Analysis

  • max time kernel
    63s
  • max time network
    68s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    19-07-2020 19:33

General

  • Target

    zeus 1_1.3.3.6.vir.exe

  • Size

    198KB

  • MD5

    37b593c8e58ab5a3a10c0ff8918dc92f

  • SHA1

    9b8895a9461fcfd636536417f0564b2ea02568a6

  • SHA256

    baa8f2980a3a3a98c8841ebbdedde17688cc1464094d02c9c1e4b3bcda950438

  • SHA512

    e823696571303aaac73f5604a2d89f406b9fc1a7c13fff1fb40f19805ad84b68489307da39023f7c43fc4a68f7ecb54da5ad3a5bae3b1643fc466352c44acfe3

Score
3/10

Malware Config

Signatures

  • Program crash ⋅ 1 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 3 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\zeus 1_1.3.3.6.vir.exe
    "C:\Users\Admin\AppData\Local\Temp\zeus 1_1.3.3.6.vir.exe"
    PID:3104
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 356
      Program crash
      Suspicious use of AdjustPrivilegeToken
      Suspicious behavior: EnumeratesProcesses
      PID:3948

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Discovery

            Execution

              Exfiltration

                Impact

                  Initial Access

                    Lateral Movement

                      Persistence

                        Privilege Escalation

                          Replay Monitor

                          00:00 00:00

                          Downloads

                          • memory/3948-0-0x0000000004D70000-0x0000000004D71000-memory.dmp
                          • memory/3948-1-0x0000000005770000-0x0000000005771000-memory.dmp