Resubmissions
06-11-2022 16:59
221106-vhpedsedgq 1030-09-2022 19:00
220930-xnsecafdhk 1022-09-2022 12:24
220922-pk8cdsfcal 7Analysis
-
max time kernel
93s -
max time network
96s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
30-09-2022 19:00
General
-
Target
52fc3da5be0665ee88bba8944b8385002df205bc83d3c68e969d980227937238.exe
-
Size
184KB
-
MD5
18ee404c378f88028bb9f62b60ce03fd
-
SHA1
c0e7e9cb52e0d9ca9efd986f56f039dff0713c98
-
SHA256
52fc3da5be0665ee88bba8944b8385002df205bc83d3c68e969d980227937238
-
SHA512
2343152375ea206f6cb0069e82cb913e1e9c5f62a3777c2a99d180b4489cb14c8546f1279a66a4735a013d88a12db4ce2ee0d9d5c047e8036640820f877bfdaa
-
SSDEEP
3072:Cl93zZHgog3iyNN9ufkEJ9jAOQVF+YFXL/uHVtS9Hzy1Q/iAHMP8Enu+2:CXzZHgBiy7nE/SVF+YFXL/uHVtS9Hzyz
Malware Config
Signatures
-
Zingo stealer payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1628-148-0x0000000000A20000-0x0000000000A58000-memory.dmp family_zingo -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 11 freegeoip.app 12 freegeoip.app -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4904 1628 WerFault.exe 52fc3da5be0665ee88bba8944b8385002df205bc83d3c68e969d980227937238.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
52fc3da5be0665ee88bba8944b8385002df205bc83d3c68e969d980227937238.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 52fc3da5be0665ee88bba8944b8385002df205bc83d3c68e969d980227937238.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 52fc3da5be0665ee88bba8944b8385002df205bc83d3c68e969d980227937238.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
52fc3da5be0665ee88bba8944b8385002df205bc83d3c68e969d980227937238.exedescription pid process Token: SeDebugPrivilege 1628 52fc3da5be0665ee88bba8944b8385002df205bc83d3c68e969d980227937238.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\52fc3da5be0665ee88bba8944b8385002df205bc83d3c68e969d980227937238.exe"C:\Users\Admin\AppData\Local\Temp\52fc3da5be0665ee88bba8944b8385002df205bc83d3c68e969d980227937238.exe"1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 23202⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1628-116-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-117-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-118-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-120-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-119-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-121-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-122-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-123-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-125-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-126-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-127-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-128-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-129-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-124-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-130-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-131-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-132-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-134-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-135-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-136-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-137-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-138-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-139-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-140-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-133-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-141-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-142-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-143-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-144-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-145-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-146-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-147-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-148-0x0000000000A20000-0x0000000000A58000-memory.dmpFilesize
224KB
-
memory/1628-149-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-150-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-151-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-152-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-153-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-154-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-155-0x0000000002BF0000-0x0000000002BF6000-memory.dmpFilesize
24KB
-
memory/1628-156-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-157-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-158-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-159-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-160-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-161-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-162-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-163-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-164-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-165-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-166-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-167-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-168-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-169-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-170-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-171-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-172-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-173-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-174-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-175-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-176-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-177-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-178-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-180-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-179-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-181-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/1628-195-0x000000000B0F0000-0x000000000B182000-memory.dmpFilesize
584KB
-
memory/1628-196-0x000000000B690000-0x000000000BB8E000-memory.dmpFilesize
5.0MB
-
memory/1628-201-0x000000000C810000-0x000000000C9D2000-memory.dmpFilesize
1.8MB
-
memory/1628-202-0x000000000C740000-0x000000000C7A6000-memory.dmpFilesize
408KB