Analysis
-
max time kernel
46s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
submitted
22-09-2022 12:24
Static task
static1
Behavioral task
behavioral1
Sample
241876c671f56d4e0ccf4333735882567ca8dbf73c893bb8ba971d8aaf144407.exe
Resource
win7-20220812-en
General
-
Target
241876c671f56d4e0ccf4333735882567ca8dbf73c893bb8ba971d8aaf144407.exe
-
Size
170KB
-
MD5
ffbe42e28872589bf30ee47453cf7317
-
SHA1
a635d9935407edc15fb3c8009a9b0c79eac30349
-
SHA256
241876c671f56d4e0ccf4333735882567ca8dbf73c893bb8ba971d8aaf144407
-
SHA512
1ee2b2613c9ac09ac14f2baeadd726b365d6e3dd678102f3c37057ccd0aadba52417e1a95f2ad1adf5dd15cc613ddfe84b4b2a61fca24113fe96d053bfa9094a
-
SSDEEP
3072:8t65yT29uuZxb6jJqLK/B39FCITOYfc/PmDfMZUzZciGabJ:8+79umbFO/FCITOYfc/PmDfMZUzZciGw
Malware Config
Signatures
-
Zingo stealer payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1972-54-0x0000000001060000-0x0000000001094000-memory.dmp family_zingo -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 10 freegeoip.app 9 freegeoip.app -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1312 1972 WerFault.exe 241876c671f56d4e0ccf4333735882567ca8dbf73c893bb8ba971d8aaf144407.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
241876c671f56d4e0ccf4333735882567ca8dbf73c893bb8ba971d8aaf144407.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 241876c671f56d4e0ccf4333735882567ca8dbf73c893bb8ba971d8aaf144407.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 241876c671f56d4e0ccf4333735882567ca8dbf73c893bb8ba971d8aaf144407.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
241876c671f56d4e0ccf4333735882567ca8dbf73c893bb8ba971d8aaf144407.exedescription pid process Token: SeDebugPrivilege 1972 241876c671f56d4e0ccf4333735882567ca8dbf73c893bb8ba971d8aaf144407.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
241876c671f56d4e0ccf4333735882567ca8dbf73c893bb8ba971d8aaf144407.exedescription pid process target process PID 1972 wrote to memory of 1312 1972 241876c671f56d4e0ccf4333735882567ca8dbf73c893bb8ba971d8aaf144407.exe WerFault.exe PID 1972 wrote to memory of 1312 1972 241876c671f56d4e0ccf4333735882567ca8dbf73c893bb8ba971d8aaf144407.exe WerFault.exe PID 1972 wrote to memory of 1312 1972 241876c671f56d4e0ccf4333735882567ca8dbf73c893bb8ba971d8aaf144407.exe WerFault.exe PID 1972 wrote to memory of 1312 1972 241876c671f56d4e0ccf4333735882567ca8dbf73c893bb8ba971d8aaf144407.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\241876c671f56d4e0ccf4333735882567ca8dbf73c893bb8ba971d8aaf144407.exe"C:\Users\Admin\AppData\Local\Temp\241876c671f56d4e0ccf4333735882567ca8dbf73c893bb8ba971d8aaf144407.exe"
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 1644
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Downloads
-
memory/1312-57-0x0000000000000000-mapping.dmp
-
memory/1972-54-0x0000000001060000-0x0000000001094000-memory.dmpFilesize
208KB
-
memory/1972-55-0x0000000000260000-0x0000000000266000-memory.dmpFilesize
24KB
-
memory/1972-56-0x00000000756B1000-0x00000000756B3000-memory.dmpFilesize
8KB