Overview

overview

7

Static

static

7

9f0a09e850...e0.exe

windows7-x64

7

9f0a09e850...e0.exe

windows10-2004-x64

7

$LOCALAPPD...ly.exe

windows7-x64

7

$LOCALAPPD...ly.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows7-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...om.dll

windows7-x64

7

$PLUGINSDI...om.dll

windows10-2004-x64

7

$PLUGINSDI...dt.dll

windows7-x64

1

$PLUGINSDI...dt.dll

windows10-2004-x64

1

$PLUGINSDI...ry.dll

windows7-x64

3

$PLUGINSDI...ry.dll

windows10-2004-x64

3

$PLUGINSDI...on.dll

windows7-x64

7

$PLUGINSDI...on.dll

windows10-2004-x64

7

$_0_/exten...lts.js

windows7-x64

1

$_0_/exten...lts.js

windows10-2004-x64

1

background.html

windows7-x64

1

background.html

windows10-2004-x64

1

DealPlyIE.dll

windows7-x64

6

DealPlyIE.dll

windows10-2004-x64

6

vn-zugo.exe

windows7-x64

7

vn-zugo.exe

windows10-2004-x64

7

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDIR/Math.dll

windows7-x64

3

$PLUGINSDIR/Math.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows7-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    145s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/02/2024, 01:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    vn-zugo.exe
  • Size 720KB
  • Sample240216-bd3xfadh46
  • SHA256 a2efbc9b9a4d99cf60bd3e3b631dbe6116f31c15ccefc9f28ba3c95404afd63f
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\vn-zugo.exe
    "C:\Users\Admin\AppData\Local\Temp\vn-zugo.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    PID:3936

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        GetVersion.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsr56CD.tmp\GetVersion.dll
        • Size 6KB
        • SHA256 7d76c7dd8f7cd5a87e0118dacb434db3971a049501e22a5f4b947154621ab3d4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Math.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsr56CD.tmp\Math.dll
        • Size 66KB
        • SHA256 0598f7d83db44929b7170c1285457b52b4281185f63ced102e709bf065f10d67
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        NSISdl.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsr56CD.tmp\NSISdl.dll
        • Size 14KB
        • SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsr56CD.tmp\System.dll
        • Size 11KB
        • SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        inetc.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsr56CD.tmp\inetc.dll
        • Size 20KB
        • SHA256 4c4d85eb9725fc7fade03467990e3dd9671c29a7870c97e69babc2cb3c9adef9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        linker.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsr56CD.tmp\linker.dll
        • Size 6KB
        • SHA256 53aa57e582dc56421c1191a0a9efac9c36960b903b7d825f3b9682605ec2b612
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        md5dll.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsr56CD.tmp\md5dll.dll
        • Size 8KB
        • SHA256 9b05dd603f13c196f3f21c43f48834208fed2294f7090fcd1334931014611fb2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        nsProcess.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsr56CD.tmp\nsProcess.dll
        • Size 4KB
        • SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
        • MD5 SHA1 SHA512
        Submit Download

        nshist.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsr56CD.tmp\nshist.dll
        • Size 39KB
        • SHA256 77f38240d729758f04fbd6ac00dc638e99ba27c42fa48200c99f51449e245343
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tbdata.json
        • Path C:\Users\Admin\AppData\Local\Temp\nsr56CD.tmp\tbdata.json
        • Size 1KB
        • SHA256 cf04dc76714155d7df1326381aa5f78163f277fa465170e1293261bf07897cb8
        • MD5 SHA1 SHA512
        Submit Download

        timepro.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsr56CD.tmp\timepro.dll
        • Size 20KB
        • SHA256 c1ed8c398108dc56fbb6fd6797c3c9df59447e2a2f198b72a45058124971b09c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/3936-19-0x0000000002310000-0x000000000232A000-memory.dmp
        Download

        memory/3936-34-0x0000000002330000-0x0000000002339000-memory.dmp
        Download

        memory/3936-226-0x0000000004050000-0x0000000004059000-memory.dmp
        Download