Analysis
-
max time kernel
150s -
max time network
56s -
platform
windows7_x64 -
resource
win7 -
submitted
19-07-2020 19:35
Static task
static1
Behavioral task
behavioral1
Sample
vmzeus_3.2.9.1.vir.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
vmzeus_3.2.9.1.vir.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
vmzeus_3.2.9.1.vir.exe
-
Size
228KB
-
MD5
c4e45a5e13dbafa2e5ec5dae4a998303
-
SHA1
08f432ece582f4eaf84dab3c0fd8dd5e6e9f1555
-
SHA256
5ffa867ac4050f771867737d104be2bf68ec9e51638b5005a6cd013ddbaba085
-
SHA512
9612b6efbdcd0d4757aebb11228f7311a3d123104e772d98ea81d872d2e10f1a6a0a774504ef2da411e14ce1e1b173d64fddf165b202b3a82bf593da763aceb0
Score
8/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1588 cmd.exe -
Suspicious behavior: EnumeratesProcesses 58 IoCs
Processes:
xpersMacromedia.exepid process 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe 820 xpersMacromedia.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
vmzeus_3.2.9.1.vir.exexpersMacromedia.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\WINE vmzeus_3.2.9.1.vir.exe Key opened \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\WINE xpersMacromedia.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
xpersMacromedia.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\Currentversion\Run xpersMacromedia.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\{D7D6D964-BD5C-6133-4A3F-549F9E9B0DE0} = "C:\\Users\\Admin\\AppData\\Roaming\\Macromedia\\xpersMacromedia.exe" xpersMacromedia.exe -
Loads dropped DLL 2 IoCs
Processes:
vmzeus_3.2.9.1.vir.exepid process 1100 vmzeus_3.2.9.1.vir.exe 1100 vmzeus_3.2.9.1.vir.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
vmzeus_3.2.9.1.vir.exedescription pid process target process PID 1100 wrote to memory of 820 1100 vmzeus_3.2.9.1.vir.exe xpersMacromedia.exe PID 1100 wrote to memory of 820 1100 vmzeus_3.2.9.1.vir.exe xpersMacromedia.exe PID 1100 wrote to memory of 820 1100 vmzeus_3.2.9.1.vir.exe xpersMacromedia.exe PID 1100 wrote to memory of 820 1100 vmzeus_3.2.9.1.vir.exe xpersMacromedia.exe PID 1100 wrote to memory of 1588 1100 vmzeus_3.2.9.1.vir.exe cmd.exe PID 1100 wrote to memory of 1588 1100 vmzeus_3.2.9.1.vir.exe cmd.exe PID 1100 wrote to memory of 1588 1100 vmzeus_3.2.9.1.vir.exe cmd.exe PID 1100 wrote to memory of 1588 1100 vmzeus_3.2.9.1.vir.exe cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
xpersMacromedia.exepid process 820 xpersMacromedia.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
xpersMacromedia.exepid process 820 xpersMacromedia.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\vmzeus_3.2.9.1.vir.exe"C:\Users\Admin\AppData\Local\Temp\vmzeus_3.2.9.1.vir.exe"1⤵
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Macromedia\xpersMacromedia.exe"C:\Users\Admin\AppData\Roaming\Macromedia\xpersMacromedia.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Identifies Wine through registry keys
- Adds Run key to start application
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpc2e75896.bat"2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpc2e75896.bat
-
C:\Users\Admin\AppData\Roaming\Macromedia\xpersMacromedia.exe
-
C:\Users\Admin\AppData\Roaming\Macromedia\xpersMacromedia.exe
-
\Users\Admin\AppData\Roaming\Macromedia\xpersMacromedia.exe
-
\Users\Admin\AppData\Roaming\Macromedia\xpersMacromedia.exe
-
memory/820-2-0x0000000000000000-mapping.dmp
-
memory/1588-5-0x0000000000000000-mapping.dmp