5c91e90a547e598c68f6ab7a607149e53872feac28386ffc3bea8d00fd1abed6

General

Target

zeus 1_1.2.4.2.vir.exe
Size

157KB
MD5

66213afc42b9176391f5a1abe6787b45
SHA1

49a6245c789982f3e6b425dfd6878dc45f388594
SHA256

5c91e90a547e598c68f6ab7a607149e53872feac28386ffc3bea8d00fd1abed6
SHA512

5ef65355f4338f82952a8d2983abf4b41355400d1e85869090d07af80eed1a7d511d64cec150526c646235a1d05cfbc917f49f6aff690665be35ef5bdf68d801

Score

5^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1432 WerFault.exe
1432 WerFault.exe
1432 WerFault.exe
1432 WerFault.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

zeus 1_1.2.4.2.vir.exezeus 1_1.2.4.2.vir.exe

description	pid	process	target process
PID 1064 wrote to memory of 1212	1064	zeus 1_1.2.4.2.vir.exe	zeus 1_1.2.4.2.vir.exe
PID 1064 wrote to memory of 1212	1064	zeus 1_1.2.4.2.vir.exe	zeus 1_1.2.4.2.vir.exe
PID 1064 wrote to memory of 1212	1064	zeus 1_1.2.4.2.vir.exe	zeus 1_1.2.4.2.vir.exe
PID 1064 wrote to memory of 1212	1064	zeus 1_1.2.4.2.vir.exe	zeus 1_1.2.4.2.vir.exe
PID 1064 wrote to memory of 1212	1064	zeus 1_1.2.4.2.vir.exe	zeus 1_1.2.4.2.vir.exe
PID 1064 wrote to memory of 1212	1064	zeus 1_1.2.4.2.vir.exe	zeus 1_1.2.4.2.vir.exe
PID 1064 wrote to memory of 1212	1064	zeus 1_1.2.4.2.vir.exe	zeus 1_1.2.4.2.vir.exe
PID 1064 wrote to memory of 1212	1064	zeus 1_1.2.4.2.vir.exe	zeus 1_1.2.4.2.vir.exe
PID 1064 wrote to memory of 1212	1064	zeus 1_1.2.4.2.vir.exe	zeus 1_1.2.4.2.vir.exe
PID 1212 wrote to memory of 1432	1212	zeus 1_1.2.4.2.vir.exe	WerFault.exe
PID 1212 wrote to memory of 1432	1212	zeus 1_1.2.4.2.vir.exe	WerFault.exe
PID 1212 wrote to memory of 1432	1212	zeus 1_1.2.4.2.vir.exe	WerFault.exe
PID 1212 wrote to memory of 1432	1212	zeus 1_1.2.4.2.vir.exe	WerFault.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

zeus 1_1.2.4.2.vir.exe

description pid process target process

PID 1064 set thread context of 1212 1064 zeus 1_1.2.4.2.vir.exe zeus 1_1.2.4.2.vir.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1432 1212 WerFault.exe zeus 1_1.2.4.2.vir.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1432 WerFault.exe

description	pid	process	target process
PID 1064 set thread context of 1212	1064	zeus 1_1.2.4.2.vir.exe	zeus 1_1.2.4.2.vir.exe

pid	pid_target	process	target process
1432	1212	WerFault.exe	zeus 1_1.2.4.2.vir.exe

description	pid	process
Token: SeDebugPrivilege	1432	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\zeus 1_1.2.4.2.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zeus 1_1.2.4.2.vir.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1212

memory/1212-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1212-1-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1212-2-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1212-4-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1212-5-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1212-6-0x0000000000404C5D-mapping.dmp

Download
memory/1212-7-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1212-10-0x0000000000404C5D-mapping.dmp

Download
memory/1432-8-0x0000000000000000-mapping.dmp

Download
memory/1432-9-0x0000000001F50000-0x0000000001F61000-memory.dmp

Filesize
68KB

Download
memory/1432-11-0x0000000002640000-0x0000000002651000-memory.dmp

Filesize
68KB

Download