Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-01-2024 20:19

General

  • Target

    magic.poisontoolz.com/xw.exe

  • Size

    28KB

  • MD5

    07863605fe5206c0f5eaf8f119ba71fc

  • SHA1

    8747e0363ab081bdcdb212f64cf32db3b25e61fc

  • SHA256

    098b1c1b7ccb2be3f1f1d98e430d3c2f81ae56075a03b58ac6c24c77fc62d920

  • SHA512

    1b7fa923c1c7fb883cb3d5e2dc53a728c67df74abf5f9d9c8c2391f779faa94efeaa40e66062968d602eef813a1f639d19d0b7e6bf8028bafd11dd08a0d956f5

  • SSDEEP

    768:2AqFNDcBN3SBldDiHjQW/081aBV/Rqcbdqb:2AacBN3YW8y08grqcb4b

Malware Config

Extracted

Family

stealerium

C2

https://discordapp.com/api/webhooks/1197850806213431377/-zU9uA2NeaYEk4-ozdhgmNljI6NS_w_qcT_cbtxYxZdkUD3JeaKChZp4GXdod-MX3D1Q

Signatures

  • Detect ZGRat V1 34 IoCs
  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\magic.poisontoolz.com\xw.exe
    "C:\Users\Admin\AppData\Local\Temp\magic.poisontoolz.com\xw.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2600
    • C:\Users\Admin\AppData\Local\Temp\magic.poisontoolz.com\xw.exe
      C:\Users\Admin\AppData\Local\Temp\magic.poisontoolz.com\xw.exe
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:3764
      • C:\Users\Admin\AppData\Local\Temp\loaderX.exe
        "C:\Users\Admin\AppData\Local\Temp\loaderX.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:5112
      • C:\Users\Admin\AppData\Local\Temp\build.exe
        "C:\Users\Admin\AppData\Local\Temp\build.exe"
        3⤵
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • outlook_office_path
        • outlook_win_path
        PID:4924
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:5020
          • C:\Windows\SysWOW64\findstr.exe
            findstr All
            5⤵
              PID:816
            • C:\Windows\SysWOW64\netsh.exe
              netsh wlan show profile
              5⤵
                PID:2328
              • C:\Windows\SysWOW64\chcp.com
                chcp 65001
                5⤵
                  PID:2408
              • C:\Windows\SysWOW64\cmd.exe
                "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:1144
        • C:\Windows\system32\msiexec.exe
          C:\Windows\system32\msiexec.exe /V
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1876
        • C:\Windows\SysWOW64\netsh.exe
          netsh wlan show networks mode=bssid
          1⤵
            PID:932
          • C:\Windows\SysWOW64\chcp.com
            chcp 65001
            1⤵
              PID:2068

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\xw.exe.log

              Filesize

              1KB

              MD5

              c3941d9fa38f1717d5cecd7a2ca71667

              SHA1

              33b5362675383b58b4166ed9f9a61e5aa6768d2e

              SHA256

              f1ed6ff1cd3df219061e32df1c75d6f48de6484cf50e5ea7d86cd8bcfcb93256

              SHA512

              98f103ef97d32bf8c0566a6f6da5cf8d58d18f698c1b3e5bd0be0ea8462f5fe54c2e5e6b5188f2b7d8f70082ffd6745b1f7f6cab95af474e2b7eaed50a9d9c45

            • C:\Users\Admin\AppData\Local\Temp\Data\CreditCards.txt

              Filesize

              238B

              MD5

              0f5f7a38759e578c92bcf62c45d80b8a

              SHA1

              211e70ede55cce5bf67f685d85cbd030a8517d2b

              SHA256

              39059fc9bf3844dacbe329b623ca7a06f72656216dd4e52dc9b938b3d95289dc

              SHA512

              8130466f8ee346c0b931a34e63e2e9dc6f4070b85faaa58efdddd4d165fa605457d3137472c5fd09da87b0135a4beb660ee39cb390d78be6f0786950036b205d

            • C:\Users\Admin\AppData\Local\Temp\build.exe

              Filesize

              1KB

              MD5

              dcf0f2f524e0e1d2752f64dc7fce8ea0

              SHA1

              4cb2ae016e67f7fa88d9598313f6092fffc55559

              SHA256

              bf6796861138edc7e2eb7807fd388d91922408853c8dccb495aca889dd2e89b6

              SHA512

              fea9118e846801b82bb04c057624ab727c3f4116c7c194164da49f6541cfad65daa70e6a5c5dfc8f148e75ac5b96763b18dcf6a427c01fa4f8a7ab2b4aa51330

            • C:\Users\Admin\AppData\Local\Temp\build.exe

              Filesize

              50KB

              MD5

              aeb20a62dc5daec0e2f60165f9829b07

              SHA1

              fdafa16dfbd0d2d6a1f88add8db1120721edead2

              SHA256

              08b11f91e2081d5ddf637d64784c4101ec65653d36299a7a22d9b457aae65a14

              SHA512

              388f9d76bf79d9c5e53a4c994ff9853356b6a0f2c5ef7feae84813f1be1d3a2c09e1838a3286acf980e66a270028595191cd35dd6593a920a8862b3cf10e387b

            • C:\Users\Admin\AppData\Local\Temp\build.exe

              Filesize

              92KB

              MD5

              a90e4f6bdd44a71e2246160693884539

              SHA1

              940ebec474e0b4d87dc4f06f37a1d32d2315cf56

              SHA256

              b2c5ecae8bdeb480fb306372d7a12d943531bd0de1b15f45168ba659f25694d4

              SHA512

              9a7fcd588ef5842798481bacfb7b32dd57efe06db3c852c69916d0045f806894d475ccf8f52bed942a35f4160bb6c3be7d635b17928d29148318c2858b62d937

            • C:\Users\Admin\AppData\Local\Temp\loaderX.exe

              Filesize

              92KB

              MD5

              45ea343e335d2d6400ccbc1e3fc85f11

              SHA1

              7f2267d1f27a076e284696c30a4cf4768fd1a52f

              SHA256

              f38fbc005bcaadb661f8f57f00eb44960e27a1cbf4c4012c3f27834e62a9c203

              SHA512

              c7689143605327ed63d967b81e7eb8eecf786b5273d772209d7581fc36517953b686a4c8196f9100acf026e9e8c5edc7724e5f0f77d0c982377dfd5d039e33a1

            • C:\Users\Admin\AppData\Local\Temp\loaderX.exe

              Filesize

              14KB

              MD5

              6e0741d4586628386a6f1df47a03655e

              SHA1

              610950a24bb3c8b318130ffb98690ecba89c1018

              SHA256

              65a5758d31c44e29e26a3444333ed585e13117daed14bff83e33df06ad9133f7

              SHA512

              4a3e09b6f5c6a33a9c919477b488aef6d3bf18e793fa3ff82dd105015b95ba0cd4451e52fbcf5ff5c9e37bc138856aaa5d83a18529512fdc4794eaff9a401393

            • C:\Users\Admin\AppData\Local\Temp\loaderX.exe

              MD5

              d41d8cd98f00b204e9800998ecf8427e

              SHA1

              da39a3ee5e6b4b0d3255bfef95601890afd80709

              SHA256

              e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

              SHA512

              cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

            • C:\Users\Admin\AppData\Local\a3c3eac75a665cb7955b2c5159e1dfed\Admin@AAKWQUEG_en-US\Directories\OneDrive.txt

              Filesize

              25B

              MD5

              966247eb3ee749e21597d73c4176bd52

              SHA1

              1e9e63c2872cef8f015d4b888eb9f81b00a35c79

              SHA256

              8ddfc481b1b6ae30815ecce8a73755862f24b3bb7fdebdbf099e037d53eb082e

              SHA512

              bd30aec68c070e86e3dec787ed26dd3d6b7d33d83e43cb2d50f9e2cff779fee4c96afbbe170443bd62874073a844beb29a69b10c72c54d7d444a8d86cfd7b5aa

            • C:\Users\Admin\AppData\Local\a3c3eac75a665cb7955b2c5159e1dfed\Admin@AAKWQUEG_en-US\Directories\Videos.txt

              Filesize

              23B

              MD5

              1fddbf1169b6c75898b86e7e24bc7c1f

              SHA1

              d2091060cb5191ff70eb99c0088c182e80c20f8c

              SHA256

              a67aa329b7d878de61671e18cd2f4b011d11cbac67ea779818c6dafad2d70733

              SHA512

              20bfeafde7fec1753fef59de467bd4a3dd7fe627e8c44e95fe62b065a5768c4508e886ec5d898e911a28cf6365f455c9ab1ebe2386d17a76f53037f99061fd4d

            • C:\Users\Admin\AppData\Local\a3c3eac75a665cb7955b2c5159e1dfed\Admin@AAKWQUEG_en-US\System\Apps.txt

              Filesize

              5KB

              MD5

              b1d58554f33c991f9454f81bf1f6a7a6

              SHA1

              1a9c0748fbb4c4974315f6a3188ffb5078372de1

              SHA256

              2809730601ec3cd803e75dded9788afc2683f6562378a497e7300fd83137838c

              SHA512

              ef961a73b2b8844155d1684a6d5e0319ad5d0c8cb2c60e4ed16b03cca69e04bf9872f2bff8fdf24d3bf284366f2b2f0d36f1e4c1cd5d007732c3ad0af562d5c6

            • C:\Users\Admin\AppData\Local\a3c3eac75a665cb7955b2c5159e1dfed\Admin@AAKWQUEG_en-US\System\Debug.txt

              Filesize

              1007B

              MD5

              e08defb48fa31212026eba24f895a35f

              SHA1

              c0b9d3c1aec64bf21af878cab77d67999399437d

              SHA256

              e32ef5b1291cd83151ccce58e0a74f9fc287cbb4276670407972b1f79a2f561e

              SHA512

              6beb8c75d37b99674e28010cf6f1bc3862632cc299e1a297c0dfcd987771c5f1249d1818b5b0800b30b478fcf6e83392f75436ec186f3d1c73de67974958ff8d

            • C:\Users\Admin\AppData\Local\a3c3eac75a665cb7955b2c5159e1dfed\Admin@AAKWQUEG_en-US\System\ProductKey.txt

              Filesize

              29B

              MD5

              71eb5479298c7afc6d126fa04d2a9bde

              SHA1

              a9b3d5505cf9f84bb6c2be2acece53cb40075113

              SHA256

              f6cadfd4e4c25ff3b8cffe54a2af24a757a349abbf4e1142ec4c9789347fe8b3

              SHA512

              7c6687e21d31ec1d6d2eff04b07b465f875fd80df26677f1506b14158444cf55044eb6674880bd5bd44f04ff73023b26cb19b8837427a1d6655c96df52f140bd

            • C:\Users\Admin\AppData\Local\a3c3eac75a665cb7955b2c5159e1dfed\msgid.dat

              Filesize

              19B

              MD5

              c010c7aa7b322c786d79b8846cb067ed

              SHA1

              fbd6564d70b404df38f7357fc5d1439cd44672a1

              SHA256

              9fb3307f61d84c4da05cc9e075a5512d168db16bad673994fc44ff8489b22f6e

              SHA512

              1197fc5a15271d40dc3732e9ffb3dc93e148d5714e18ac66c9af7da52b3005e4ea10b848215e566576f605bd72b43d3b5a8c0d2014396d0d493de40069bb873b

            • memory/2600-939-0x0000000008190000-0x0000000008734000-memory.dmp

              Filesize

              5.6MB

            • memory/2600-25-0x0000000007200000-0x0000000007763000-memory.dmp

              Filesize

              5.4MB

            • memory/2600-31-0x0000000007200000-0x0000000007763000-memory.dmp

              Filesize

              5.4MB

            • memory/2600-33-0x0000000007200000-0x0000000007763000-memory.dmp

              Filesize

              5.4MB

            • memory/2600-35-0x0000000007200000-0x0000000007763000-memory.dmp

              Filesize

              5.4MB

            • memory/2600-39-0x0000000007200000-0x0000000007763000-memory.dmp

              Filesize

              5.4MB

            • memory/2600-41-0x0000000007200000-0x0000000007763000-memory.dmp

              Filesize

              5.4MB

            • memory/2600-45-0x0000000007200000-0x0000000007763000-memory.dmp

              Filesize

              5.4MB

            • memory/2600-47-0x0000000007200000-0x0000000007763000-memory.dmp

              Filesize

              5.4MB

            • memory/2600-51-0x0000000007200000-0x0000000007763000-memory.dmp

              Filesize

              5.4MB

            • memory/2600-53-0x0000000007200000-0x0000000007763000-memory.dmp

              Filesize

              5.4MB

            • memory/2600-57-0x0000000007200000-0x0000000007763000-memory.dmp

              Filesize

              5.4MB

            • memory/2600-55-0x0000000007200000-0x0000000007763000-memory.dmp

              Filesize

              5.4MB

            • memory/2600-61-0x0000000007200000-0x0000000007763000-memory.dmp

              Filesize

              5.4MB

            • memory/2600-65-0x0000000007200000-0x0000000007763000-memory.dmp

              Filesize

              5.4MB

            • memory/2600-63-0x0000000007200000-0x0000000007763000-memory.dmp

              Filesize

              5.4MB

            • memory/2600-67-0x0000000007200000-0x0000000007763000-memory.dmp

              Filesize

              5.4MB

            • memory/2600-59-0x0000000007200000-0x0000000007763000-memory.dmp

              Filesize

              5.4MB

            • memory/2600-49-0x0000000007200000-0x0000000007763000-memory.dmp

              Filesize

              5.4MB

            • memory/2600-43-0x0000000007200000-0x0000000007763000-memory.dmp

              Filesize

              5.4MB

            • memory/2600-37-0x0000000007200000-0x0000000007763000-memory.dmp

              Filesize

              5.4MB

            • memory/2600-23-0x0000000007200000-0x0000000007763000-memory.dmp

              Filesize

              5.4MB

            • memory/2600-13-0x0000000007200000-0x0000000007763000-memory.dmp

              Filesize

              5.4MB

            • memory/2600-5-0x0000000007200000-0x0000000007763000-memory.dmp

              Filesize

              5.4MB

            • memory/2600-4-0x0000000007200000-0x0000000007763000-memory.dmp

              Filesize

              5.4MB

            • memory/2600-936-0x0000000002F70000-0x0000000002F71000-memory.dmp

              Filesize

              4KB

            • memory/2600-937-0x0000000008E30000-0x0000000009330000-memory.dmp

              Filesize

              5.0MB

            • memory/2600-938-0x0000000006FD0000-0x000000000701C000-memory.dmp

              Filesize

              304KB

            • memory/2600-27-0x0000000007200000-0x0000000007763000-memory.dmp

              Filesize

              5.4MB

            • memory/2600-943-0x00000000745C0000-0x0000000074D70000-memory.dmp

              Filesize

              7.7MB

            • memory/2600-1-0x00000000745C0000-0x0000000074D70000-memory.dmp

              Filesize

              7.7MB

            • memory/2600-0-0x0000000000C50000-0x0000000000C5E000-memory.dmp

              Filesize

              56KB

            • memory/2600-2-0x00000000056C0000-0x00000000056D0000-memory.dmp

              Filesize

              64KB

            • memory/2600-3-0x0000000007200000-0x0000000007768000-memory.dmp

              Filesize

              5.4MB

            • memory/2600-7-0x0000000007200000-0x0000000007763000-memory.dmp

              Filesize

              5.4MB

            • memory/2600-29-0x0000000007200000-0x0000000007763000-memory.dmp

              Filesize

              5.4MB

            • memory/2600-9-0x0000000007200000-0x0000000007763000-memory.dmp

              Filesize

              5.4MB

            • memory/2600-11-0x0000000007200000-0x0000000007763000-memory.dmp

              Filesize

              5.4MB

            • memory/2600-15-0x0000000007200000-0x0000000007763000-memory.dmp

              Filesize

              5.4MB

            • memory/2600-17-0x0000000007200000-0x0000000007763000-memory.dmp

              Filesize

              5.4MB

            • memory/2600-19-0x0000000007200000-0x0000000007763000-memory.dmp

              Filesize

              5.4MB

            • memory/2600-21-0x0000000007200000-0x0000000007763000-memory.dmp

              Filesize

              5.4MB

            • memory/3764-981-0x00000000745C0000-0x0000000074D70000-memory.dmp

              Filesize

              7.7MB

            • memory/3764-946-0x00000000050C0000-0x0000000005152000-memory.dmp

              Filesize

              584KB

            • memory/3764-945-0x0000000000400000-0x0000000000C0A000-memory.dmp

              Filesize

              8.0MB

            • memory/3764-944-0x00000000745C0000-0x0000000074D70000-memory.dmp

              Filesize

              7.7MB

            • memory/3764-947-0x0000000005260000-0x0000000005270000-memory.dmp

              Filesize

              64KB

            • memory/3764-948-0x00000000052B0000-0x00000000052BA000-memory.dmp

              Filesize

              40KB

            • memory/4924-977-0x00000000008A0000-0x0000000000A32000-memory.dmp

              Filesize

              1.6MB

            • memory/4924-1226-0x0000000006C40000-0x0000000006CBA000-memory.dmp

              Filesize

              488KB

            • memory/4924-1315-0x0000000002CA0000-0x0000000002CB0000-memory.dmp

              Filesize

              64KB

            • memory/4924-1031-0x00000000058A0000-0x00000000058C6000-memory.dmp

              Filesize

              152KB

            • memory/4924-1032-0x00000000058D0000-0x00000000058D8000-memory.dmp

              Filesize

              32KB

            • memory/4924-1030-0x0000000005810000-0x00000000058A2000-memory.dmp

              Filesize

              584KB

            • memory/4924-1035-0x0000000006820000-0x000000000683E000-memory.dmp

              Filesize

              120KB

            • memory/4924-1034-0x0000000006800000-0x0000000006808000-memory.dmp

              Filesize

              32KB

            • memory/4924-1033-0x00000000067F0000-0x00000000067FA000-memory.dmp

              Filesize

              40KB

            • memory/4924-979-0x00000000052E0000-0x0000000005346000-memory.dmp

              Filesize

              408KB

            • memory/4924-1223-0x0000000002CA0000-0x0000000002CB0000-memory.dmp

              Filesize

              64KB

            • memory/4924-1018-0x0000000002CA0000-0x0000000002CB0000-memory.dmp

              Filesize

              64KB

            • memory/4924-1298-0x0000000007100000-0x00000000071B2000-memory.dmp

              Filesize

              712KB

            • memory/4924-982-0x00000000745C0000-0x0000000074D70000-memory.dmp

              Filesize

              7.7MB

            • memory/4924-1314-0x0000000002CA0000-0x0000000002CB0000-memory.dmp

              Filesize

              64KB

            • memory/4924-1313-0x00000000745C0000-0x0000000074D70000-memory.dmp

              Filesize

              7.7MB

            • memory/4924-1301-0x0000000007FA0000-0x00000000082F4000-memory.dmp

              Filesize

              3.3MB

            • memory/4924-1300-0x0000000006B70000-0x0000000006B92000-memory.dmp

              Filesize

              136KB

            • memory/5112-985-0x0000015A5A390000-0x0000015A5A3E0000-memory.dmp

              Filesize

              320KB

            • memory/5112-983-0x0000015A58300000-0x0000015A58310000-memory.dmp

              Filesize

              64KB

            • memory/5112-980-0x00007FFADC100000-0x00007FFADCBC1000-memory.dmp

              Filesize

              10.8MB

            • memory/5112-978-0x0000015A3DAD0000-0x0000015A3DC48000-memory.dmp

              Filesize

              1.5MB

            • memory/5112-1027-0x00007FFADC100000-0x00007FFADCBC1000-memory.dmp

              Filesize

              10.8MB