Analysis
-
max time kernel
150s -
max time network
110s -
platform
windows10_x64 -
resource
win10 -
submitted
19-07-2020 19:25
Static task
static1
Behavioral task
behavioral1
Sample
vmzeus_3.2.3.1.vir.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
vmzeus_3.2.3.1.vir.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
vmzeus_3.2.3.1.vir.exe
-
Size
279KB
-
MD5
0f09d8d3edf0e06e79fb15df680be3ac
-
SHA1
4881a85b7531ed2211e0c722a5bb1c9e9c522c54
-
SHA256
e3e1334530a63bb70e51fdd7c28ad51bfcdff8022d393a8dbbd6a398e90ff12c
-
SHA512
753302eb82312b86e997e5ea7644fb9de0dc240eaf8c6d6e912f4f73528ef691692384bd57cd74cc5f521c90718463376d4484e3c29525e1c0add2577fd5890d
Score
8/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
MozillaMgr.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\Currentversion\Run MozillaMgr.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\{0B8F1DEE-1A63-46D8-D410-AB1E7675A2C3} = "C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\MozillaMgr.exe" MozillaMgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
vmzeus_3.2.3.1.vir.exeMozillaMgr.exepid process 2728 vmzeus_3.2.3.1.vir.exe 3844 MozillaMgr.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
vmzeus_3.2.3.1.vir.exevmzeus_3.2.3.1.vir.exeMozillaMgr.exedescription pid process target process PID 2728 wrote to memory of 3596 2728 vmzeus_3.2.3.1.vir.exe vmzeus_3.2.3.1.vir.exe PID 2728 wrote to memory of 3596 2728 vmzeus_3.2.3.1.vir.exe vmzeus_3.2.3.1.vir.exe PID 2728 wrote to memory of 3596 2728 vmzeus_3.2.3.1.vir.exe vmzeus_3.2.3.1.vir.exe PID 2728 wrote to memory of 3596 2728 vmzeus_3.2.3.1.vir.exe vmzeus_3.2.3.1.vir.exe PID 2728 wrote to memory of 3596 2728 vmzeus_3.2.3.1.vir.exe vmzeus_3.2.3.1.vir.exe PID 2728 wrote to memory of 3596 2728 vmzeus_3.2.3.1.vir.exe vmzeus_3.2.3.1.vir.exe PID 2728 wrote to memory of 3596 2728 vmzeus_3.2.3.1.vir.exe vmzeus_3.2.3.1.vir.exe PID 2728 wrote to memory of 3596 2728 vmzeus_3.2.3.1.vir.exe vmzeus_3.2.3.1.vir.exe PID 3596 wrote to memory of 3844 3596 vmzeus_3.2.3.1.vir.exe MozillaMgr.exe PID 3596 wrote to memory of 3844 3596 vmzeus_3.2.3.1.vir.exe MozillaMgr.exe PID 3596 wrote to memory of 3844 3596 vmzeus_3.2.3.1.vir.exe MozillaMgr.exe PID 3844 wrote to memory of 4080 3844 MozillaMgr.exe MozillaMgr.exe PID 3844 wrote to memory of 4080 3844 MozillaMgr.exe MozillaMgr.exe PID 3844 wrote to memory of 4080 3844 MozillaMgr.exe MozillaMgr.exe PID 3844 wrote to memory of 4080 3844 MozillaMgr.exe MozillaMgr.exe PID 3844 wrote to memory of 4080 3844 MozillaMgr.exe MozillaMgr.exe PID 3844 wrote to memory of 4080 3844 MozillaMgr.exe MozillaMgr.exe PID 3844 wrote to memory of 4080 3844 MozillaMgr.exe MozillaMgr.exe PID 3844 wrote to memory of 4080 3844 MozillaMgr.exe MozillaMgr.exe PID 3596 wrote to memory of 1884 3596 vmzeus_3.2.3.1.vir.exe cmd.exe PID 3596 wrote to memory of 1884 3596 vmzeus_3.2.3.1.vir.exe cmd.exe PID 3596 wrote to memory of 1884 3596 vmzeus_3.2.3.1.vir.exe cmd.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
vmzeus_3.2.3.1.vir.exeMozillaMgr.exedescription pid process target process PID 2728 set thread context of 3596 2728 vmzeus_3.2.3.1.vir.exe vmzeus_3.2.3.1.vir.exe PID 3844 set thread context of 4080 3844 MozillaMgr.exe MozillaMgr.exe -
Executes dropped EXE 2 IoCs
Processes:
MozillaMgr.exeMozillaMgr.exepid process 3844 MozillaMgr.exe 4080 MozillaMgr.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
MozillaMgr.exepid process 4080 MozillaMgr.exe -
Suspicious behavior: EnumeratesProcesses 116 IoCs
Processes:
MozillaMgr.exepid process 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe 4080 MozillaMgr.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
vmzeus_3.2.3.1.vir.exeMozillaMgr.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\WINE vmzeus_3.2.3.1.vir.exe Key opened \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\WINE MozillaMgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\vmzeus_3.2.3.1.vir.exe"C:\Users\Admin\AppData\Local\Temp\vmzeus_3.2.3.1.vir.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\vmzeus_3.2.3.1.vir.exe"C:\Users\Admin\AppData\Local\Temp\vmzeus_3.2.3.1.vir.exe"2⤵
- Suspicious use of WriteProcessMemory
- Identifies Wine through registry keys
-
C:\Users\Admin\AppData\Roaming\Mozilla\MozillaMgr.exe"C:\Users\Admin\AppData\Roaming\Mozilla\MozillaMgr.exe"3⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Mozilla\MozillaMgr.exe"C:\Users\Admin\AppData\Roaming\Mozilla\MozillaMgr.exe"4⤵
- Adds Run key to start application
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious behavior: EnumeratesProcesses
- Identifies Wine through registry keys
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp879321f8.bat"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp879321f8.bat
-
C:\Users\Admin\AppData\Roaming\Mozilla\MozillaMgr.exe
-
C:\Users\Admin\AppData\Roaming\Mozilla\MozillaMgr.exe
-
C:\Users\Admin\AppData\Roaming\Mozilla\MozillaMgr.exe
-
memory/1884-14-0x0000000000000000-mapping.dmp
-
memory/3596-2-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3596-3-0x0000000000424A04-mapping.dmp
-
memory/3596-4-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3844-5-0x0000000000000000-mapping.dmp
-
memory/4080-11-0x0000000000424A04-mapping.dmp