000004C22000-memory.dmpFilesize
8KB
-
memory/604-40-0x0000000004C10000-0x0000000004C12000-memory.dmpFilesize
8KB
-
memory/604-41-0x0000000004B70000-0x0000000004B72000-memory.dmpFilesize
8KB
-
memory/604-42-0x0000000003C30000-0x0000000003C32000-memory.dmpFilesize
8KB
-
memory/604-43-0x0000000003B60000-0x0000000003B62000-memory.dmpFilesize
8KB
-
memory/604-44-0x0000000004C70000-0x0000000004C72000-memory.dmpFilesize
8KB
-
memory/604-45-0x0000000004C60000-0x0000000004C62000-memory.dmpFilesize
8KB
-
memory/604-46-0x0000000004C50000-0x0000000004C52000-memory.dmpFilesize
8KB
-
memory/604-47-0x0000000004C40000-0x0000000004C42000-memory.dmpFilesize
8KB
-
memory/604-48-0x00000000038D0000-0x00000000039D0000-memory.dmpFilesize
1024KB
-
memory/604-50-0x0000000002110000-0x0000000002120000-memory.dmpFilesize
64KB
-
memory/604-56-0x0000000001F50000-0x0000000001F60000-memory.dmpFilesize
64KB
-
memory/1464-1-0x0000000000000000-mapping.dmp
-
memory/1912-62-0x0000000000050000-0x0000000000077000-memory.dmpFilesize
156KB
-
memory/1912-64-0x00000000000613D7-mapping.dmp