Analysis

  • max time kernel
    14s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-01-2024 20:19

General

  • Target

    magic.poisontoolz.com/File2crypt.exe

  • Size

    2.1MB

  • MD5

    59c9ab244182896361828d4e30d7fe31

  • SHA1

    1cffba028bb2a0f8a6af81610e6fabe31d0fb20b

  • SHA256

    7adb172b0b1772607653b7c685d98281f9dd63dc5a3c8554c886d9b5433b2a7a

  • SHA512

    f92ca8fa70b61c37352b339eb79041a6c6e1c7d04eb985acf18e284d5aa20e66cfee701d8763aa60269248e0daf812bc1cd30669695bf434668be489f944c9d6

  • SSDEEP

    49152:mUnQGWMOd1UCKPOwE7q+WF/S3gDPhSPAXeEPoeL0qYhxD/x:XaXUHGy+Wk3gDhSP5eLG/x

Malware Config

Extracted

Family

stealerium

C2

https://discordapp.com/api/webhooks/1197850806213431377/-zU9uA2NeaYEk4-ozdhgmNljI6NS_w_qcT_cbtxYxZdkUD3JeaKChZp4GXdod-MX3D1Q

Signatures

  • Detect ZGRat V1 34 IoCs
  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\magic.poisontoolz.com\File2crypt.exe
    "C:\Users\Admin\AppData\Local\Temp\magic.poisontoolz.com\File2crypt.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3856
    • C:\Users\Admin\AppData\Local\Temp\magic.poisontoolz.com\File2crypt.exe
      C:\Users\Admin\AppData\Local\Temp\magic.poisontoolz.com\File2crypt.exe
      2⤵
      • Accesses Microsoft Outlook profiles
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • outlook_office_path
      • outlook_win_path
      PID:2148
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:468
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
        3⤵
          PID:5056
    • C:\Windows\SysWOW64\chcp.com
      chcp 65001
      1⤵
        PID:4684
      • C:\Windows\SysWOW64\netsh.exe
        netsh wlan show profile
        1⤵
          PID:1596
        • C:\Windows\system32\msiexec.exe
          C:\Windows\system32\msiexec.exe /V
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4944
        • C:\Windows\SysWOW64\findstr.exe
          findstr All
          1⤵
            PID:448
          • C:\Windows\SysWOW64\netsh.exe
            netsh wlan show networks mode=bssid
            1⤵
              PID:3332
            • C:\Windows\SysWOW64\chcp.com
              chcp 65001
              1⤵
                PID:4564

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\File2crypt.exe.log

                Filesize

                927B

                MD5

                4a911455784f74e368a4c2c7876d76f4

                SHA1

                a1700a0849ffb4f26671eb76da2489946b821c34

                SHA256

                264098e15b5b33d425f3b76e45b7976b58f917048125041135f7e60d8151108c

                SHA512

                4617591400409e1930195795a55e20d5f063042bb3e9fd1955099066e507b6ac8a1e3ae54cc42418e2639149b31bf7e58cd5743670d9030a15e29f14d813815d

              • C:\Users\Admin\AppData\Local\e2fc4e3155b3fb3d7ad22e986531550f\Admin@GAWKBMOT_en-US\Browsers\Firefox\Bookmarks.txt

                MD5

                d41d8cd98f00b204e9800998ecf8427e

                SHA1

                da39a3ee5e6b4b0d3255bfef95601890afd80709

                SHA256

                e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                SHA512

                cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

              • C:\Users\Admin\AppData\Local\e2fc4e3155b3fb3d7ad22e986531550f\Admin@GAWKBMOT_en-US\Directories\OneDrive.txt

                Filesize

                25B

                MD5

                966247eb3ee749e21597d73c4176bd52

                SHA1

                1e9e63c2872cef8f015d4b888eb9f81b00a35c79

                SHA256

                8ddfc481b1b6ae30815ecce8a73755862f24b3bb7fdebdbf099e037d53eb082e

                SHA512

                bd30aec68c070e86e3dec787ed26dd3d6b7d33d83e43cb2d50f9e2cff779fee4c96afbbe170443bd62874073a844beb29a69b10c72c54d7d444a8d86cfd7b5aa

              • C:\Users\Admin\AppData\Local\e2fc4e3155b3fb3d7ad22e986531550f\Admin@GAWKBMOT_en-US\Directories\Startup.txt

                Filesize

                24B

                MD5

                68c93da4981d591704cea7b71cebfb97

                SHA1

                fd0f8d97463cd33892cc828b4ad04e03fc014fa6

                SHA256

                889ed51f9c16a4b989bda57957d3e132b1a9c117ee84e208207f2fa208a59483

                SHA512

                63455c726b55f2d4de87147a75ff04f2daa35278183969ccf185d23707840dd84363bec20d4e8c56252196ce555001ca0e61b3f4887d27577081fdef9e946402

              • C:\Users\Admin\AppData\Local\e2fc4e3155b3fb3d7ad22e986531550f\Admin@GAWKBMOT_en-US\System\Apps.txt

                Filesize

                1KB

                MD5

                8e3475a0678a63edc092dda39fc9bb2d

                SHA1

                589ce3f8ba1797024f6c0ab06b248c67cf739cac

                SHA256

                d2ab564b653221a1ee2f60b56437698ea39533e8aaff5773eb4506c3be227099

                SHA512

                fe263f2624d887400570d3ccaf1c6e79b239f62a1ca20e3bca6c928056be7c84b405ad80dc4bd91b073272a76852ddc8032d586142e272db2beafafd1a0ad96f

              • C:\Users\Admin\AppData\Local\e2fc4e3155b3fb3d7ad22e986531550f\Admin@GAWKBMOT_en-US\System\Debug.txt

                Filesize

                1KB

                MD5

                6038c6816d6cd11f7c460c00b2238fc6

                SHA1

                d4e182455aa02a3363a6ebb5cb0ea987b2507b69

                SHA256

                856b43e957bd20204f0f34b645706175d6eeb18120e135eccae5d39d99780ca0

                SHA512

                b00b0ce6fb86f2298c18c6ce748f71882aefe6d995b61e82494edb4647849596537b7e40c8dd7e64d5eae24d2496063d6aa9a24d9ce5a354ca94a85bb6ee4278

              • C:\Users\Admin\AppData\Local\e2fc4e3155b3fb3d7ad22e986531550f\Admin@GAWKBMOT_en-US\System\Process.txt

                Filesize

                4KB

                MD5

                cd3f1b337705d2b32c17dc4adc97a2b4

                SHA1

                45e048692510d63446ee2a5ecabe106b89306bd4

                SHA256

                d8d763b2649f655efa9b5cf7eb82b56be32bfafbc098577736de35e875d87a48

                SHA512

                2bd512434dd7066dab77565136dcbe73d869191ef4f09bc458529af3d0b4c88c5898fcdbd644dad80259e12cbefffe36d26a3fe2c252b47117c1a29a7cc9200f

              • C:\Users\Admin\AppData\Local\e2fc4e3155b3fb3d7ad22e986531550f\Admin@GAWKBMOT_en-US\System\ProductKey.txt

                Filesize

                29B

                MD5

                71eb5479298c7afc6d126fa04d2a9bde

                SHA1

                a9b3d5505cf9f84bb6c2be2acece53cb40075113

                SHA256

                f6cadfd4e4c25ff3b8cffe54a2af24a757a349abbf4e1142ec4c9789347fe8b3

                SHA512

                7c6687e21d31ec1d6d2eff04b07b465f875fd80df26677f1506b14158444cf55044eb6674880bd5bd44f04ff73023b26cb19b8837427a1d6655c96df52f140bd

              • C:\Users\Admin\AppData\Local\e2fc4e3155b3fb3d7ad22e986531550f\msgid.dat

                Filesize

                19B

                MD5

                2c293d26d4955cc89b70566a8fd0b371

                SHA1

                20849f72e81215208fc91c52ba2caf57993466bb

                SHA256

                499481147f342836968aa4af73d5280686a48c91eb9837eda1a1cfcf07f59121

                SHA512

                2b82cfed0ce3d49376eacdede47010965d529cc45d8c26d9d0bc96df56005f65eef608c177d21fd073284cb3985fbf238bd7ef66638b968977e6a7d01148810a

              • memory/2148-1224-0x0000000007E20000-0x0000000008174000-memory.dmp

                Filesize

                3.3MB

              • memory/2148-1239-0x0000000005170000-0x0000000005180000-memory.dmp

                Filesize

                64KB

              • memory/2148-944-0x0000000000400000-0x0000000000592000-memory.dmp

                Filesize

                1.6MB

              • memory/2148-1236-0x0000000006E70000-0x0000000006E7A000-memory.dmp

                Filesize

                40KB

              • memory/2148-1221-0x00000000069D0000-0x0000000006A82000-memory.dmp

                Filesize

                712KB

              • memory/2148-1237-0x0000000074790000-0x0000000074F40000-memory.dmp

                Filesize

                7.7MB

              • memory/2148-1148-0x00000000068B0000-0x000000000692A000-memory.dmp

                Filesize

                488KB

              • memory/2148-1114-0x0000000005170000-0x0000000005180000-memory.dmp

                Filesize

                64KB

              • memory/2148-1112-0x0000000005170000-0x0000000005180000-memory.dmp

                Filesize

                64KB

              • memory/2148-1238-0x0000000005170000-0x0000000005180000-memory.dmp

                Filesize

                64KB

              • memory/2148-1013-0x0000000006B20000-0x0000000006BB2000-memory.dmp

                Filesize

                584KB

              • memory/2148-1223-0x0000000006D20000-0x0000000006D42000-memory.dmp

                Filesize

                136KB

              • memory/2148-954-0x0000000006790000-0x000000000679A000-memory.dmp

                Filesize

                40KB

              • memory/2148-956-0x00000000067C0000-0x00000000067DE000-memory.dmp

                Filesize

                120KB

              • memory/2148-955-0x00000000067A0000-0x00000000067A8000-memory.dmp

                Filesize

                32KB

              • memory/2148-951-0x0000000005660000-0x00000000056F2000-memory.dmp

                Filesize

                584KB

              • memory/2148-952-0x00000000056F0000-0x0000000005716000-memory.dmp

                Filesize

                152KB

              • memory/2148-953-0x0000000005160000-0x0000000005168000-memory.dmp

                Filesize

                32KB

              • memory/2148-948-0x0000000005170000-0x0000000005180000-memory.dmp

                Filesize

                64KB

              • memory/2148-1240-0x0000000005170000-0x0000000005180000-memory.dmp

                Filesize

                64KB

              • memory/2148-946-0x0000000074790000-0x0000000074F40000-memory.dmp

                Filesize

                7.7MB

              • memory/2148-947-0x0000000005180000-0x00000000051E6000-memory.dmp

                Filesize

                408KB

              • memory/3856-58-0x0000000005160000-0x0000000005364000-memory.dmp

                Filesize

                2.0MB

              • memory/3856-64-0x0000000005160000-0x0000000005364000-memory.dmp

                Filesize

                2.0MB

              • memory/3856-20-0x0000000005160000-0x0000000005364000-memory.dmp

                Filesize

                2.0MB

              • memory/3856-16-0x0000000005160000-0x0000000005364000-memory.dmp

                Filesize

                2.0MB

              • memory/3856-12-0x0000000005160000-0x0000000005364000-memory.dmp

                Filesize

                2.0MB

              • memory/3856-8-0x0000000005160000-0x0000000005364000-memory.dmp

                Filesize

                2.0MB

              • memory/3856-6-0x0000000005160000-0x0000000005364000-memory.dmp

                Filesize

                2.0MB

              • memory/3856-937-0x0000000005370000-0x0000000005371000-memory.dmp

                Filesize

                4KB

              • memory/3856-939-0x0000000005400000-0x000000000544C000-memory.dmp

                Filesize

                304KB

              • memory/3856-938-0x0000000005620000-0x00000000057C2000-memory.dmp

                Filesize

                1.6MB

              • memory/3856-940-0x0000000006DF0000-0x0000000007394000-memory.dmp

                Filesize

                5.6MB

              • memory/3856-26-0x0000000005160000-0x0000000005364000-memory.dmp

                Filesize

                2.0MB

              • memory/3856-30-0x0000000005160000-0x0000000005364000-memory.dmp

                Filesize

                2.0MB

              • memory/3856-32-0x0000000005160000-0x0000000005364000-memory.dmp

                Filesize

                2.0MB

              • memory/3856-945-0x0000000074790000-0x0000000074F40000-memory.dmp

                Filesize

                7.7MB

              • memory/3856-38-0x0000000005160000-0x0000000005364000-memory.dmp

                Filesize

                2.0MB

              • memory/3856-42-0x0000000005160000-0x0000000005364000-memory.dmp

                Filesize

                2.0MB

              • memory/3856-46-0x0000000005160000-0x0000000005364000-memory.dmp

                Filesize

                2.0MB

              • memory/3856-52-0x0000000005160000-0x0000000005364000-memory.dmp

                Filesize

                2.0MB

              • memory/3856-56-0x0000000005160000-0x0000000005364000-memory.dmp

                Filesize

                2.0MB

              • memory/3856-60-0x0000000005160000-0x0000000005364000-memory.dmp

                Filesize

                2.0MB

              • memory/3856-22-0x0000000005160000-0x0000000005364000-memory.dmp

                Filesize

                2.0MB

              • memory/3856-68-0x0000000005160000-0x0000000005364000-memory.dmp

                Filesize

                2.0MB

              • memory/3856-66-0x0000000005160000-0x0000000005364000-memory.dmp

                Filesize

                2.0MB

              • memory/3856-62-0x0000000005160000-0x0000000005364000-memory.dmp

                Filesize

                2.0MB

              • memory/3856-1-0x0000000000240000-0x0000000000458000-memory.dmp

                Filesize

                2.1MB

              • memory/3856-54-0x0000000005160000-0x0000000005364000-memory.dmp

                Filesize

                2.0MB

              • memory/3856-50-0x0000000005160000-0x0000000005364000-memory.dmp

                Filesize

                2.0MB

              • memory/3856-48-0x0000000005160000-0x0000000005364000-memory.dmp

                Filesize

                2.0MB

              • memory/3856-44-0x0000000005160000-0x0000000005364000-memory.dmp

                Filesize

                2.0MB

              • memory/3856-40-0x0000000005160000-0x0000000005364000-memory.dmp

                Filesize

                2.0MB

              • memory/3856-36-0x0000000005160000-0x0000000005364000-memory.dmp

                Filesize

                2.0MB

              • memory/3856-34-0x0000000005160000-0x0000000005364000-memory.dmp

                Filesize

                2.0MB

              • memory/3856-28-0x0000000005160000-0x0000000005364000-memory.dmp

                Filesize

                2.0MB

              • memory/3856-24-0x0000000005160000-0x0000000005364000-memory.dmp

                Filesize

                2.0MB

              • memory/3856-18-0x0000000005160000-0x0000000005364000-memory.dmp

                Filesize

                2.0MB

              • memory/3856-14-0x0000000005160000-0x0000000005364000-memory.dmp

                Filesize

                2.0MB

              • memory/3856-10-0x0000000005160000-0x0000000005364000-memory.dmp

                Filesize

                2.0MB

              • memory/3856-5-0x0000000005160000-0x0000000005364000-memory.dmp

                Filesize

                2.0MB

              • memory/3856-4-0x0000000005160000-0x000000000536A000-memory.dmp

                Filesize

                2.0MB

              • memory/3856-3-0x0000000004EE0000-0x00000000050E8000-memory.dmp

                Filesize

                2.0MB

              • memory/3856-2-0x0000000004D90000-0x0000000004DA0000-memory.dmp

                Filesize

                64KB

              • memory/3856-0-0x0000000074790000-0x0000000074F40000-memory.dmp

                Filesize

                7.7MB