Analysis
-
max time kernel
0s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
22/12/2023, 14:56
General
-
Target
d030ec06a1d021fb435d8459a929db7b.exe
-
Size
731KB
-
MD5
d030ec06a1d021fb435d8459a929db7b
-
SHA1
155e20d350f9d2223bdd9c5dc30ad2969f077487
-
SHA256
cf53005d2d146dadf6dc95287bbcd1a50c8687711ebf8d497535f14ae423d6c3
-
SHA512
f46a8fd4016911c8bea1c579b89899173d65e019d8caae6ada6bac52d4a85ee734294b9622ce762d255fb0c6903e1040b33fdc71fecffd8d70ec225624b07786
-
SSDEEP
12288:aPOlblXqp28GxW8ULUwC5Y/pT2UZI2PvSSR0o6y2/:aUtqpDCHU4MpT2UVPvSSR0o6y2
Malware Config
Extracted
xloader
2.3
u6f4
cleverokids.site
thecannabisawards.vegas
shopbelleofthebarns.com
digitalizamimundo.com
surschool.com
lowbrowprintshop.com
gx17.net
transformafter50.info
lilygildersguild.com
hubcitypaving.com
safemarketingagency.net
suka-cbd.com
leseditionstadine.com
affreciea.com
lamozi.com
csliu.com
drgustavoamadorotorrino.com
trimatrik.digital
diamondtoolz.net
lumerianpriestess.com
Signatures
-
Detect ZGRat V1 19 IoCs
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Xloader payload 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d030ec06a1d021fb435d8459a929db7b.exe"C:\Users\Admin\AppData\Local\Temp\d030ec06a1d021fb435d8459a929db7b.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com2⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com2⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com2⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com2⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com2⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com2⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com2⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com2⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com2⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\d030ec06a1d021fb435d8459a929db7b.exeC:\Users\Admin\AppData\Local\Temp\d030ec06a1d021fb435d8459a929db7b.exe2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD5913b74a15a7cf9d3ecc93650a575acf6
SHA1a1d2aa4f7a84e2d270cac5668c832de014bba0ea
SHA2568f1aa7992b4c8f0b127f547cd248254a9e9d680514010ea13d498a73500f4581
SHA512eeff0b2b2a8129a7d59d43ab855cdef1ddac6c773f9774bcd506a973a7645ab3f8558acaf880f7c0205ac87fc4be5e8414194158219da89b1ba07fd5a1f78b3d
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
336KB
-
Filesize
256KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
6.9MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
336KB
-
Filesize
408KB
-
Filesize
336KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
752KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
408KB
-
Filesize
6.9MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
336KB
-
Filesize
432KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
360KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
160KB
-
Filesize
3.0MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
5.7MB