d6e2e79e31eb5e0d8144deca05e9caffd7b78133d12f6a408edc7a86163c4d99 | Triage

Analysis

max time kernel
132s
max time network
47s
platform
windows10_x64
resource
win10v200430
submitted
19-07-2020 19:28

Sharing

Report Analysis Logs

General

Target

zeus 1_1.2.1.7.vir.exe
Size

39KB
MD5

0898b37a366f3aeec04a86151e1035e4
SHA1

980f5ac4d9b44591ddf91597554622a9e21eca96
SHA256

d6e2e79e31eb5e0d8144deca05e9caffd7b78133d12f6a408edc7a86163c4d99
SHA512

7bb0e9459fe8322034c294cc9e40ebac4e16f3322b0e3f49a609fbee24df206d8e270093d676c00467a127d7e534a8e3f5d3ade081c3d097976408f796b92511

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

zeus 1_1.2.1.7.vir.exe

description	pid	process	target process
PID 1300 wrote to memory of 1572	1300	zeus 1_1.2.1.7.vir.exe	cmd.exe
PID 1300 wrote to memory of 1572	1300	zeus 1_1.2.1.7.vir.exe	cmd.exe
PID 1300 wrote to memory of 1572	1300	zeus 1_1.2.1.7.vir.exe	cmd.exe
PID 1300 wrote to memory of 1840	1300	zeus 1_1.2.1.7.vir.exe	cmd.exe
PID 1300 wrote to memory of 1840	1300	zeus 1_1.2.1.7.vir.exe	cmd.exe
PID 1300 wrote to memory of 1840	1300	zeus 1_1.2.1.7.vir.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\zeus 1_1.2.1.7.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zeus 1_1.2.1.7.vir.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1300

C:\Windows\SysWOW64\cmd.exe
cmd /c copy "C:\Users\Admin\AppData\Local\Temp\zeus 1_1.2.1.7.vir.exe" "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
2⤵
PID:1572

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
2⤵
PID:1840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1572-0-0x0000000000000000-mapping.dmp

Download
memory/1840-1-0x0000000000000000-mapping.dmp

Download