Overview

overview

10

Static

static

Zoom.exe

windows7-x64

8

Zoom.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Zoom.exe

  • Size

    700.0MB

  • Sample

    220912-sszxrsdef7

  • MD5

    19aff3d6ed110a9037aff507cac4077f

  • SHA1

    caa99a9682d20e657b58d9d508f6d4921d6b606b

  • SHA256

    f2efaa8e2d001d9c7872ab0a374480bec010aeaa9dbdb932cc058530ad125217

  • SHA512

    aeb18af24d7eb2459ba39955fc34ae3169d3f0e51a015af1b55dc13646848bbe1505c6c2966bd61918d2e5b61b2c29101769404d0f261c7b5b96701d4bd7e283

  • SSDEEP

    393216:eyZAs/vU7EM9/95+v4tnCedg+lMuMKaQrREdgBuTsOliTQJOZf2pmbr:e48Q3v4tCugmbf/oNOl6wr

Score
10/10
discoverypersistencespywarestealer

Malware Config

Targets

    • Target

      Zoom.exe

    • Size

      700.0MB

    • MD5

      19aff3d6ed110a9037aff507cac4077f

    • SHA1

      caa99a9682d20e657b58d9d508f6d4921d6b606b

    • SHA256

      f2efaa8e2d001d9c7872ab0a374480bec010aeaa9dbdb932cc058530ad125217

    • SHA512

      aeb18af24d7eb2459ba39955fc34ae3169d3f0e51a015af1b55dc13646848bbe1505c6c2966bd61918d2e5b61b2c29101769404d0f261c7b5b96701d4bd7e283

    • SSDEEP

      393216:eyZAs/vU7EM9/95+v4tnCedg+lMuMKaQrREdgBuTsOliTQJOZf2pmbr:e48Q3v4tCugmbf/oNOl6wr

    Score
    10/10
    discoverypersistencespywarestealer

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks