Analysis
-
max time kernel
162s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
28-12-2023 05:01
Static task
static1
Behavioral task
behavioral1
Sample
c58af9384d71e33bae1d8a032d9e7b19.exe
Resource
win7-20231215-en
General
-
Target
c58af9384d71e33bae1d8a032d9e7b19.exe
-
Size
4.0MB
-
MD5
c58af9384d71e33bae1d8a032d9e7b19
-
SHA1
15bd308104a7b2d05ba9fd03b3a4c5410afabc56
-
SHA256
77189b22dfb8238a4837f95e3283150bca8105d618cc421cde8170644bcf878b
-
SHA512
ac80eb00dcf2aec8a56e071281030b9c3ec57460b2a2c59b8db43ce51a60465a419ed1e5f887d7e2d8b41c0aaca226244bb52e7c72cccf44f477fcdad03aa3e8
-
SSDEEP
49152:PSzzgkLJWvg/RdFy7/QhWwALywBDyVt4kWzzwskrk4NZXuMk6o9ufAXV4AK:
Malware Config
Signatures
-
Detect ZGRat V1 2 IoCs
Processes:
resource yara_rule behavioral2/memory/988-96-0x0000000004BD0000-0x0000000004C6C000-memory.dmp family_zgrat_v1 behavioral2/memory/988-102-0x0000000005470000-0x000000000550A000-memory.dmp family_zgrat_v1 -
Detects Echelon Stealer payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\ChromeCache\ChromeCache.exe family_echelon behavioral2/memory/4984-7-0x0000000000890000-0x0000000000A14000-memory.dmp family_echelon -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ChromeCache.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation ChromeCache.exe -
Executes dropped EXE 2 IoCs
Processes:
ChromeCache.exeDecoder.exepid process 4984 ChromeCache.exe 988 Decoder.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 35 api.ipify.org 36 api.ipify.org 69 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2536 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
ChromeCache.exepid process 4984 ChromeCache.exe 4984 ChromeCache.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ChromeCache.exeDecoder.exedescription pid process Token: SeDebugPrivilege 4984 ChromeCache.exe Token: SeDebugPrivilege 988 Decoder.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
c58af9384d71e33bae1d8a032d9e7b19.exeChromeCache.execmd.exedescription pid process target process PID 1680 wrote to memory of 4984 1680 c58af9384d71e33bae1d8a032d9e7b19.exe ChromeCache.exe PID 1680 wrote to memory of 4984 1680 c58af9384d71e33bae1d8a032d9e7b19.exe ChromeCache.exe PID 4984 wrote to memory of 988 4984 ChromeCache.exe Decoder.exe PID 4984 wrote to memory of 988 4984 ChromeCache.exe Decoder.exe PID 4984 wrote to memory of 988 4984 ChromeCache.exe Decoder.exe PID 4984 wrote to memory of 4760 4984 ChromeCache.exe cmd.exe PID 4984 wrote to memory of 4760 4984 ChromeCache.exe cmd.exe PID 4760 wrote to memory of 2536 4760 cmd.exe timeout.exe PID 4760 wrote to memory of 2536 4760 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c58af9384d71e33bae1d8a032d9e7b19.exe"C:\Users\Admin\AppData\Local\Temp\c58af9384d71e33bae1d8a032d9e7b19.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Roaming\ChromeCache\ChromeCache.exe"C:\Users\Admin\AppData\Roaming\ChromeCache\ChromeCache.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\ProgramData\Decoder.exe"C:\ProgramData\Decoder.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:988 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.cmd""3⤵
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\system32\timeout.exetimeout 44⤵
- Delays execution with timeout.exe
PID:2536
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Decoder.exeFilesize
490KB
MD5c29c0d495ed13e703f433d53bdffdab8
SHA174ed36e6b6027b61abcfe2956670ffd9de7fd71a
SHA25620309707aa6fc678963aace7685a37839d439c850b1ba399bdbfbbeddc10ed4b
SHA512fea4c1066ee6df3ebb29a354678a3d0f1398cd216b92b261296fcff580b00e19cefe24d975beebcc41854cceef3df2702d569811358dae4203a924fb52cf5426
-
C:\Users\Admin\AppData\Local\Temp\.cmdFilesize
85B
MD573712247036b6a24d16502c57a3e5679
SHA165ca9edadb0773fc34db7dfefe9e6416f1ac17fa
SHA2568bd49d7e7e6b2c2dc16a4cb0eebb8f28892775fad56c9e4aaa22d59f01883cd0
SHA512548eef10b0118f7d907fa19c12de68b47278afffb3eb9460621efb2b711ebcf6b90d0ea1c077fc480e032bf241fb3f8cc995ec1373e301446f89f1a74a6309de
-
C:\Users\Admin\AppData\Local\uPPPuLNJXHyH078BFBFF000306D22ED8715E54\54078BFBFF000306D22ED8715EuPPPuLNJXHyH\Browsers\Passwords\Passwords_Edge.txtFilesize
401B
MD5778ded02fee528236c356ac450b6e017
SHA1faf1dda6c4cdded66dbff360e3719987fb112bbe
SHA2566d2cd7b05481a6aa103e6bbc8c38566def147e17322ac9e9f3471c230b723047
SHA512f58fa3996d71bb3ff9a809fe66d05dc188078d71a652df930653ee4f332ddd13958b86a462659961734637002227b17dc5f9d3174e21a75d1f03b40f416f0dd6
-
C:\Users\Admin\AppData\Local\uPPPuLNJXHyH078BFBFF000306D22ED8715E54\54078BFBFF000306D22ED8715EuPPPuLNJXHyH\Browsers\Passwords\Passwords_Edge.txtFilesize
426B
MD542fa959509b3ed7c94c0cf3728b03f6d
SHA1661292176640beb0b38dc9e7a462518eb592d27d
SHA256870ef3d2370932a8938faa60abd47d75ea0af98bfa11c82ae8efe9e94fd8be00
SHA5127def291737d081c93d0cc38ac8d3062fd34d93b68d191eb0d54e9857e0c0afdbcd241471a2e10c28ce8db3b1d1ae0dba2ef6f609cfe8a1e8fe1dd103dba80007
-
C:\Users\Admin\AppData\Roaming\ChromeCache\ChromeCache.exeFilesize
1.5MB
MD5ad2f6dd54f8a52708148b9fe50f7ede9
SHA120b3284ad569811a6f28a39a92b6da61d2713079
SHA25659c3fc7329bf3f09b892d86419da8d1872dc2262683ec45b348a1c27993133b0
SHA5127f2c297b294a20edf52e63eaf7311883295b6bd5c6cd14e839ba8174dabcb353df4536976ba680f647311cfc86f6952f82a0508a6b6dbfe03fbdac7a7e3b57af
-
memory/988-96-0x0000000004BD0000-0x0000000004C6C000-memory.dmpFilesize
624KB
-
memory/988-99-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/988-103-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/988-102-0x0000000005470000-0x000000000550A000-memory.dmpFilesize
616KB
-
memory/988-101-0x0000000004E70000-0x0000000005414000-memory.dmpFilesize
5.6MB
-
memory/988-100-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/988-98-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/988-97-0x0000000074DB0000-0x0000000075560000-memory.dmpFilesize
7.7MB
-
memory/988-95-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/988-94-0x0000000074DB0000-0x0000000075560000-memory.dmpFilesize
7.7MB
-
memory/1680-1-0x00007FFC18B50000-0x00007FFC19611000-memory.dmpFilesize
10.8MB
-
memory/1680-2-0x000000001BB60000-0x000000001BB70000-memory.dmpFilesize
64KB
-
memory/1680-0-0x0000000000A90000-0x0000000000E90000-memory.dmpFilesize
4.0MB
-
memory/1680-10-0x00007FFC18B50000-0x00007FFC19611000-memory.dmpFilesize
10.8MB
-
memory/4984-93-0x00007FFC18B50000-0x00007FFC19611000-memory.dmpFilesize
10.8MB
-
memory/4984-7-0x0000000000890000-0x0000000000A14000-memory.dmpFilesize
1.5MB
-
memory/4984-33-0x000000001B650000-0x000000001B660000-memory.dmpFilesize
64KB
-
memory/4984-32-0x00007FFC18B50000-0x00007FFC19611000-memory.dmpFilesize
10.8MB
-
memory/4984-8-0x00007FFC18B50000-0x00007FFC19611000-memory.dmpFilesize
10.8MB
-
memory/4984-12-0x000000001BC60000-0x000000001BCD6000-memory.dmpFilesize
472KB
-
memory/4984-11-0x000000001B650000-0x000000001B660000-memory.dmpFilesize
64KB