Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
03/06/2024, 07:24
Behavioral task
behavioral1
Sample
CC generator/Zeo Gen.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
CC generator/Zeo Gen.exe
Resource
win10v2004-20240508-en
General
-
Target
CC generator/Zeo Gen.exe
-
Size
13.8MB
-
MD5
e401b8a0ff33bbd9fac216a4dcc58dc8
-
SHA1
8ec49af3c3efa518b5f0b8e35f1bbc9503567d35
-
SHA256
8ea82f3c6f29a82aaaec3a35f4cfd9227d532446a651947a3033c5ae5e8510b9
-
SHA512
73236c79c1ba371411dfede0a6f6b329a52326d93cf6c75c90e32e7a162f64b68b19d64e85f7ec3424191b89e2e585a25db1dc4253a204b7fe8c060963643eb2
-
SSDEEP
393216:0YS6kNaS/r076UJOshouIkPftRL54YRJY:0YS6kN/lUkwouTtRLzY
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2180 Zeo Gen.exe -
resource yara_rule behavioral1/files/0x00060000000167d5-22.dat upx behavioral1/memory/2180-24-0x000007FEF5930000-0x000007FEF5F19000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2180 2372 Zeo Gen.exe 28 PID 2372 wrote to memory of 2180 2372 Zeo Gen.exe 28 PID 2372 wrote to memory of 2180 2372 Zeo Gen.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\CC generator\Zeo Gen.exe"C:\Users\Admin\AppData\Local\Temp\CC generator\Zeo Gen.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\CC generator\Zeo Gen.exe"C:\Users\Admin\AppData\Local\Temp\CC generator\Zeo Gen.exe"2⤵
- Loads dropped DLL
PID:2180
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD55f6fd64ec2d7d73ae49c34dd12cedb23
SHA1c6e0385a868f3153a6e8879527749db52dce4125
SHA256ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967
SHA512c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab