Analysis

  • max time kernel
    122s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    30-01-2024 03:55

General

  • Target

    31118351b8b0db68e9c1bc3ad1da8e7c.exe

  • Size

    2.5MB

  • MD5

    31118351b8b0db68e9c1bc3ad1da8e7c

  • SHA1

    adb461d4d199ea7367b65b185f47a10401e2ba97

  • SHA256

    1d72f409f9089ba57b151f5836df00ba70480f1530c67b1a2c81fc9b50b7cbe2

  • SHA512

    a9a3575d49a76da29df558023ea3d79e5fa9216c6ec58dc802b98ec12dfcaea71ae74b863626860f81aebd4ed1f5b7f76f90bdd84dc5a7e1741eb2bf52b73aa1

  • SSDEEP

    49152:ywoUZ8Cps0BJDmN8wjp+ps8M+1tgVO8jrHWvrYz93513:E0LSNFUps8M+MVvr2zMn

Malware Config

Extracted

Family

stealerium

C2

https://discordapp.com/api/webhooks/1197850806213431377/-zU9uA2NeaYEk4-ozdhgmNljI6NS_w_qcT_cbtxYxZdkUD3JeaKChZp4GXdod-MX3D1Q

Signatures

  • Detect ZGRat V1 34 IoCs
  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\31118351b8b0db68e9c1bc3ad1da8e7c.exe
    "C:\Users\Admin\AppData\Local\Temp\31118351b8b0db68e9c1bc3ad1da8e7c.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2468
    • C:\Users\Admin\AppData\Local\Temp\31118351b8b0db68e9c1bc3ad1da8e7c.exe
      C:\Users\Admin\AppData\Local\Temp\31118351b8b0db68e9c1bc3ad1da8e7c.exe
      2⤵
        PID:616
      • C:\Users\Admin\AppData\Local\Temp\31118351b8b0db68e9c1bc3ad1da8e7c.exe
        C:\Users\Admin\AppData\Local\Temp\31118351b8b0db68e9c1bc3ad1da8e7c.exe
        2⤵
        • Accesses Microsoft Outlook profiles
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • outlook_office_path
        • outlook_win_path
        PID:1392
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1968
          • C:\Windows\SysWOW64\chcp.com
            chcp 65001
            4⤵
              PID:2028
            • C:\Windows\SysWOW64\netsh.exe
              netsh wlan show profile
              4⤵
                PID:2620
              • C:\Windows\SysWOW64\findstr.exe
                findstr All
                4⤵
                  PID:2732
              • C:\Windows\SysWOW64\cmd.exe
                "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:2788
                • C:\Windows\SysWOW64\chcp.com
                  chcp 65001
                  4⤵
                    PID:3000
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh wlan show networks mode=bssid
                    4⤵
                      PID:2640
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 2688
                    3⤵
                    • Program crash
                    PID:2064
              • C:\Windows\system32\msiexec.exe
                C:\Windows\system32\msiexec.exe /V
                1⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:2368

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\9d1f7482b2d2b844fc5b50bef2f65af1\Admin@OZEMQECW_en-US\Browsers\Firefox\Bookmarks.txt

                Filesize

                105B

                MD5

                2e9d094dda5cdc3ce6519f75943a4ff4

                SHA1

                5d989b4ac8b699781681fe75ed9ef98191a5096c

                SHA256

                c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

                SHA512

                d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

              • C:\Users\Admin\AppData\Local\9d1f7482b2d2b844fc5b50bef2f65af1\Admin@OZEMQECW_en-US\Directories\Startup.txt

                Filesize

                24B

                MD5

                68c93da4981d591704cea7b71cebfb97

                SHA1

                fd0f8d97463cd33892cc828b4ad04e03fc014fa6

                SHA256

                889ed51f9c16a4b989bda57957d3e132b1a9c117ee84e208207f2fa208a59483

                SHA512

                63455c726b55f2d4de87147a75ff04f2daa35278183969ccf185d23707840dd84363bec20d4e8c56252196ce555001ca0e61b3f4887d27577081fdef9e946402

              • C:\Users\Admin\AppData\Local\9d1f7482b2d2b844fc5b50bef2f65af1\Admin@OZEMQECW_en-US\Directories\Videos.txt

                Filesize

                23B

                MD5

                1fddbf1169b6c75898b86e7e24bc7c1f

                SHA1

                d2091060cb5191ff70eb99c0088c182e80c20f8c

                SHA256

                a67aa329b7d878de61671e18cd2f4b011d11cbac67ea779818c6dafad2d70733

                SHA512

                20bfeafde7fec1753fef59de467bd4a3dd7fe627e8c44e95fe62b065a5768c4508e886ec5d898e911a28cf6365f455c9ab1ebe2386d17a76f53037f99061fd4d

              • C:\Users\Admin\AppData\Local\9d1f7482b2d2b844fc5b50bef2f65af1\Admin@OZEMQECW_en-US\System\Apps.txt

                Filesize

                3KB

                MD5

                b9f3ff2f21802bff33fcb17dae5d17de

                SHA1

                e33e900c78f8f87dbdbe7b362eee95014d677511

                SHA256

                a1910d820725246f1709cf322390e65117be0a1f8e892675fd270b596ffc4ad9

                SHA512

                800ebcc00b38415a73b03000361914d63ecaac15ac242421a4f46877cfa85672add8aec0a9ee1466e191887718bc40b2e2519490e88a46ed76dee548bd936bdd

              • C:\Users\Admin\AppData\Local\9d1f7482b2d2b844fc5b50bef2f65af1\Admin@OZEMQECW_en-US\System\Apps.txt

                Filesize

                6KB

                MD5

                90e05e64959dcc96ed6dfb89d65334a6

                SHA1

                76840a3fb0a3a37a497a2232912753f9a9e5733a

                SHA256

                5b7c50db5b426b201287418c6032f1b300370beb66534f8cca03cf3fa5d02876

                SHA512

                f9b909093eea8743f08ce5428909d5a3a4c087e4faf28c5617784c81e511505de37f1bbc9069fbedb8a0e0e45ec5880f70d1de34908ae45ff35706115e79f510

              • C:\Users\Admin\AppData\Local\9d1f7482b2d2b844fc5b50bef2f65af1\Admin@OZEMQECW_en-US\System\Debug.txt

                Filesize

                1KB

                MD5

                81371eb8887a2b6d3e1f7ce85896f0f0

                SHA1

                0ee463973c122061e4fc3798332a98a095486909

                SHA256

                d3d84c807876492074fe9017506614832d16c9d03f0f349284be8f798189974a

                SHA512

                dbf8b9ddc859c43ba8357208429cc7a6ead110382bea359dbddd5f4bf80055adf525ede9d34c02d8fcf659bba473c09aa844f0e38c056a31cc5032acf962fabf

              • C:\Users\Admin\AppData\Local\9d1f7482b2d2b844fc5b50bef2f65af1\Admin@OZEMQECW_en-US\System\ProductKey.txt

                Filesize

                29B

                MD5

                cad6c6bee6c11c88f5e2f69f0be6deb7

                SHA1

                289d74c3bebe6cca4e1d2e084482ad6d21316c84

                SHA256

                dc288491fadc4a85e71085890e3d6a7746e99a317cd5ef09a30272dfb10398c0

                SHA512

                e02cf6bff8b4ebd7a1346ecb1667be36c3ef7415fff77c3b9cfb370f3d0dc861f74d3e0e49065699850ba6cc025cd68d14ceb73f3b512c2a9b28873a69aff097

              • C:\Users\Admin\AppData\Local\Temp\CabA852.tmp

                Filesize

                65KB

                MD5

                ac05d27423a85adc1622c714f2cb6184

                SHA1

                b0fe2b1abddb97837ea0195be70ab2ff14d43198

                SHA256

                c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

                SHA512

                6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

              • C:\Users\Admin\AppData\Local\Temp\TarA894.tmp

                Filesize

                171KB

                MD5

                9c0c641c06238516f27941aa1166d427

                SHA1

                64cd549fb8cf014fcd9312aa7a5b023847b6c977

                SHA256

                4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

                SHA512

                936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

              • memory/1392-1120-0x0000000005C00000-0x0000000005C7A000-memory.dmp

                Filesize

                488KB

              • memory/1392-1176-0x0000000074120000-0x000000007480E000-memory.dmp

                Filesize

                6.9MB

              • memory/1392-1178-0x0000000004F30000-0x0000000004F70000-memory.dmp

                Filesize

                256KB

              • memory/1392-1075-0x0000000004F30000-0x0000000004F70000-memory.dmp

                Filesize

                256KB

              • memory/1392-1001-0x0000000000D30000-0x0000000000D4E000-memory.dmp

                Filesize

                120KB

              • memory/1392-1000-0x0000000000BB0000-0x0000000000BB8000-memory.dmp

                Filesize

                32KB

              • memory/1392-999-0x0000000000B60000-0x0000000000B6A000-memory.dmp

                Filesize

                40KB

              • memory/1392-957-0x0000000000400000-0x0000000000592000-memory.dmp

                Filesize

                1.6MB

              • memory/1392-1177-0x0000000004F30000-0x0000000004F70000-memory.dmp

                Filesize

                256KB

              • memory/1392-964-0x0000000000670000-0x0000000000678000-memory.dmp

                Filesize

                32KB

              • memory/1392-963-0x0000000000640000-0x0000000000666000-memory.dmp

                Filesize

                152KB

              • memory/1392-962-0x0000000000E20000-0x0000000000EB2000-memory.dmp

                Filesize

                584KB

              • memory/1392-958-0x0000000004F30000-0x0000000004F70000-memory.dmp

                Filesize

                256KB

              • memory/1392-956-0x0000000074120000-0x000000007480E000-memory.dmp

                Filesize

                6.9MB

              • memory/2468-26-0x0000000006370000-0x0000000006574000-memory.dmp

                Filesize

                2.0MB

              • memory/2468-38-0x0000000006370000-0x0000000006574000-memory.dmp

                Filesize

                2.0MB

              • memory/2468-44-0x0000000006370000-0x0000000006574000-memory.dmp

                Filesize

                2.0MB

              • memory/2468-46-0x0000000006370000-0x0000000006574000-memory.dmp

                Filesize

                2.0MB

              • memory/2468-48-0x0000000006370000-0x0000000006574000-memory.dmp

                Filesize

                2.0MB

              • memory/2468-52-0x0000000006370000-0x0000000006574000-memory.dmp

                Filesize

                2.0MB

              • memory/2468-54-0x0000000006370000-0x0000000006574000-memory.dmp

                Filesize

                2.0MB

              • memory/2468-50-0x0000000006370000-0x0000000006574000-memory.dmp

                Filesize

                2.0MB

              • memory/2468-56-0x0000000006370000-0x0000000006574000-memory.dmp

                Filesize

                2.0MB

              • memory/2468-58-0x0000000006370000-0x0000000006574000-memory.dmp

                Filesize

                2.0MB

              • memory/2468-60-0x0000000006370000-0x0000000006574000-memory.dmp

                Filesize

                2.0MB

              • memory/2468-62-0x0000000006370000-0x0000000006574000-memory.dmp

                Filesize

                2.0MB

              • memory/2468-64-0x0000000006370000-0x0000000006574000-memory.dmp

                Filesize

                2.0MB

              • memory/2468-66-0x0000000006370000-0x0000000006574000-memory.dmp

                Filesize

                2.0MB

              • memory/2468-68-0x0000000006370000-0x0000000006574000-memory.dmp

                Filesize

                2.0MB

              • memory/2468-937-0x00000000004E0000-0x00000000004E1000-memory.dmp

                Filesize

                4KB

              • memory/2468-938-0x0000000006740000-0x00000000068E2000-memory.dmp

                Filesize

                1.6MB

              • memory/2468-939-0x0000000002030000-0x000000000207C000-memory.dmp

                Filesize

                304KB

              • memory/2468-952-0x0000000074120000-0x000000007480E000-memory.dmp

                Filesize

                6.9MB

              • memory/2468-40-0x0000000006370000-0x0000000006574000-memory.dmp

                Filesize

                2.0MB

              • memory/2468-36-0x0000000006370000-0x0000000006574000-memory.dmp

                Filesize

                2.0MB

              • memory/2468-42-0x0000000006370000-0x0000000006574000-memory.dmp

                Filesize

                2.0MB

              • memory/2468-34-0x0000000006370000-0x0000000006574000-memory.dmp

                Filesize

                2.0MB

              • memory/2468-32-0x0000000006370000-0x0000000006574000-memory.dmp

                Filesize

                2.0MB

              • memory/2468-30-0x0000000006370000-0x0000000006574000-memory.dmp

                Filesize

                2.0MB

              • memory/2468-28-0x0000000006370000-0x0000000006574000-memory.dmp

                Filesize

                2.0MB

              • memory/2468-0-0x0000000000820000-0x0000000000A9E000-memory.dmp

                Filesize

                2.5MB

              • memory/2468-18-0x0000000006370000-0x0000000006574000-memory.dmp

                Filesize

                2.0MB

              • memory/2468-22-0x0000000006370000-0x0000000006574000-memory.dmp

                Filesize

                2.0MB

              • memory/2468-24-0x0000000006370000-0x0000000006574000-memory.dmp

                Filesize

                2.0MB

              • memory/2468-20-0x0000000006370000-0x0000000006574000-memory.dmp

                Filesize

                2.0MB

              • memory/2468-16-0x0000000006370000-0x0000000006574000-memory.dmp

                Filesize

                2.0MB

              • memory/2468-12-0x0000000006370000-0x0000000006574000-memory.dmp

                Filesize

                2.0MB

              • memory/2468-14-0x0000000006370000-0x0000000006574000-memory.dmp

                Filesize

                2.0MB

              • memory/2468-10-0x0000000006370000-0x0000000006574000-memory.dmp

                Filesize

                2.0MB

              • memory/2468-6-0x0000000006370000-0x0000000006574000-memory.dmp

                Filesize

                2.0MB

              • memory/2468-8-0x0000000006370000-0x0000000006574000-memory.dmp

                Filesize

                2.0MB

              • memory/2468-5-0x0000000006370000-0x0000000006574000-memory.dmp

                Filesize

                2.0MB

              • memory/2468-4-0x0000000006370000-0x000000000657A000-memory.dmp

                Filesize

                2.0MB

              • memory/2468-3-0x0000000004E10000-0x000000000501A000-memory.dmp

                Filesize

                2.0MB

              • memory/2468-2-0x0000000004AF0000-0x0000000004B30000-memory.dmp

                Filesize

                256KB

              • memory/2468-1-0x0000000074120000-0x000000007480E000-memory.dmp

                Filesize

                6.9MB