e3e1334530a63bb70e51fdd7c28ad51bfcdff8022d393a8dbbd6a398e90ff12c

General

Target

vmzeus_3.2.3.1.vir.exe
Size

279KB
MD5

0f09d8d3edf0e06e79fb15df680be3ac
SHA1

4881a85b7531ed2211e0c722a5bb1c9e9c522c54
SHA256

e3e1334530a63bb70e51fdd7c28ad51bfcdff8022d393a8dbbd6a398e90ff12c
SHA512

753302eb82312b86e997e5ea7644fb9de0dc240eaf8c6d6e912f4f73528ef691692384bd57cd74cc5f521c90718463376d4484e3c29525e1c0add2577fd5890d

Score

8^/10

evasion

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

agentMediaCenterPrograms.exeagentMediaCenterPrograms.exe

pid process

336 agentMediaCenterPrograms.exe
1040 agentMediaCenterPrograms.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1484 cmd.exe

pid	process
336	agentMediaCenterPrograms.exe
1040	agentMediaCenterPrograms.exe

pid	process
1484	cmd.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

vmzeus_3.2.3.1.vir.exeagentMediaCenterPrograms.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\WINE	vmzeus_3.2.3.1.vir.exe
Key opened	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\WINE	agentMediaCenterPrograms.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

vmzeus_3.2.3.1.vir.exeagentMediaCenterPrograms.exe

pid process

1496 vmzeus_3.2.3.1.vir.exe
336 agentMediaCenterPrograms.exe

pid	process
1496	vmzeus_3.2.3.1.vir.exe
336	agentMediaCenterPrograms.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

vmzeus_3.2.3.1.vir.exevmzeus_3.2.3.1.vir.exeagentMediaCenterPrograms.exe

description	pid	process	target process
PID 1496 wrote to memory of 308	1496	vmzeus_3.2.3.1.vir.exe	vmzeus_3.2.3.1.vir.exe
PID 1496 wrote to memory of 308	1496	vmzeus_3.2.3.1.vir.exe	vmzeus_3.2.3.1.vir.exe
PID 1496 wrote to memory of 308	1496	vmzeus_3.2.3.1.vir.exe	vmzeus_3.2.3.1.vir.exe
PID 1496 wrote to memory of 308	1496	vmzeus_3.2.3.1.vir.exe	vmzeus_3.2.3.1.vir.exe
PID 1496 wrote to memory of 308	1496	vmzeus_3.2.3.1.vir.exe	vmzeus_3.2.3.1.vir.exe
PID 1496 wrote to memory of 308	1496	vmzeus_3.2.3.1.vir.exe	vmzeus_3.2.3.1.vir.exe
PID 1496 wrote to memory of 308	1496	vmzeus_3.2.3.1.vir.exe	vmzeus_3.2.3.1.vir.exe
PID 1496 wrote to memory of 308	1496	vmzeus_3.2.3.1.vir.exe	vmzeus_3.2.3.1.vir.exe
PID 1496 wrote to memory of 308	1496	vmzeus_3.2.3.1.vir.exe	vmzeus_3.2.3.1.vir.exe
PID 308 wrote to memory of 336	308	vmzeus_3.2.3.1.vir.exe	agentMediaCenterPrograms.exe
PID 308 wrote to memory of 336	308	vmzeus_3.2.3.1.vir.exe	agentMediaCenterPrograms.exe
PID 308 wrote to memory of 336	308	vmzeus_3.2.3.1.vir.exe	agentMediaCenterPrograms.exe
PID 308 wrote to memory of 336	308	vmzeus_3.2.3.1.vir.exe	agentMediaCenterPrograms.exe
PID 336 wrote to memory of 1040	336	agentMediaCenterPrograms.exe	agentMediaCenterPrograms.exe
PID 336 wrote to memory of 1040	336	agentMediaCenterPrograms.exe	agentMediaCenterPrograms.exe
PID 336 wrote to memory of 1040	336	agentMediaCenterPrograms.exe	agentMediaCenterPrograms.exe
PID 336 wrote to memory of 1040	336	agentMediaCenterPrograms.exe	agentMediaCenterPrograms.exe
PID 336 wrote to memory of 1040	336	agentMediaCenterPrograms.exe	agentMediaCenterPrograms.exe
PID 336 wrote to memory of 1040	336	agentMediaCenterPrograms.exe	agentMediaCenterPrograms.exe
PID 336 wrote to memory of 1040	336	agentMediaCenterPrograms.exe	agentMediaCenterPrograms.exe
PID 336 wrote to memory of 1040	336	agentMediaCenterPrograms.exe	agentMediaCenterPrograms.exe
PID 336 wrote to memory of 1040	336	agentMediaCenterPrograms.exe	agentMediaCenterPrograms.exe
PID 308 wrote to memory of 1484	308	vmzeus_3.2.3.1.vir.exe	cmd.exe
PID 308 wrote to memory of 1484	308	vmzeus_3.2.3.1.vir.exe	cmd.exe
PID 308 wrote to memory of 1484	308	vmzeus_3.2.3.1.vir.exe	cmd.exe
PID 308 wrote to memory of 1484	308	vmzeus_3.2.3.1.vir.exe	cmd.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

vmzeus_3.2.3.1.vir.exeagentMediaCenterPrograms.exe

description	pid	process	target process
PID 1496 set thread context of 308	1496	vmzeus_3.2.3.1.vir.exe	vmzeus_3.2.3.1.vir.exe
PID 336 set thread context of 1040	336	agentMediaCenterPrograms.exe	agentMediaCenterPrograms.exe

Loads dropped DLL 2 IoCs

Processes:

vmzeus_3.2.3.1.vir.exe

pid process

308 vmzeus_3.2.3.1.vir.exe
308 vmzeus_3.2.3.1.vir.exe

pid	process
308	vmzeus_3.2.3.1.vir.exe
308	vmzeus_3.2.3.1.vir.exe

C:\Users\Admin\AppData\Local\Temp\vmzeus_3.2.3.1.vir.exe
"C:\Users\Admin\AppData\Local\Temp\vmzeus_3.2.3.1.vir.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1496

C:\Users\Admin\AppData\Local\Temp\vmzeus_3.2.3.1.vir.exe
"C:\Users\Admin\AppData\Local\Temp\vmzeus_3.2.3.1.vir.exe"
2⤵
- Identifies Wine through registry keys
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
PID:308

C:\Users\Admin\AppData\Roaming\Media Center Programs\agentMediaCenterPrograms.exe
"C:\Users\Admin\AppData\Roaming\Media Center Programs\agentMediaCenterPrograms.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:336

C:\Users\Admin\AppData\Roaming\Media Center Programs\agentMediaCenterPrograms.exe
"C:\Users\Admin\AppData\Roaming\Media Center Programs\agentMediaCenterPrograms.exe"
4⤵
- Executes dropped EXE
- Identifies Wine through registry keys
PID:1040

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpb3d86cf4.bat"
3⤵
- Deletes itself
PID:1484

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

1

T1012

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpb3d86cf4.bat

Download Submit
C:\Users\Admin\AppData\Roaming\Media Center Programs\agentMediaCenterPrograms.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Media Center Programs\agentMediaCenterPrograms.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Media Center Programs\agentMediaCenterPrograms.exe

Download Submit
\Users\Admin\AppData\Roaming\Media Center Programs\agentMediaCenterPrograms.exe

Download Submit
\Users\Admin\AppData\Roaming\Media Center Programs\agentMediaCenterPrograms.exe

Download Submit
memory/308-3-0x0000000000424A04-mapping.dmp

Download
memory/308-5-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/308-2-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/336-18-0x0000000001CA0000-0x0000000001CA4000-memory.dmp

Filesize
16KB

Download
memory/336-9-0x0000000000000000-mapping.dmp

Download
memory/336-19-0x00000000027E0000-0x00000000027E4000-memory.dmp

Filesize
16KB

Download
memory/1040-15-0x0000000000424A04-mapping.dmp

Download
memory/1484-20-0x0000000000000000-mapping.dmp

Download
memory/1496-6-0x0000000002760000-0x0000000002764000-memory.dmp

Filesize
16KB

Download
memory/1496-4-0x00000000004B0000-0x00000000004B4000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads