Analysis
- max time kernel
119s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
30/09/2022, 17:51
General
- Target 1384cc588ec40608f603b100e6fe9d1a339fc9453fc4ca46c863cd9863fc7d1b.exe
- Size 48KB
- Sample220930-we5gwaecd3
- SHA256 1384cc588ec40608f603b100e6fe9d1a339fc9453fc4ca46c863cd9863fc7d1b
Malware Config
Signatures
- Zingo stealer
Zingo is an info stealer first seen in March 2022.
- Downloads MZ/PE file
- Loads dropped DLL 7 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1384cc588ec40608f603b100e6fe9d1a339fc9453fc4ca46c863cd9863fc7d1b.exe"C:\Users\Admin\AppData\Local\Temp\1384cc588ec40608f603b100e6fe9d1a339fc9453fc4ca46c863cd9863fc7d1b.exe"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
DotNetZip.dll
DotNetZip.dll
Newtonsoft.Json.dll
Newtonsoft.Json.dll
System.Data.SQLite.dll
System.Data.SQLite.dll
SQLite.Interop.dll
memory/4892-143-0x0000000007B30000-0x0000000007CF2000-memory.dmp
memory/4892-132-0x0000000000BD0000-0x0000000000BE2000-memory.dmp
memory/4892-139-0x00000000063D0000-0x00000000063F2000-memory.dmp
memory/4892-142-0x0000000006470000-0x00000000064D2000-memory.dmp
memory/4892-137-0x0000000007550000-0x0000000007600000-memory.dmp
memory/4892-138-0x0000000006140000-0x0000000006190000-memory.dmp
memory/4892-145-0x0000000008BE0000-0x0000000008C1C000-memory.dmp
memory/4892-146-0x0000000008E20000-0x0000000008E86000-memory.dmp
memory/4892-134-0x00000000064F0000-0x0000000006A94000-memory.dmp
memory/4892-133-0x0000000001370000-0x0000000001402000-memory.dmp
memory/4892-149-0x0000000008FD0000-0x000000000904A000-memory.dmp