Analysis
- max time kernel
45s - max time network
49s - platform
windows7_x64 - resource
win7-20220901-en - resource tags
- submitted
30/09/2022, 17:51
General
- Target fdad86b2ec983b35f5b1970a3635af5a02ae2269e0f5fe1a744d05d7c3105ee6.exe
- Size 316KB
- Sample220930-wfdesafceq
- SHA256 fdad86b2ec983b35f5b1970a3635af5a02ae2269e0f5fe1a744d05d7c3105ee6
Malware Config
Signatures
- Zingo stealer
Zingo is an info stealer first seen in March 2022.
- Downloads MZ/PE file
- VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
- Loads dropped DLL 9 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fdad86b2ec983b35f5b1970a3635af5a02ae2269e0f5fe1a744d05d7c3105ee6.exe"C:\Users\Admin\AppData\Local\Temp\fdad86b2ec983b35f5b1970a3635af5a02ae2269e0f5fe1a744d05d7c3105ee6.exe"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
DotNetZip.dll
DotNetZip.dll
Newtonsoft.Json.dll
Newtonsoft.Json.dll
Newtonsoft.Json.dll
Newtonsoft.Json.dll
System.Data.SQLite.dll
System.Data.SQLite.dll
SQLite.Interop.dll
memory/1064-54-0x0000000001110000-0x000000000119C000-memory.dmp
memory/1064-65-0x0000000009D80000-0x0000000009DE2000-memory.dmp
memory/1064-67-0x0000000000C10000-0x0000000000C30000-memory.dmp
memory/1064-60-0x0000000009F70000-0x000000000A020000-memory.dmp
memory/1064-57-0x0000000075BB1000-0x0000000075BB3000-memory.dmp
memory/1064-70-0x0000000006C10000-0x0000000006C8A000-memory.dmp