Analysis
- max time kernel
153s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
04/02/2024, 06:25
General
- Target 8e71e9516683fb3becd0c6cdf5a9fa64.exe
- Size 419KB
- Sample240204-g6lfradgar
- SHA256 adfc1312ed080bcd3fff720269f3c544b5f33194acb71f36b2393d85eeedc34a
Malware Config
Extracted
-
xloader
-
2.3
-
ur5u
-
365happyday.xyz
-
maxiemier.info
-
desarapen.com
-
manjalmatrimony.com
-
developingservice.com
-
cxdnl.com
-
srlwujbj.icu
-
couldve-wouldve-shouldve.com
-
cruzingtovazquez.com
-
nishifleurs.com
-
ssgasi9a.com
-
jiantxcallbackc.com
-
myonlineslotsfree.com
-
kiahhco.com
-
extra-times.net
-
tvfenxiang.com
-
fluid-branding.com
-
esquire-capital.com
-
arvictories.com
-
energyvibrance.com
Signatures
- Detect ZGRat V1 34 IoCs
- Xloader
Xloader is a rebranded version of Formbook malware.
- ZGRat
ZGRat is remote access trojan written in C#.
- Xloader payload 5 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 46 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 30 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8e71e9516683fb3becd0c6cdf5a9fa64.exe"C:\Users\Admin\AppData\Local\Temp\8e71e9516683fb3becd0c6cdf5a9fa64.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.83⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.83⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\8e71e9516683fb3becd0c6cdf5a9fa64.exeC:\Users\Admin\AppData\Local\Temp\8e71e9516683fb3becd0c6cdf5a9fa64.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\8e71e9516683fb3becd0c6cdf5a9fa64.exeC:\Users\Admin\AppData\Local\Temp\8e71e9516683fb3becd0c6cdf5a9fa64.exe3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FB_7ED0.tmp.exe"C:\Users\Admin\AppData\Local\Temp\FB_7ED0.tmp.exe"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\FB_7FEA.tmp.exe"C:\Users\Admin\AppData\Local\Temp\FB_7FEA.tmp.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\FB_7FEA.tmp.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
FB_7ED0.tmp.exe
FB_7FEA.tmp.exe
__PSScriptPolicyTest_n4kw2hgo.kip.ps1
memory/536-2513-0x00000000014C0000-0x000000000180A000-memory.dmp
memory/536-2514-0x0000000000D70000-0x0000000000D98000-memory.dmp
memory/536-2515-0x0000000000D50000-0x0000000000D60000-memory.dmp
memory/1432-11-0x00000000054C0000-0x00000000054E2000-memory.dmp
memory/1432-28-0x0000000006B10000-0x0000000006B32000-memory.dmp
memory/1432-23-0x00000000060A0000-0x00000000063F4000-memory.dmp
memory/1432-24-0x00000000065C0000-0x00000000065DE000-memory.dmp
memory/1432-25-0x0000000006670000-0x00000000066BC000-memory.dmp
memory/1432-26-0x0000000007790000-0x0000000007826000-memory.dmp
memory/1432-27-0x0000000006AA0000-0x0000000006ABA000-memory.dmp
memory/1432-13-0x0000000005D70000-0x0000000005DD6000-memory.dmp
memory/1432-29-0x0000000008A10000-0x000000000908A000-memory.dmp
memory/1432-32-0x0000000074490000-0x0000000074C40000-memory.dmp
memory/1432-12-0x0000000005560000-0x00000000055C6000-memory.dmp
memory/1432-10-0x0000000005740000-0x0000000005D68000-memory.dmp
memory/1432-9-0x0000000005100000-0x0000000005110000-memory.dmp
memory/1432-8-0x0000000005100000-0x0000000005110000-memory.dmp
memory/1432-7-0x0000000074490000-0x0000000074C40000-memory.dmp
memory/1432-6-0x0000000002C80000-0x0000000002CB6000-memory.dmp
memory/2024-65-0x0000000006750000-0x00000000067C5000-memory.dmp
memory/2024-101-0x0000000006750000-0x00000000067C5000-memory.dmp
memory/2024-0-0x0000000000920000-0x0000000000990000-memory.dmp
memory/2024-1-0x0000000074490000-0x0000000074C40000-memory.dmp
memory/2024-2-0x0000000005890000-0x0000000005E34000-memory.dmp
memory/2024-48-0x0000000074490000-0x0000000074C40000-memory.dmp
memory/2024-3-0x0000000005380000-0x0000000005412000-memory.dmp
memory/2024-51-0x00000000054C0000-0x00000000054D0000-memory.dmp
memory/2024-52-0x00000000066B0000-0x0000000006716000-memory.dmp
memory/2024-53-0x0000000006750000-0x00000000067CC000-memory.dmp
memory/2024-54-0x0000000006750000-0x00000000067C5000-memory.dmp
memory/2024-55-0x0000000006750000-0x00000000067C5000-memory.dmp
memory/2024-57-0x0000000006750000-0x00000000067C5000-memory.dmp
memory/2024-61-0x0000000006750000-0x00000000067C5000-memory.dmp
memory/2024-63-0x0000000006750000-0x00000000067C5000-memory.dmp
memory/2024-59-0x0000000006750000-0x00000000067C5000-memory.dmp
memory/2024-5-0x0000000005440000-0x000000000544A000-memory.dmp
memory/2024-67-0x0000000006750000-0x00000000067C5000-memory.dmp
memory/2024-69-0x0000000006750000-0x00000000067C5000-memory.dmp
memory/2024-71-0x0000000006750000-0x00000000067C5000-memory.dmp
memory/2024-73-0x0000000006750000-0x00000000067C5000-memory.dmp
memory/2024-75-0x0000000006750000-0x00000000067C5000-memory.dmp
memory/2024-91-0x0000000006750000-0x00000000067C5000-memory.dmp
memory/2024-89-0x0000000006750000-0x00000000067C5000-memory.dmp
memory/2024-93-0x0000000006750000-0x00000000067C5000-memory.dmp
memory/2024-87-0x0000000006750000-0x00000000067C5000-memory.dmp
memory/2024-105-0x0000000006750000-0x00000000067C5000-memory.dmp
memory/2024-107-0x0000000006750000-0x00000000067C5000-memory.dmp
memory/2024-103-0x0000000006750000-0x00000000067C5000-memory.dmp
memory/2024-4-0x00000000054C0000-0x00000000054D0000-memory.dmp
memory/2024-99-0x0000000006750000-0x00000000067C5000-memory.dmp
memory/2024-97-0x0000000006750000-0x00000000067C5000-memory.dmp
memory/2024-95-0x0000000006750000-0x00000000067C5000-memory.dmp
memory/2024-85-0x0000000006750000-0x00000000067C5000-memory.dmp
memory/2024-83-0x0000000006750000-0x00000000067C5000-memory.dmp
memory/2024-81-0x0000000006750000-0x00000000067C5000-memory.dmp
memory/2024-79-0x0000000006750000-0x00000000067C5000-memory.dmp
memory/2024-77-0x0000000006750000-0x00000000067C5000-memory.dmp
memory/2024-109-0x0000000006750000-0x00000000067C5000-memory.dmp
memory/2024-111-0x0000000006750000-0x00000000067C5000-memory.dmp
memory/2024-117-0x0000000006750000-0x00000000067C5000-memory.dmp
memory/2024-115-0x0000000006750000-0x00000000067C5000-memory.dmp
memory/2024-113-0x0000000006750000-0x00000000067C5000-memory.dmp
memory/2024-2496-0x0000000074490000-0x0000000074C40000-memory.dmp
memory/2084-2520-0x0000000000CB0000-0x00000000010E3000-memory.dmp
memory/2084-2528-0x0000000001400000-0x0000000001428000-memory.dmp
memory/2084-2525-0x00000000031B0000-0x000000000323F000-memory.dmp
memory/2084-2522-0x0000000003350000-0x000000000369A000-memory.dmp
memory/2084-2521-0x0000000001400000-0x0000000001428000-memory.dmp
memory/2304-34-0x0000000074490000-0x0000000074C40000-memory.dmp
memory/2304-36-0x0000000005450000-0x0000000005460000-memory.dmp
memory/2304-38-0x00000000062E0000-0x0000000006634000-memory.dmp
memory/2304-50-0x0000000074490000-0x0000000074C40000-memory.dmp
memory/2304-35-0x0000000005450000-0x0000000005460000-memory.dmp
memory/3300-2497-0x0000000000400000-0x000000000042E000-memory.dmp
memory/3392-2516-0x0000000002A80000-0x0000000002B32000-memory.dmp
memory/3392-2526-0x0000000002A80000-0x0000000002B32000-memory.dmp
memory/3392-2530-0x0000000008140000-0x00000000081E6000-memory.dmp
memory/3392-2534-0x0000000008140000-0x00000000081E6000-memory.dmp