Resubmissions
06-11-2022 16:59
221106-vhpedsedgq 1030-09-2022 19:00
220930-xnsecafdhk 1022-09-2022 12:24
220922-pk8cdsfcal 7Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
06-11-2022 16:59
Behavioral task
behavioral1
Sample
52fc3da5be0665ee88bba8944b8385002df205bc83d3c68e969d980227937238.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
52fc3da5be0665ee88bba8944b8385002df205bc83d3c68e969d980227937238.exe
Resource
win10-20220812-en
General
-
Target
52fc3da5be0665ee88bba8944b8385002df205bc83d3c68e969d980227937238.exe
-
Size
184KB
-
MD5
18ee404c378f88028bb9f62b60ce03fd
-
SHA1
c0e7e9cb52e0d9ca9efd986f56f039dff0713c98
-
SHA256
52fc3da5be0665ee88bba8944b8385002df205bc83d3c68e969d980227937238
-
SHA512
2343152375ea206f6cb0069e82cb913e1e9c5f62a3777c2a99d180b4489cb14c8546f1279a66a4735a013d88a12db4ce2ee0d9d5c047e8036640820f877bfdaa
-
SSDEEP
3072:Cl93zZHgog3iyNN9ufkEJ9jAOQVF+YFXL/uHVtS9Hzy1Q/iAHMP8Enu+2:CXzZHgBiy7nE/SVF+YFXL/uHVtS9Hzyz
Malware Config
Signatures
-
Zingo stealer payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4660-148-0x00000000007D0000-0x0000000000808000-memory.dmp family_zingo -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 8 freegeoip.app 9 freegeoip.app -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1972 4660 WerFault.exe 52fc3da5be0665ee88bba8944b8385002df205bc83d3c68e969d980227937238.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
52fc3da5be0665ee88bba8944b8385002df205bc83d3c68e969d980227937238.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 52fc3da5be0665ee88bba8944b8385002df205bc83d3c68e969d980227937238.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 52fc3da5be0665ee88bba8944b8385002df205bc83d3c68e969d980227937238.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
52fc3da5be0665ee88bba8944b8385002df205bc83d3c68e969d980227937238.exedescription pid process Token: SeDebugPrivilege 4660 52fc3da5be0665ee88bba8944b8385002df205bc83d3c68e969d980227937238.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\52fc3da5be0665ee88bba8944b8385002df205bc83d3c68e969d980227937238.exe"C:\Users\Admin\AppData\Local\Temp\52fc3da5be0665ee88bba8944b8385002df205bc83d3c68e969d980227937238.exe"1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4660 -s 19362⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4660-116-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-117-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-118-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-119-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-120-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-121-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-122-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-123-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-125-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-124-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-126-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-127-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-128-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-129-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-130-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-131-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-133-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-132-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-134-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-135-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-136-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-137-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-138-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-139-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-140-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-141-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-142-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-143-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-144-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-145-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-146-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-147-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-148-0x00000000007D0000-0x0000000000808000-memory.dmpFilesize
224KB
-
memory/4660-149-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-150-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-151-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-152-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-153-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-154-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-155-0x0000000000D30000-0x0000000000D36000-memory.dmpFilesize
24KB
-
memory/4660-156-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-158-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-157-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-159-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-160-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-161-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-162-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-163-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-164-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-165-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-166-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-167-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-168-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-169-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-170-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-171-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-172-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-173-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-174-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-175-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-176-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-177-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-179-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-180-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-178-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-181-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4660-187-0x0000000005990000-0x0000000005A22000-memory.dmpFilesize
584KB
-
memory/4660-188-0x00000000062B0000-0x00000000067AE000-memory.dmpFilesize
5.0MB
-
memory/4660-200-0x0000000008500000-0x00000000086C2000-memory.dmpFilesize
1.8MB
-
memory/4660-201-0x0000000007140000-0x00000000071A6000-memory.dmpFilesize
408KB