Analysis
-
max time kernel
119s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-12-2023 18:19
Static task
static1
Behavioral task
behavioral1
Sample
33fe683a4f96d2b64616814f7473f9ad.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
33fe683a4f96d2b64616814f7473f9ad.exe
Resource
win10v2004-20231215-en
General
-
Target
33fe683a4f96d2b64616814f7473f9ad.exe
-
Size
486KB
-
MD5
33fe683a4f96d2b64616814f7473f9ad
-
SHA1
1dfecff86628341cb0f5208c6957a970e2729a99
-
SHA256
4b6d2d4d20ed03f56ffffc9c92549c99b7bd4494c7335790e9cae0e0b5824193
-
SHA512
3e8ae602b91151780f6b0c58f3409f19d7680ffd6bd979ee9c380966cf9442de06f031af4162da82204f87317c68bd59dc14a737e5e189b58171f343fd0963aa
-
SSDEEP
12288:tqXS3Nv68mo+UmaKOmGa1NoigDRlBda3w:wQtFYUUJUDX/a
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot1846829589:AAHSsEDTKvDOQ17YrNRY5_FXv5z4mpfGRIc/sendMessage?chat_id=1407381447
Signatures
-
Detect ZGRat V1 34 IoCs
Processes:
resource yara_rule behavioral1/memory/2540-6-0x0000000005F40000-0x0000000005FC0000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-8-0x0000000005F40000-0x0000000005FBB000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-7-0x0000000005F40000-0x0000000005FBB000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-20-0x0000000005F40000-0x0000000005FBB000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-38-0x0000000005F40000-0x0000000005FBB000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-54-0x0000000005F40000-0x0000000005FBB000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-64-0x0000000005F40000-0x0000000005FBB000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-70-0x0000000005F40000-0x0000000005FBB000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-68-0x0000000005F40000-0x0000000005FBB000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-66-0x0000000005F40000-0x0000000005FBB000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-62-0x0000000005F40000-0x0000000005FBB000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-60-0x0000000005F40000-0x0000000005FBB000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-58-0x0000000005F40000-0x0000000005FBB000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-56-0x0000000005F40000-0x0000000005FBB000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-52-0x0000000005F40000-0x0000000005FBB000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-50-0x0000000005F40000-0x0000000005FBB000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-48-0x0000000005F40000-0x0000000005FBB000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-46-0x0000000005F40000-0x0000000005FBB000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-44-0x0000000005F40000-0x0000000005FBB000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-42-0x0000000005F40000-0x0000000005FBB000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-40-0x0000000005F40000-0x0000000005FBB000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-36-0x0000000005F40000-0x0000000005FBB000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-34-0x0000000005F40000-0x0000000005FBB000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-32-0x0000000005F40000-0x0000000005FBB000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-30-0x0000000005F40000-0x0000000005FBB000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-28-0x0000000005F40000-0x0000000005FBB000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-26-0x0000000005F40000-0x0000000005FBB000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-24-0x0000000005F40000-0x0000000005FBB000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-22-0x0000000005F40000-0x0000000005FBB000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-18-0x0000000005F40000-0x0000000005FBB000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-16-0x0000000005F40000-0x0000000005FBB000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-14-0x0000000005F40000-0x0000000005FBB000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-12-0x0000000005F40000-0x0000000005FBB000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-10-0x0000000005F40000-0x0000000005FBB000-memory.dmp family_zgrat_v1 -
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1512-2448-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/1512-2450-0x0000000000590000-0x00000000005D0000-memory.dmp family_snakekeylogger -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 freegeoip.app 5 freegeoip.app 2 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
33fe683a4f96d2b64616814f7473f9ad.exedescription pid process target process PID 2540 set thread context of 1512 2540 33fe683a4f96d2b64616814f7473f9ad.exe 33fe683a4f96d2b64616814f7473f9ad.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1236 1512 WerFault.exe 33fe683a4f96d2b64616814f7473f9ad.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
33fe683a4f96d2b64616814f7473f9ad.exe33fe683a4f96d2b64616814f7473f9ad.exepid process 2540 33fe683a4f96d2b64616814f7473f9ad.exe 1512 33fe683a4f96d2b64616814f7473f9ad.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
33fe683a4f96d2b64616814f7473f9ad.exe33fe683a4f96d2b64616814f7473f9ad.exedescription pid process Token: SeDebugPrivilege 2540 33fe683a4f96d2b64616814f7473f9ad.exe Token: SeDebugPrivilege 1512 33fe683a4f96d2b64616814f7473f9ad.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
33fe683a4f96d2b64616814f7473f9ad.exe33fe683a4f96d2b64616814f7473f9ad.exedescription pid process target process PID 2540 wrote to memory of 1512 2540 33fe683a4f96d2b64616814f7473f9ad.exe 33fe683a4f96d2b64616814f7473f9ad.exe PID 2540 wrote to memory of 1512 2540 33fe683a4f96d2b64616814f7473f9ad.exe 33fe683a4f96d2b64616814f7473f9ad.exe PID 2540 wrote to memory of 1512 2540 33fe683a4f96d2b64616814f7473f9ad.exe 33fe683a4f96d2b64616814f7473f9ad.exe PID 2540 wrote to memory of 1512 2540 33fe683a4f96d2b64616814f7473f9ad.exe 33fe683a4f96d2b64616814f7473f9ad.exe PID 2540 wrote to memory of 1512 2540 33fe683a4f96d2b64616814f7473f9ad.exe 33fe683a4f96d2b64616814f7473f9ad.exe PID 2540 wrote to memory of 1512 2540 33fe683a4f96d2b64616814f7473f9ad.exe 33fe683a4f96d2b64616814f7473f9ad.exe PID 2540 wrote to memory of 1512 2540 33fe683a4f96d2b64616814f7473f9ad.exe 33fe683a4f96d2b64616814f7473f9ad.exe PID 2540 wrote to memory of 1512 2540 33fe683a4f96d2b64616814f7473f9ad.exe 33fe683a4f96d2b64616814f7473f9ad.exe PID 2540 wrote to memory of 1512 2540 33fe683a4f96d2b64616814f7473f9ad.exe 33fe683a4f96d2b64616814f7473f9ad.exe PID 1512 wrote to memory of 1236 1512 33fe683a4f96d2b64616814f7473f9ad.exe WerFault.exe PID 1512 wrote to memory of 1236 1512 33fe683a4f96d2b64616814f7473f9ad.exe WerFault.exe PID 1512 wrote to memory of 1236 1512 33fe683a4f96d2b64616814f7473f9ad.exe WerFault.exe PID 1512 wrote to memory of 1236 1512 33fe683a4f96d2b64616814f7473f9ad.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\33fe683a4f96d2b64616814f7473f9ad.exe"C:\Users\Admin\AppData\Local\Temp\33fe683a4f96d2b64616814f7473f9ad.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\33fe683a4f96d2b64616814f7473f9ad.exeC:\Users\Admin\AppData\Local\Temp\33fe683a4f96d2b64616814f7473f9ad.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 15243⤵
- Program crash
PID:1236