Analysis
- max time kernel
147s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
13/03/2024, 09:39
General
- Target c58af9384d71e33bae1d8a032d9e7b19.exe
- Size 4.0MB
- Sample240313-lmmxpaaa81
- SHA256 77189b22dfb8238a4837f95e3283150bca8105d618cc421cde8170644bcf878b
Malware Config
Signatures
- Detect ZGRat V1 35 IoCs
- Detects Echelon Stealer payload 2 IoCs
- Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
- ZGRat
ZGRat is remote access trojan written in C#.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c58af9384d71e33bae1d8a032d9e7b19.exe"C:\Users\Admin\AppData\Local\Temp\c58af9384d71e33bae1d8a032d9e7b19.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WinNetcommon\WinNetcommon.exe"C:\Users\Admin\AppData\Roaming\WinNetcommon\WinNetcommon.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Decoder.exe"C:\ProgramData\Decoder.exe"3⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.cmd""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 44⤵
- Delays execution with timeout.exe
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Decoder.exe
Bookmarks.txt
ProcessList.txt
ProcessList.txt
ProcessList.txt
.cmd
tmp88B8.tmp.dat
tmp88C9.tmp.dat
Passwords_Edge.txt
WinNetcommon.exe
memory/1588-9-0x000000001B630000-0x000000001B640000-memory.dmp
memory/1588-105-0x00007FFFCCF50000-0x00007FFFCDA11000-memory.dmp
memory/1588-10-0x000000001BC40000-0x000000001BCB6000-memory.dmp
memory/1588-7-0x00000000007B0000-0x0000000000934000-memory.dmp
memory/1588-8-0x00007FFFCCF50000-0x00007FFFCDA11000-memory.dmp
memory/4844-145-0x0000000004B90000-0x0000000004C24000-memory.dmp
memory/4844-161-0x0000000004B90000-0x0000000004C24000-memory.dmp
memory/4844-113-0x0000000004B90000-0x0000000004C2A000-memory.dmp
memory/4844-115-0x0000000004B90000-0x0000000004C24000-memory.dmp
memory/4844-114-0x0000000004B90000-0x0000000004C24000-memory.dmp
memory/4844-117-0x0000000004B90000-0x0000000004C24000-memory.dmp
memory/4844-119-0x0000000004B90000-0x0000000004C24000-memory.dmp
memory/4844-121-0x0000000004B90000-0x0000000004C24000-memory.dmp
memory/4844-123-0x0000000004B90000-0x0000000004C24000-memory.dmp
memory/4844-127-0x0000000004B90000-0x0000000004C24000-memory.dmp
memory/4844-125-0x0000000004B90000-0x0000000004C24000-memory.dmp
memory/4844-129-0x0000000004B90000-0x0000000004C24000-memory.dmp
memory/4844-131-0x0000000004B90000-0x0000000004C24000-memory.dmp
memory/4844-133-0x0000000004B90000-0x0000000004C24000-memory.dmp
memory/4844-139-0x0000000004B90000-0x0000000004C24000-memory.dmp
memory/4844-137-0x0000000004B90000-0x0000000004C24000-memory.dmp
memory/4844-135-0x0000000004B90000-0x0000000004C24000-memory.dmp
memory/4844-141-0x0000000004B90000-0x0000000004C24000-memory.dmp
memory/4844-143-0x0000000004B90000-0x0000000004C24000-memory.dmp
memory/4844-111-0x0000000004C50000-0x0000000004C60000-memory.dmp
memory/4844-147-0x0000000004B90000-0x0000000004C24000-memory.dmp
memory/4844-149-0x0000000004B90000-0x0000000004C24000-memory.dmp
memory/4844-151-0x0000000004B90000-0x0000000004C24000-memory.dmp
memory/4844-153-0x0000000004B90000-0x0000000004C24000-memory.dmp
memory/4844-157-0x0000000004B90000-0x0000000004C24000-memory.dmp
memory/4844-155-0x0000000004B90000-0x0000000004C24000-memory.dmp
memory/4844-159-0x0000000004B90000-0x0000000004C24000-memory.dmp
memory/4844-112-0x0000000004D00000-0x00000000052A4000-memory.dmp
memory/4844-163-0x0000000004B90000-0x0000000004C24000-memory.dmp
memory/4844-165-0x0000000004B90000-0x0000000004C24000-memory.dmp
memory/4844-167-0x0000000004B90000-0x0000000004C24000-memory.dmp
memory/4844-169-0x0000000004B90000-0x0000000004C24000-memory.dmp
memory/4844-171-0x0000000004B90000-0x0000000004C24000-memory.dmp
memory/4844-173-0x0000000004B90000-0x0000000004C24000-memory.dmp
memory/4844-177-0x0000000004B90000-0x0000000004C24000-memory.dmp
memory/4844-175-0x0000000004B90000-0x0000000004C24000-memory.dmp
memory/4844-562-0x0000000004C50000-0x0000000004C60000-memory.dmp
memory/4844-110-0x0000000004C50000-0x0000000004C60000-memory.dmp
memory/4844-109-0x0000000004C50000-0x0000000004C60000-memory.dmp
memory/4844-108-0x0000000004C60000-0x0000000004CFC000-memory.dmp
memory/4844-595-0x0000000006370000-0x0000000006402000-memory.dmp
memory/4844-107-0x0000000074D20000-0x00000000754D0000-memory.dmp
memory/4844-713-0x0000000074D20000-0x00000000754D0000-memory.dmp
memory/4844-710-0x0000000004C50000-0x0000000004C60000-memory.dmp
memory/4844-690-0x00000000072A0000-0x0000000007306000-memory.dmp
memory/4844-694-0x00000000056E0000-0x0000000005756000-memory.dmp
memory/4844-707-0x0000000074D20000-0x00000000754D0000-memory.dmp
memory/4844-708-0x0000000004C50000-0x0000000004C60000-memory.dmp
memory/4844-709-0x0000000004C50000-0x0000000004C60000-memory.dmp
memory/4996-0-0x0000000000020000-0x0000000000420000-memory.dmp
memory/4996-1-0x00007FFFCCF50000-0x00007FFFCDA11000-memory.dmp
memory/4996-2-0x000000001AFF0000-0x000000001B000000-memory.dmp
memory/4996-12-0x00007FFFCCF50000-0x00007FFFCDA11000-memory.dmp