zebrocy | 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105

General

Target

34371c7833c38fa441316f238961d9a2.exe
Size

978KB
MD5

34371c7833c38fa441316f238961d9a2
SHA1

74e99094f77642ef2d803188121a9c61e73139fe
SHA256

444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105
SHA512

aba20341168f6f78cecb302c1544ad617a6dc4d5e081cb3ffbcfe0e67c9a5708ce7e9d264de78eb620c3acea19cf37789f25a48dbb080ed16542ccc4b780386a
SSDEEP

24576:VoyOrimyU/MAYycTwgadEhiU8BnM4XkEJ:CNyU/LYyQwdU8RkE

Score

10^/10

zebrocy backdoor spyware stealer trojan upx

Malware Config

Signatures

Zebrocy
Zebrocy is a backdoor created by Sofacy threat group and has multiple variants developed in different languages.
trojan backdoor zebrocy

Zebrocy Go Variant 7 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2540-1-0x0000000000400000-0x00000000007A7000-memory.dmp	Zebrocy
behavioral1/memory/2540-2-0x0000000000400000-0x00000000007A7000-memory.dmp	Zebrocy
behavioral1/memory/2540-964-0x0000000000400000-0x00000000007A7000-memory.dmp	Zebrocy
behavioral1/memory/2540-4526-0x0000000000400000-0x00000000007A7000-memory.dmp	Zebrocy
behavioral1/memory/2540-7893-0x0000000000400000-0x00000000007A7000-memory.dmp	Zebrocy
behavioral1/memory/2540-16097-0x0000000000400000-0x00000000007A7000-memory.dmp	Zebrocy
behavioral1/memory/2540-16815-0x0000000000400000-0x00000000007A7000-memory.dmp	Zebrocy

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2540-0-0x0000000000400000-0x00000000007A7000-memory.dmp	upx
behavioral1/memory/2540-1-0x0000000000400000-0x00000000007A7000-memory.dmp	upx
behavioral1/memory/2540-2-0x0000000000400000-0x00000000007A7000-memory.dmp	upx
behavioral1/memory/2540-964-0x0000000000400000-0x00000000007A7000-memory.dmp	upx
behavioral1/memory/2540-4526-0x0000000000400000-0x00000000007A7000-memory.dmp	upx
behavioral1/memory/2540-7893-0x0000000000400000-0x00000000007A7000-memory.dmp	upx
behavioral1/memory/2540-16097-0x0000000000400000-0x00000000007A7000-memory.dmp	upx
behavioral1/memory/2540-16815-0x0000000000400000-0x00000000007A7000-memory.dmp	upx

Drops desktop.ini file(s) 4 IoCs

Processes:

34371c7833c38fa441316f238961d9a2.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini	34371c7833c38fa441316f238961d9a2.exe

Drops file in Program Files directory 64 IoCs

Processes:

34371c7833c38fa441316f238961d9a2.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02446_.WMF	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR4B.GIF	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\service.js	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\slideshow_glass_frame.png	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0086426.WMF	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Atlantic\Azores	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\vlc.mo	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_sun.png	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\METCONV.TXT	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS01634_.WMF	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Teal.css	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSCOL11.INF	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tehran	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\meta\art\03_lastfm.luac	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\Vdk10.lng	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0196110.WMF	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21433_.GIF	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ACCDDSLM.DLL	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Training.potx	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\settings.css	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.attributeTransformation.exsd	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\base-undocked-4.png	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\FBIBLIO.DLL	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\THMBNAIL.PNG	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\en-US\enu-dsk\M1033DSK.UDT	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00265_.WMF	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0387895.JPG	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck.css	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\visualvm.conf	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR49F.GIF	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\SETLANG_K_COL.HXK	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\PersonalMonthlyBudget.xltx	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kuala_Lumpur	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\eclipse.inf	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105378.WMF	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0172035.WMF	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD15156_.GIF	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL109.XML	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgePackages.h	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\vlc.mo	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01126_.WMF	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\PULLQUOTEBB.DPV	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives.nl_zh_4.4.0.v20140623020002.jar	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-api_zh_CN.jar	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\vlc.mo	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\utilityfunctions.js	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\WPULQT98.POC	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoBeta.png	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\v8_context_snapshot.bin	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00612_.WMF	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15059_.GIF	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.war	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\add_up.png	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\EXPLODE.WAV	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ONLNTCOMLIB.DLL	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\play_rest.png	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-actions.xml	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ml.pak	34371c7833c38fa441316f238961d9a2.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4.ssl_1.0.0.v20140827-1444.jar	34371c7833c38fa441316f238961d9a2.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

34371c7833c38fa441316f238961d9a2.exe

pid process

2540 34371c7833c38fa441316f238961d9a2.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 2584 vssvc.exe
Token: SeRestorePrivilege 2584 vssvc.exe
Token: SeAuditPrivilege 2584 vssvc.exe
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

pid	process
2540	34371c7833c38fa441316f238961d9a2.exe

description	pid	process
Token: SeBackupPrivilege	2584	vssvc.exe
Token: SeRestorePrivilege	2584	vssvc.exe
Token: SeAuditPrivilege	2584	vssvc.exe

C:\Users\Admin\AppData\Local\Temp\34371c7833c38fa441316f238961d9a2.exe
"C:\Users\Admin\AppData\Local\Temp\34371c7833c38fa441316f238961d9a2.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:2540

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2540-0-0x0000000000400000-0x00000000007A7000-memory.dmp

Filesize
3.7MB

Download
memory/2540-1-0x0000000000400000-0x00000000007A7000-memory.dmp

Filesize
3.7MB

Download
memory/2540-2-0x0000000000400000-0x00000000007A7000-memory.dmp

Filesize
3.7MB

Download
memory/2540-964-0x0000000000400000-0x00000000007A7000-memory.dmp

Filesize
3.7MB

Download
memory/2540-4526-0x0000000000400000-0x00000000007A7000-memory.dmp

Filesize
3.7MB

Download
memory/2540-7893-0x0000000000400000-0x00000000007A7000-memory.dmp

Filesize
3.7MB

Download
memory/2540-16097-0x0000000000400000-0x00000000007A7000-memory.dmp

Filesize
3.7MB

Download
memory/2540-16815-0x0000000000400000-0x00000000007A7000-memory.dmp

Filesize
3.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads