Analysis

  • max time kernel
    109s
  • max time network
    110s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    08/04/2024, 23:35

General

  • Target

    VALO STRIKE/VALO STRIKE.exe

  • Size

    908KB

  • MD5

    d39ffc7d850cc3a5f2b55cb51729b4dd

  • SHA1

    3ea25c22239beef9e28fe8ac2d2e9858593dfe0a

  • SHA256

    02bc75d88f6bb8577a6825692bcd65b4ec941356b935edb8c6ec746cfcc2a39c

  • SHA512

    07075833b2b74275906c85437d04ee99a7e668a0d3cdcc7a6eeb88ced5ff0208f9873e3136b660708675e2b7225f0ca2a0169f0c4c09d32a3ca4decb39100750

  • SSDEEP

    6144:5PZHfaiAuNkAbQuek6f6YZC9sOjftfzg1sjn03pRrx5tFFq9rMbhTz:RZ/aduNBbGDf6YgX7g1w0NXFw9AVTz

Malware Config

Signatures

  • Detect ZGRat V1 8 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 8 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 1 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VALO STRIKE\VALO STRIKE.exe
    "C:\Users\Admin\AppData\Local\Temp\VALO STRIKE\VALO STRIKE.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1620
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:1976
    • C:\Windows\system32\SearchIndexer.exe
      C:\Windows\system32\SearchIndexer.exe /Embedding
      1⤵
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:536
      • C:\Windows\system32\SearchProtocolHost.exe
        "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
        2⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious use of SetWindowsHookEx
        PID:1456
      • C:\Windows\system32\SearchFilterHost.exe
        "C:\Windows\system32\SearchFilterHost.exe" 0 508 512 520 65536 516
        2⤵
        • Modifies data under HKEY_USERS
        PID:948
    • C:\Users\Admin\AppData\Local\Temp\VALO STRIKE\VALO STRIKE.exe
      "C:\Users\Admin\AppData\Local\Temp\VALO STRIKE\VALO STRIKE.exe"
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3012
    • C:\Users\Admin\AppData\Local\Temp\VALO STRIKE\VALO STRIKE.exe
      "C:\Users\Admin\AppData\Local\Temp\VALO STRIKE\VALO STRIKE.exe"
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2404
    • C:\Users\Admin\AppData\Local\Temp\VALO STRIKE\VALO STRIKE.exe
      "C:\Users\Admin\AppData\Local\Temp\VALO STRIKE\VALO STRIKE.exe"
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1352
    • C:\Users\Admin\AppData\Local\Temp\VALO STRIKE\VALO STRIKE.exe
      "C:\Users\Admin\AppData\Local\Temp\VALO STRIKE\VALO STRIKE.exe"
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:572
    • C:\Users\Admin\AppData\Local\Temp\VALO STRIKE\VALO STRIKE.exe
      "C:\Users\Admin\AppData\Local\Temp\VALO STRIKE\VALO STRIKE.exe"
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2080

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

            Filesize

            1024KB

            MD5

            10b29ab6a20f00bfb34f115d114c9f3a

            SHA1

            12fe0187e6ad0382241bf272f4c876d5cfb84cda

            SHA256

            618d9073b5daaa227bc665901cb63eb5399f5e7c6a530fd298dfe8f90f4acd65

            SHA512

            8dcc96c7a2959f07cb9ef87ae512a84f00cbeaa50a9a92b121fe5557664b3ec6b36c49e443ad654fb1dbd06f6f9147913805b821d8b9e025e89ca9ff28c61f35

          • memory/536-58-0x0000000002EC0000-0x0000000002EC8000-memory.dmp

            Filesize

            32KB

          • memory/536-112-0x0000000003850000-0x0000000003858000-memory.dmp

            Filesize

            32KB

          • memory/536-75-0x00000000032B0000-0x00000000032B8000-memory.dmp

            Filesize

            32KB

          • memory/536-69-0x0000000002F10000-0x0000000002F18000-memory.dmp

            Filesize

            32KB

          • memory/536-60-0x0000000002E70000-0x0000000002E71000-memory.dmp

            Filesize

            4KB

          • memory/536-9-0x0000000001A70000-0x0000000001A80000-memory.dmp

            Filesize

            64KB

          • memory/536-25-0x0000000001B70000-0x0000000001B80000-memory.dmp

            Filesize

            64KB

          • memory/536-51-0x0000000002F00000-0x0000000002F08000-memory.dmp

            Filesize

            32KB

          • memory/536-52-0x0000000002EC0000-0x0000000002EC1000-memory.dmp

            Filesize

            4KB

          • memory/572-104-0x0000000072350000-0x0000000072A3E000-memory.dmp

            Filesize

            6.9MB

          • memory/572-128-0x0000000072350000-0x0000000072A3E000-memory.dmp

            Filesize

            6.9MB

          • memory/572-99-0x00000000005C0000-0x0000000000674000-memory.dmp

            Filesize

            720KB

          • memory/948-116-0x000007FEDBDF0000-0x000007FEDBDFA000-memory.dmp

            Filesize

            40KB

          • memory/948-115-0x000007FEF5370000-0x000007FEF54B3000-memory.dmp

            Filesize

            1.3MB

          • memory/948-87-0x000007FEF5370000-0x000007FEF54B3000-memory.dmp

            Filesize

            1.3MB

          • memory/948-88-0x000007FEDBDF0000-0x000007FEDBDFA000-memory.dmp

            Filesize

            40KB

          • memory/1352-90-0x0000000000460000-0x0000000000514000-memory.dmp

            Filesize

            720KB

          • memory/1352-122-0x0000000072350000-0x0000000072A3E000-memory.dmp

            Filesize

            6.9MB

          • memory/1352-96-0x00000000051E0000-0x0000000005220000-memory.dmp

            Filesize

            256KB

          • memory/1352-95-0x0000000072350000-0x0000000072A3E000-memory.dmp

            Filesize

            6.9MB

          • memory/1620-0-0x0000000000280000-0x0000000000334000-memory.dmp

            Filesize

            720KB

          • memory/1620-6-0x0000000002410000-0x0000000002450000-memory.dmp

            Filesize

            256KB

          • memory/1620-5-0x0000000074130000-0x000000007481E000-memory.dmp

            Filesize

            6.9MB

          • memory/1620-1-0x0000000077120000-0x00000000771F6000-memory.dmp

            Filesize

            856KB

          • memory/1620-8-0x0000000074130000-0x000000007481E000-memory.dmp

            Filesize

            6.9MB

          • memory/2080-119-0x0000000000180000-0x0000000000234000-memory.dmp

            Filesize

            720KB

          • memory/2080-121-0x0000000004D40000-0x0000000004D80000-memory.dmp

            Filesize

            256KB

          • memory/2080-120-0x0000000072350000-0x0000000072A3E000-memory.dmp

            Filesize

            6.9MB

          • memory/2404-86-0x0000000072350000-0x0000000072A3E000-memory.dmp

            Filesize

            6.9MB

          • memory/2404-82-0x0000000000730000-0x00000000007E4000-memory.dmp

            Filesize

            720KB

          • memory/2404-100-0x0000000072350000-0x0000000072A3E000-memory.dmp

            Filesize

            6.9MB

          • memory/2404-105-0x0000000004CD0000-0x0000000004D10000-memory.dmp

            Filesize

            256KB

          • memory/2404-107-0x0000000072350000-0x0000000072A3E000-memory.dmp

            Filesize

            6.9MB

          • memory/3012-98-0x0000000072350000-0x0000000072A3E000-memory.dmp

            Filesize

            6.9MB

          • memory/3012-76-0x0000000000300000-0x00000000003B4000-memory.dmp

            Filesize

            720KB

          • memory/3012-80-0x0000000072350000-0x0000000072A3E000-memory.dmp

            Filesize

            6.9MB

          • memory/3012-81-0x0000000005170000-0x00000000051B0000-memory.dmp

            Filesize

            256KB

          • memory/3012-89-0x0000000072350000-0x0000000072A3E000-memory.dmp

            Filesize

            6.9MB

          • memory/3012-94-0x0000000005170000-0x00000000051B0000-memory.dmp

            Filesize

            256KB