zebrocy | 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105

General

Target

setup.exe
Size

978KB
MD5

34371c7833c38fa441316f238961d9a2
SHA1

74e99094f77642ef2d803188121a9c61e73139fe
SHA256

444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105
SHA512

aba20341168f6f78cecb302c1544ad617a6dc4d5e081cb3ffbcfe0e67c9a5708ce7e9d264de78eb620c3acea19cf37789f25a48dbb080ed16542ccc4b780386a
SSDEEP

24576:VoyOrimyU/MAYycTwgadEhiU8BnM4XkEJ:CNyU/LYyQwdU8RkE

Score

10^/10

zebrocy backdoor spyware stealer trojan upx

Malware Config

Signatures

Zebrocy
Zebrocy is a backdoor created by Sofacy threat group and has multiple variants developed in different languages.
trojan backdoor zebrocy

Zebrocy Go Variant 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1708-4-0x0000000000400000-0x00000000007A7000-memory.dmp	Zebrocy
behavioral1/memory/1708-8-0x0000000000400000-0x00000000007A7000-memory.dmp	Zebrocy
behavioral1/memory/1708-1670-0x0000000000400000-0x00000000007A7000-memory.dmp	Zebrocy
behavioral1/memory/1708-5798-0x0000000000400000-0x00000000007A7000-memory.dmp	Zebrocy
behavioral1/memory/1708-8458-0x0000000000400000-0x00000000007A7000-memory.dmp	Zebrocy
behavioral1/memory/1708-17025-0x0000000000400000-0x00000000007A7000-memory.dmp	Zebrocy

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1708-0-0x0000000000400000-0x00000000007A7000-memory.dmp	upx
behavioral1/memory/1708-4-0x0000000000400000-0x00000000007A7000-memory.dmp	upx
behavioral1/memory/1708-8-0x0000000000400000-0x00000000007A7000-memory.dmp	upx
behavioral1/memory/1708-1670-0x0000000000400000-0x00000000007A7000-memory.dmp	upx
behavioral1/memory/1708-5798-0x0000000000400000-0x00000000007A7000-memory.dmp	upx
behavioral1/memory/1708-8458-0x0000000000400000-0x00000000007A7000-memory.dmp	upx
behavioral1/memory/1708-17025-0x0000000000400000-0x00000000007A7000-memory.dmp	upx

Drops desktop.ini file(s) 4 IoCs

Processes:

setup.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	setup.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini	setup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	setup.exe

Drops file in Program Files directory 64 IoCs

Processes:

setup.exe

description	ioc	process
File opened for modification	C:\Program Files\DisconnectUnblock.aifc	setup.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-core-kit.xml	setup.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_foggy.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\Person.gif	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\XMLSDK5.CHM	setup.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\RSSFeeds.css	setup.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\javaws.policy	setup.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jayapura	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0188513.WMF	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0196142.WMF	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\ONINTL.DLL	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BIZCARD.DPV	setup.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rankin_Inlet	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\MSART11.BDR	setup.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0251871.WMF	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15274_.GIF	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\BUTTON.JPG	setup.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\FrameworkList.xml	setup.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Nauru	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099162.JPG	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02116_.GIF	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Black Tie.thmx	setup.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-first-quarter_partly-cloudy.png	setup.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEREP.DLL	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00176_.GIF	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0088542.WMF	setup.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightRegular.ttf	setup.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_zh_CN.jar	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00779_.WMF	setup.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Madeira	setup.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rarrow.gif	setup.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerActionExceptionHandlers.exsd	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Sort\YEAR.XSL	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SMSS.ICO	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSHY7ES.LEX	setup.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\colorcycle.png	setup.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_videoinset.png	setup.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\localizedSettings.css	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0103812.WMF	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\OIS_COL.HXC	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.BusinessApplications.Runtime.xml	setup.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.ds_1.4.200.v20131126-2331.jar	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10255_.GIF	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21331_.GIF	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CATALOG.XML	setup.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\settings.js	setup.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\css\weather.css	setup.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-annotations-common.xml	setup.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\settings.js	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\MSART14.BDR	setup.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\calendar.html	setup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hwresmlm.dat	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01586_.WMF	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099172.WMF	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105244.WMF	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0237225.WMF	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\TAB_OFF.GIF	setup.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\redmenu.png	setup.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\plugin.xml	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\IN00915_.WMF	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02058U.BMP	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\OLNOTER.FAE	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\TAB_ON.GIF	setup.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

setup.exe

pid process

1708 setup.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 2740 vssvc.exe
Token: SeRestorePrivilege 2740 vssvc.exe
Token: SeAuditPrivilege 2740 vssvc.exe
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

pid	process
1708	setup.exe

description	pid	process
Token: SeBackupPrivilege	2740	vssvc.exe
Token: SeRestorePrivilege	2740	vssvc.exe
Token: SeAuditPrivilege	2740	vssvc.exe

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1708

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2740

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1708-0-0x0000000000400000-0x00000000007A7000-memory.dmp

Filesize
3.7MB

Download
memory/1708-1-0x0000000000D50000-0x00000000010F7000-memory.dmp

Filesize
3.7MB

Download
memory/1708-2-0x0000000000D50000-0x00000000010F7000-memory.dmp

Filesize
3.7MB

Download
memory/1708-3-0x0000000000D50000-0x00000000010F7000-memory.dmp

Filesize
3.7MB

Download
memory/1708-4-0x0000000000400000-0x00000000007A7000-memory.dmp

Filesize
3.7MB

Download
memory/1708-5-0x0000000000D50000-0x00000000010F7000-memory.dmp

Filesize
3.7MB

Download
memory/1708-6-0x0000000000D50000-0x00000000010F7000-memory.dmp

Filesize
3.7MB

Download
memory/1708-7-0x0000000000D50000-0x00000000010F7000-memory.dmp

Filesize
3.7MB

Download
memory/1708-8-0x0000000000400000-0x00000000007A7000-memory.dmp

Filesize
3.7MB

Download
memory/1708-1670-0x0000000000400000-0x00000000007A7000-memory.dmp

Filesize
3.7MB

Download
memory/1708-5798-0x0000000000400000-0x00000000007A7000-memory.dmp

Filesize
3.7MB

Download
memory/1708-8458-0x0000000000400000-0x00000000007A7000-memory.dmp

Filesize
3.7MB

Download
memory/1708-17025-0x0000000000400000-0x00000000007A7000-memory.dmp

Filesize
3.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads