Malware Analysis Report

2025-03-14 22:52

Sample ID 240406-1h3vnsce25
Target 621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5
SHA256 621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5
Tags
evasion persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5

Threat Level: Known bad

The file 621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5 was found to be: Known bad.

Malicious Activity Summary

evasion persistence

Modifies visiblity of hidden/system files in Explorer

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-06 21:39

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-06 21:39

Reported

2024-04-06 21:42

Platform

win7-20240319-en

Max time kernel

150s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe"

Signatures

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Users\Admin\pgmiz.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\pgmiz.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\pgmiz = "C:\\Users\\Admin\\pgmiz.exe" C:\Users\Admin\pgmiz.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe N/A
N/A N/A C:\Users\Admin\pgmiz.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2084 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe C:\Users\Admin\pgmiz.exe
PID 2084 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe C:\Users\Admin\pgmiz.exe
PID 2084 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe C:\Users\Admin\pgmiz.exe
PID 2084 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe C:\Users\Admin\pgmiz.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2484 wrote to memory of 2084 N/A C:\Users\Admin\pgmiz.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe

Processes

C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe

"C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe"

C:\Users\Admin\pgmiz.exe

"C:\Users\Admin\pgmiz.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 ns4.thepicturehut.net udp

Files

C:\Users\Admin\pgmiz.exe

MD5 cce85c227ce027e183aa33a3f0524f25
SHA1 08aa875ad7ecd232df53ec98974d6c8552d40615
SHA256 ddae98501c278c81a9895f8aca76e5ded2b67db17d0a69cefc98056ef6570c0d
SHA512 f9826be91a831e83e98aa4986475c584652aa6095e8b4696b7487ef864e89f9812f024195153047dfa927b0a73cadd4772fd8b62128e61f00663bbea8bedbc81

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-06 21:39

Reported

2024-04-06 21:42

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe"

Signatures

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Users\Admin\zeuce.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\zeuce.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeuce = "C:\\Users\\Admin\\zeuce.exe" C:\Users\Admin\zeuce.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe N/A
N/A N/A C:\Users\Admin\zeuce.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3608 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe C:\Users\Admin\zeuce.exe
PID 3608 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe C:\Users\Admin\zeuce.exe
PID 3608 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe C:\Users\Admin\zeuce.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe
PID 2704 wrote to memory of 3608 N/A C:\Users\Admin\zeuce.exe C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe

Processes

C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe

"C:\Users\Admin\AppData\Local\Temp\621f1e5a75e96ce621e64786298188f3eded0bce004463b398bb3ea24e97def5.exe"

C:\Users\Admin\zeuce.exe

"C:\Users\Admin\zeuce.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 ns2.thepicturehut.net udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 udp

Files

C:\Users\Admin\zeuce.exe

MD5 5289a13ccffae12e0d26deac6c970809
SHA1 a5345a5598be211f0adb1e3c7d658d874f2705a6
SHA256 50e0155c8e39ef9c39b366f183846c684e42638a47c1caa74d0cb2240caafbc3
SHA512 8349cf77abe8bdf7f406ba00b826120c476e02d90b069e91de007fca09be6d1000ab15057b5af5f7a6d45b114d779ddb61333810ba7f57c85b47282779c91e30