Analysis
-
max time kernel
151s -
max time network
122s -
platform
windows7_x64 -
resource
win7 -
submitted
19-07-2020 17:25
Static task
static1
Behavioral task
behavioral1
Sample
zeus 2_2.1.0.5.vir.exe
Resource
win7
Behavioral task
behavioral2
Sample
zeus 2_2.1.0.5.vir.exe
Resource
win10
General
-
Target
zeus 2_2.1.0.5.vir.exe
-
Size
189KB
-
MD5
0c4cf45b512432aaeb0e0a52697f1e8a
-
SHA1
570f75215e0755937adbae7abd3a00b3af0702d8
-
SHA256
fb413e293d5cc9f5b0cef6328221ab9888fd61f9898935fad11c2afb42f4ee12
-
SHA512
550c2c56eb751b2886b1e9bfeac434392505ad0778b675563571deb8bdca4758ed46e7e3d4193fbdcd7aa42dc12fa8c16dbb438e9359dc3d9adc95321ab66420
Malware Config
Signatures
-
NTFS ADS 1 IoCs
Processes:
WinMail.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\63E82410-00000001.eml:OECustomProperty WinMail.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
naot.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\Currentversion\Run naot.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\{7182BE5E-A597-CE64-9F9A-F7DD1AAAC14E} = "C:\\Users\\Admin\\AppData\\Roaming\\Edukg\\naot.exe" naot.exe -
Suspicious use of WriteProcessMemory 61 IoCs
Processes:
zeus 2_2.1.0.5.vir.exenaot.exedescription pid process target process PID 1464 wrote to memory of 1552 1464 zeus 2_2.1.0.5.vir.exe naot.exe PID 1464 wrote to memory of 1552 1464 zeus 2_2.1.0.5.vir.exe naot.exe PID 1464 wrote to memory of 1552 1464 zeus 2_2.1.0.5.vir.exe naot.exe PID 1464 wrote to memory of 1552 1464 zeus 2_2.1.0.5.vir.exe naot.exe PID 1552 wrote to memory of 1092 1552 naot.exe taskhost.exe PID 1552 wrote to memory of 1092 1552 naot.exe taskhost.exe PID 1552 wrote to memory of 1092 1552 naot.exe taskhost.exe PID 1552 wrote to memory of 1092 1552 naot.exe taskhost.exe PID 1552 wrote to memory of 1092 1552 naot.exe taskhost.exe PID 1552 wrote to memory of 1180 1552 naot.exe Dwm.exe PID 1552 wrote to memory of 1180 1552 naot.exe Dwm.exe PID 1552 wrote to memory of 1180 1552 naot.exe Dwm.exe PID 1552 wrote to memory of 1180 1552 naot.exe Dwm.exe PID 1552 wrote to memory of 1180 1552 naot.exe Dwm.exe PID 1552 wrote to memory of 1228 1552 naot.exe Explorer.EXE PID 1552 wrote to memory of 1228 1552 naot.exe Explorer.EXE PID 1552 wrote to memory of 1228 1552 naot.exe Explorer.EXE PID 1552 wrote to memory of 1228 1552 naot.exe Explorer.EXE PID 1552 wrote to memory of 1228 1552 naot.exe Explorer.EXE PID 1552 wrote to memory of 1464 1552 naot.exe zeus 2_2.1.0.5.vir.exe PID 1552 wrote to memory of 1464 1552 naot.exe zeus 2_2.1.0.5.vir.exe PID 1552 wrote to memory of 1464 1552 naot.exe zeus 2_2.1.0.5.vir.exe PID 1552 wrote to memory of 1464 1552 naot.exe zeus 2_2.1.0.5.vir.exe PID 1552 wrote to memory of 1464 1552 naot.exe zeus 2_2.1.0.5.vir.exe PID 1552 wrote to memory of 740 1552 naot.exe WinMail.exe PID 1552 wrote to memory of 740 1552 naot.exe WinMail.exe PID 1552 wrote to memory of 740 1552 naot.exe WinMail.exe PID 1464 wrote to memory of 1944 1464 zeus 2_2.1.0.5.vir.exe cmd.exe PID 1464 wrote to memory of 1944 1464 zeus 2_2.1.0.5.vir.exe cmd.exe PID 1464 wrote to memory of 1944 1464 zeus 2_2.1.0.5.vir.exe cmd.exe PID 1464 wrote to memory of 1944 1464 zeus 2_2.1.0.5.vir.exe cmd.exe PID 1464 wrote to memory of 1944 1464 zeus 2_2.1.0.5.vir.exe cmd.exe PID 1464 wrote to memory of 1944 1464 zeus 2_2.1.0.5.vir.exe cmd.exe PID 1464 wrote to memory of 1944 1464 zeus 2_2.1.0.5.vir.exe cmd.exe PID 1464 wrote to memory of 1944 1464 zeus 2_2.1.0.5.vir.exe cmd.exe PID 1464 wrote to memory of 1944 1464 zeus 2_2.1.0.5.vir.exe cmd.exe PID 1552 wrote to memory of 1332 1552 naot.exe DllHost.exe PID 1552 wrote to memory of 1332 1552 naot.exe DllHost.exe PID 1552 wrote to memory of 1332 1552 naot.exe DllHost.exe PID 1552 wrote to memory of 1332 1552 naot.exe DllHost.exe PID 1552 wrote to memory of 1332 1552 naot.exe DllHost.exe PID 1552 wrote to memory of 1264 1552 naot.exe DllHost.exe PID 1552 wrote to memory of 1264 1552 naot.exe DllHost.exe PID 1552 wrote to memory of 1264 1552 naot.exe DllHost.exe PID 1552 wrote to memory of 1264 1552 naot.exe DllHost.exe PID 1552 wrote to memory of 1264 1552 naot.exe DllHost.exe PID 1552 wrote to memory of 1036 1552 naot.exe DllHost.exe PID 1552 wrote to memory of 1036 1552 naot.exe DllHost.exe PID 1552 wrote to memory of 1036 1552 naot.exe DllHost.exe PID 1552 wrote to memory of 1036 1552 naot.exe DllHost.exe PID 1552 wrote to memory of 1036 1552 naot.exe DllHost.exe PID 1552 wrote to memory of 1832 1552 naot.exe DllHost.exe PID 1552 wrote to memory of 1832 1552 naot.exe DllHost.exe PID 1552 wrote to memory of 1832 1552 naot.exe DllHost.exe PID 1552 wrote to memory of 1832 1552 naot.exe DllHost.exe PID 1552 wrote to memory of 1832 1552 naot.exe DllHost.exe PID 1552 wrote to memory of 1644 1552 naot.exe DllHost.exe PID 1552 wrote to memory of 1644 1552 naot.exe DllHost.exe PID 1552 wrote to memory of 1644 1552 naot.exe DllHost.exe PID 1552 wrote to memory of 1644 1552 naot.exe DllHost.exe PID 1552 wrote to memory of 1644 1552 naot.exe DllHost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
WinMail.exepid process 740 WinMail.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
WinMail.exepid process 740 WinMail.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
zeus 2_2.1.0.5.vir.exedescription pid process target process PID 1464 set thread context of 1944 1464 zeus 2_2.1.0.5.vir.exe cmd.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1944 cmd.exe -
Processes:
zeus 2_2.1.0.5.vir.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy zeus 2_2.1.0.5.vir.exe Set value (int) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" zeus 2_2.1.0.5.vir.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
zeus 2_2.1.0.5.vir.exeWinMail.exedescription pid process Token: SeSecurityPrivilege 1464 zeus 2_2.1.0.5.vir.exe Token: SeSecurityPrivilege 1464 zeus 2_2.1.0.5.vir.exe Token: SeSecurityPrivilege 1464 zeus 2_2.1.0.5.vir.exe Token: SeManageVolumePrivilege 740 WinMail.exe -
Loads dropped DLL 2 IoCs
Processes:
zeus 2_2.1.0.5.vir.exepid process 1464 zeus 2_2.1.0.5.vir.exe 1464 zeus 2_2.1.0.5.vir.exe -
Executes dropped EXE 1 IoCs
Processes:
naot.exepid process 1552 naot.exe -
Suspicious behavior: EnumeratesProcesses 34 IoCs
Processes:
naot.exepid process 1552 naot.exe 1552 naot.exe 1552 naot.exe 1552 naot.exe 1552 naot.exe 1552 naot.exe 1552 naot.exe 1552 naot.exe 1552 naot.exe 1552 naot.exe 1552 naot.exe 1552 naot.exe 1552 naot.exe 1552 naot.exe 1552 naot.exe 1552 naot.exe 1552 naot.exe 1552 naot.exe 1552 naot.exe 1552 naot.exe 1552 naot.exe 1552 naot.exe 1552 naot.exe 1552 naot.exe 1552 naot.exe 1552 naot.exe 1552 naot.exe 1552 naot.exe 1552 naot.exe 1552 naot.exe 1552 naot.exe 1552 naot.exe 1552 naot.exe 1552 naot.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
WinMail.exepid process 740 WinMail.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\zeus 2_2.1.0.5.vir.exe"C:\Users\Admin\AppData\Local\Temp\zeus 2_2.1.0.5.vir.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Edukg\naot.exe"C:\Users\Admin\AppData\Roaming\Edukg\naot.exe"3⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpcea7811e.bat"3⤵
- Deletes itself
-
C:\Program Files\Windows Mail\WinMail.exe"C:\Program Files\Windows Mail\WinMail.exe" -Embedding1⤵
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpcea7811e.bat
-
C:\Users\Admin\AppData\Roaming\Edukg\naot.exe
-
C:\Users\Admin\AppData\Roaming\Edukg\naot.exe
-
C:\Users\Admin\AppData\Roaming\Seby\keif.enh
-
\Users\Admin\AppData\Roaming\Edukg\naot.exe
-
\Users\Admin\AppData\Roaming\Edukg\naot.exe
-
memory/740-5-0x00000000038C0000-0x00000000039C0000-memory.dmpFilesize
1024KB
-
memory/740-7-0x00000000038C0000-0x0000000003AC0000-memory.dmpFilesize
2.0MB
-
memory/740-9-0x00000000038C0000-0x00000000039C0000-memory.dmpFilesize
1024KB
-
memory/740-10-0x00000000038C0000-0x0000000003AC0000-memory.dmpFilesize
2.0MB
-
memory/740-11-0x00000000039C0000-0x0000000003AC0000-memory.dmpFilesize
1024KB
-
memory/740-15-0x0000000003AE0000-0x0000000003AE2000-memory.dmpFilesize
8KB
-
memory/740-16-0x0000000003AF0000-0x0000000003AF2000-memory.dmpFilesize
8KB
-
memory/740-17-0x0000000003AD0000-0x0000000003AD2000-memory.dmpFilesize
8KB
-
memory/740-18-0x0000000003F20000-0x0000000003F22000-memory.dmpFilesize
8KB
-
memory/740-19-0x0000000003F00000-0x0000000003F02000-memory.dmpFilesize
8KB
-
memory/740-20-0x0000000003AF0000-0x0000000003AF2000-memory.dmpFilesize
8KB
-
memory/740-21-0x0000000003EE0000-0x0000000003EE2000-memory.dmpFilesize
8KB
-
memory/740-22-0x0000000003F00000-0x0000000003F02000-memory.dmpFilesize
8KB
-
memory/740-23-0x0000000003F20000-0x0000000003F22000-memory.dmpFilesize
8KB
-
memory/740-24-0x0000000003EF0000-0x0000000003EF2000-memory.dmpFilesize
8KB
-
memory/740-25-0x0000000003AF0000-0x0000000003AF2000-memory.dmpFilesize
8KB
-
memory/740-26-0x0000000003F20000-0x0000000003F22000-memory.dmpFilesize
8KB
-
memory/740-27-0x0000000004690000-0x0000000004692000-memory.dmpFilesize
8KB
-
memory/740-28-0x00000000046A0000-0x00000000046A2000-memory.dmpFilesize
8KB
-
memory/740-29-0x00000000046B0000-0x00000000046B2000-memory.dmpFilesize
8KB
-
memory/740-30-0x00000000046C0000-0x00000000046C2000-memory.dmpFilesize
8KB
-
memory/740-31-0x0000000004BB0000-0x0000000004BB2000-memory.dmpFilesize
8KB
-
memory/740-32-0x0000000004C40000-0x0000000004C42000-memory.dmpFilesize
8KB
-
memory/740-33-0x0000000004D60000-0x0000000004D62000-memory.dmpFilesize
8KB
-
memory/740-34-0x0000000003C60000-0x0000000003C62000-memory.dmpFilesize
8KB
-
memory/740-35-0x0000000003F10000-0x0000000003F12000-memory.dmpFilesize
8KB
-
memory/740-36-0x0000000003C50000-0x0000000003C52000-memory.dmpFilesize
8KB
-
memory/740-37-0x0000000003F80000-0x0000000003F82000-memory.dmpFilesize
8KB
-
memory/740-38-0x00000000043A0000-0x00000000043A2000-memory.dmpFilesize
8KB
-
memory/740-39-0x0000000004430000-0x0000000004432000-memory.dmpFilesize
8KB
-
memory/740-40-0x0000000004440000-0x0000000004442000-memory.dmpFilesize
8KB
-
memory/740-42-0x0000000004460000-0x0000000004462000-memory.dmpFilesize
8KB
-
memory/740-41-0x0000000004C50000-0x0000000004C52000-memory.dmpFilesize
8KB
-
memory/740-43-0x0000000004660000-0x0000000004662000-memory.dmpFilesize
8KB
-
memory/740-44-0x0000000004650000-0x0000000004652000-memory.dmpFilesize
8KB
-
memory/740-45-0x0000000004640000-0x0000000004642000-memory.dmpFilesize
8KB
-
memory/740-46-0x0000000004630000-0x0000000004632000-memory.dmpFilesize
8KB
-
memory/740-47-0x0000000004620000-0x0000000004622000-memory.dmpFilesize
8KB
-
memory/740-48-0x0000000004570000-0x0000000004572000-memory.dmpFilesize
8KB
-
memory/740-49-0x0000000004580000-0x0000000004582000-memory.dmpFilesize
8KB
-
memory/740-50-0x0000000003D30000-0x0000000003D32000-memory.dmpFilesize
8KB
-
memory/740-51-0x00000000038C0000-0x00000000039C0000-memory.dmpFilesize
1024KB
-
memory/740-53-0x0000000001FA0000-0x0000000001FB0000-memory.dmpFilesize
64KB
-
memory/740-59-0x0000000001F40000-0x0000000001F50000-memory.dmpFilesize
64KB
-
memory/1552-2-0x0000000000000000-mapping.dmp
-
memory/1944-65-0x0000000000050000-0x0000000000077000-memory.dmpFilesize
156KB
-
memory/1944-67-0x000000000006AFBC-mapping.dmp