Analysis

  • max time kernel
    150s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/03/2024, 01:18

General

  • Target

    531f41f23a4d59dc025170f0b2cf0713ac8672a45f20cfeb02ecb34692032696.exe

  • Size

    1.0MB

  • MD5

    366744603ffec08845dc309908341641

  • SHA1

    c79aa9df75843ee1ec55782117542cc511297b9f

  • SHA256

    531f41f23a4d59dc025170f0b2cf0713ac8672a45f20cfeb02ecb34692032696

  • SHA512

    948f07ef3abf1201555ac03d775a0daca69eb27e979d19a9b5aced21246d4b13bc10433d1d3de0716e1b180febc594ac4329eeaa2aa2d923fbecbda8c5f259df

  • SSDEEP

    24576:+PF6DSSEvVi8ds05OTOfYIOBRaR6URr0GDp6epPEM:+PazuAOfh4RaR6URrNp3

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    eu-west-1.sftpcloud.io
  • Port:
    21
  • Username:
    7ca6b8c78c944c7bbcffb6e105194795
  • Password:
    0Ygw7MnwUGGUk95kfauRAZgEl1zVgfFB

Signatures

  • Detect ZGRat V1 30 IoCs
  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • ModiLoader Second Stage 5 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\531f41f23a4d59dc025170f0b2cf0713ac8672a45f20cfeb02ecb34692032696.exe
    "C:\Users\Admin\AppData\Local\Temp\531f41f23a4d59dc025170f0b2cf0713ac8672a45f20cfeb02ecb34692032696.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:116
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c mkdir "\\?\C:\Windows "
      2⤵
        PID:2816
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c mkdir "\\?\C:\Windows \System32"
        2⤵
          PID:884
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c "C:\Windows \System32\8695336.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:856
          • C:\Windows \System32\8695336.exe
            "C:\Windows \System32\8695336.exe"
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:544
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\windows \system32\KDECO.bat""
              4⤵
                PID:2520
                • C:\Windows\system32\cmd.exe
                  cmd /c powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4464
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
                    6⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5104
          • C:\Windows\SysWOW64\extrac32.exe
            C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Admin\AppData\Local\Temp\531f41f23a4d59dc025170f0b2cf0713ac8672a45f20cfeb02ecb34692032696.exe C:\\Users\\Public\\Libraries\\Ajakmxds.PIF
            2⤵
              PID:3732
            • C:\Users\Public\Libraries\sdxmkajA.pif
              C:\Users\Public\Libraries\sdxmkajA.pif
              2⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3248

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ihuviuri.0ei.ps1

                  Filesize

                  60B

                  MD5

                  d17fe0a3f47be24a6453e9ef58c94641

                  SHA1

                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                  SHA256

                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                  SHA512

                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                • C:\Users\Public\Libraries\sdxmkajA.pif

                  Filesize

                  66KB

                  MD5

                  c116d3604ceafe7057d77ff27552c215

                  SHA1

                  452b14432fb5758b46f2897aeccd89f7c82a727d

                  SHA256

                  7bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301

                  SHA512

                  9202a00eeaf4c5be94de32fd41bfea40fc32d368955d49b7bad2b5c23c4ebc92dccb37d99f5a14e53ad674b63f1baa6efb1feb27225c86693ead3262a26d66c6

                • C:\Windows \System32\8695336.exe

                  Filesize

                  128KB

                  MD5

                  231ce1e1d7d98b44371ffff407d68b59

                  SHA1

                  25510d0f6353dbf0c9f72fc880de7585e34b28ff

                  SHA256

                  30951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96

                  SHA512

                  520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612

                • C:\Windows \System32\netutils.dll

                  Filesize

                  112KB

                  MD5

                  fa7aa88417d0c48807144a1a48fe3fbc

                  SHA1

                  6f5ec990b12d4a6075050a94e0d68d03781fa46d

                  SHA256

                  2019dcd18ba7d5554a4a9da882740aa883941670af3de9396960081a0f8aa098

                  SHA512

                  99b2eb6f8e7d00a3803cba229149e5e0cb67a3deb607782c55fbacd25d9c074cce83759de15490eff939d5ad98f26cdbd44395cc79ffe22753e16c3d9e3b5fff

                • memory/116-0-0x00000000006B0000-0x00000000006B1000-memory.dmp

                  Filesize

                  4KB

                • memory/116-1-0x0000000003F60000-0x0000000004F60000-memory.dmp

                  Filesize

                  16.0MB

                • memory/116-2-0x0000000003F60000-0x0000000004F60000-memory.dmp

                  Filesize

                  16.0MB

                • memory/116-4-0x0000000000400000-0x000000000050F000-memory.dmp

                  Filesize

                  1.1MB

                • memory/544-15-0x00000000613C0000-0x00000000613E3000-memory.dmp

                  Filesize

                  140KB

                • memory/3248-75-0x000000004C870000-0x000000004C8C3000-memory.dmp

                  Filesize

                  332KB

                • memory/3248-83-0x000000004C870000-0x000000004C8C3000-memory.dmp

                  Filesize

                  332KB

                • memory/3248-1118-0x000000004C2B0000-0x000000004C2C0000-memory.dmp

                  Filesize

                  64KB

                • memory/3248-1117-0x0000000074B40000-0x00000000752F0000-memory.dmp

                  Filesize

                  7.7MB

                • memory/3248-40-0x0000000000400000-0x0000000001400000-memory.dmp

                  Filesize

                  16.0MB

                • memory/3248-45-0x0000000000400000-0x0000000001400000-memory.dmp

                  Filesize

                  16.0MB

                • memory/3248-46-0x000000004C1B0000-0x000000004C20A000-memory.dmp

                  Filesize

                  360KB

                • memory/3248-47-0x000000004C2C0000-0x000000004C864000-memory.dmp

                  Filesize

                  5.6MB

                • memory/3248-48-0x000000004C870000-0x000000004C8C8000-memory.dmp

                  Filesize

                  352KB

                • memory/3248-49-0x000000004C870000-0x000000004C8C3000-memory.dmp

                  Filesize

                  332KB

                • memory/3248-50-0x000000004C870000-0x000000004C8C3000-memory.dmp

                  Filesize

                  332KB

                • memory/3248-52-0x000000004C870000-0x000000004C8C3000-memory.dmp

                  Filesize

                  332KB

                • memory/3248-54-0x000000004C870000-0x000000004C8C3000-memory.dmp

                  Filesize

                  332KB

                • memory/3248-56-0x000000004C870000-0x000000004C8C3000-memory.dmp

                  Filesize

                  332KB

                • memory/3248-58-0x000000004C870000-0x000000004C8C3000-memory.dmp

                  Filesize

                  332KB

                • memory/3248-60-0x000000004C870000-0x000000004C8C3000-memory.dmp

                  Filesize

                  332KB

                • memory/3248-62-0x000000004C870000-0x000000004C8C3000-memory.dmp

                  Filesize

                  332KB

                • memory/3248-64-0x000000004C870000-0x000000004C8C3000-memory.dmp

                  Filesize

                  332KB

                • memory/3248-67-0x0000000000400000-0x0000000001400000-memory.dmp

                  Filesize

                  16.0MB

                • memory/3248-66-0x000000004C870000-0x000000004C8C3000-memory.dmp

                  Filesize

                  332KB

                • memory/3248-69-0x000000004C870000-0x000000004C8C3000-memory.dmp

                  Filesize

                  332KB

                • memory/3248-71-0x000000004C870000-0x000000004C8C3000-memory.dmp

                  Filesize

                  332KB

                • memory/3248-73-0x000000004C870000-0x000000004C8C3000-memory.dmp

                  Filesize

                  332KB

                • memory/3248-43-0x0000000000400000-0x0000000001400000-memory.dmp

                  Filesize

                  16.0MB

                • memory/3248-77-0x000000004C870000-0x000000004C8C3000-memory.dmp

                  Filesize

                  332KB

                • memory/3248-79-0x000000004C870000-0x000000004C8C3000-memory.dmp

                  Filesize

                  332KB

                • memory/3248-81-0x000000004C870000-0x000000004C8C3000-memory.dmp

                  Filesize

                  332KB

                • memory/3248-1116-0x000000004C2B0000-0x000000004C2C0000-memory.dmp

                  Filesize

                  64KB

                • memory/3248-86-0x000000004C2B0000-0x000000004C2C0000-memory.dmp

                  Filesize

                  64KB

                • memory/3248-87-0x000000004C2B0000-0x000000004C2C0000-memory.dmp

                  Filesize

                  64KB

                • memory/3248-85-0x000000004C870000-0x000000004C8C3000-memory.dmp

                  Filesize

                  332KB

                • memory/3248-90-0x000000004C870000-0x000000004C8C3000-memory.dmp

                  Filesize

                  332KB

                • memory/3248-89-0x000000004C2B0000-0x000000004C2C0000-memory.dmp

                  Filesize

                  64KB

                • memory/3248-92-0x000000004C870000-0x000000004C8C3000-memory.dmp

                  Filesize

                  332KB

                • memory/3248-94-0x000000004C870000-0x000000004C8C3000-memory.dmp

                  Filesize

                  332KB

                • memory/3248-96-0x000000004C870000-0x000000004C8C3000-memory.dmp

                  Filesize

                  332KB

                • memory/3248-98-0x000000004C870000-0x000000004C8C3000-memory.dmp

                  Filesize

                  332KB

                • memory/3248-100-0x000000004C870000-0x000000004C8C3000-memory.dmp

                  Filesize

                  332KB

                • memory/3248-102-0x000000004C870000-0x000000004C8C3000-memory.dmp

                  Filesize

                  332KB

                • memory/3248-103-0x0000000074B40000-0x00000000752F0000-memory.dmp

                  Filesize

                  7.7MB

                • memory/3248-105-0x000000004C870000-0x000000004C8C3000-memory.dmp

                  Filesize

                  332KB

                • memory/3248-107-0x000000004C870000-0x000000004C8C3000-memory.dmp

                  Filesize

                  332KB

                • memory/3248-1106-0x000000004CA00000-0x000000004CA66000-memory.dmp

                  Filesize

                  408KB

                • memory/3248-1107-0x000000004C2B0000-0x000000004C2C0000-memory.dmp

                  Filesize

                  64KB

                • memory/3248-1108-0x000000004D2D0000-0x000000004D320000-memory.dmp

                  Filesize

                  320KB

                • memory/3248-1109-0x000000004D320000-0x000000004D3BC000-memory.dmp

                  Filesize

                  624KB

                • memory/3248-1110-0x000000004DB00000-0x000000004DB92000-memory.dmp

                  Filesize

                  584KB

                • memory/3248-1111-0x000000004DD20000-0x000000004DD2A000-memory.dmp

                  Filesize

                  40KB

                • memory/3248-1114-0x000000004C2B0000-0x000000004C2C0000-memory.dmp

                  Filesize

                  64KB

                • memory/3248-1115-0x000000004C2B0000-0x000000004C2C0000-memory.dmp

                  Filesize

                  64KB

                • memory/5104-21-0x00000234CE660000-0x00000234CE682000-memory.dmp

                  Filesize

                  136KB

                • memory/5104-27-0x00000234CE6F0000-0x00000234CE700000-memory.dmp

                  Filesize

                  64KB

                • memory/5104-26-0x00007FFD6A600000-0x00007FFD6B0C1000-memory.dmp

                  Filesize

                  10.8MB

                • memory/5104-28-0x00000234CE6F0000-0x00000234CE700000-memory.dmp

                  Filesize

                  64KB

                • memory/5104-31-0x00007FFD6A600000-0x00007FFD6B0C1000-memory.dmp

                  Filesize

                  10.8MB