Resubmissions

09-04-2024 03:49

240409-edcl2adf68 10

09-04-2024 03:48

240409-ec33ladf59 10

09-04-2024 03:47

240409-ecqr9sdf46 10

09-04-2024 03:47

240409-eb8xfshb7t 10

03-04-2024 12:14

240403-peb21add42 10

Analysis

  • max time kernel
    1199s
  • max time network
    1205s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    09-04-2024 03:48

General

  • Target

    Ezxotfkmz.exe

  • Size

    451KB

  • MD5

    0d34f2b095cbff0be00eb45758929907

  • SHA1

    3fa3b5e296d49c4d8e6dfc5d4b775a48609aca78

  • SHA256

    89d511c97a4e0f4bf48a72fe764adb6d3de9007859c7632dc07477f2062c2b20

  • SHA512

    6965e9d2c2b9a11bb428ba8ac47202b7d0d4aaf826f905fb0afee903b2ae4b85cec446b536721b84237aeeb08f03ff413a67c75c36ba78d85a6727831e7b6340

  • SSDEEP

    6144:xpHC550+1KYQ2JRpK3SRgadBU9RwfqUKDPi5xo/nY:xpis+S2JRpK3SRgKQ/n

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

103.153.182.247:6161

Attributes
  • communication_password

    81dc9bdb52d04dc20036dbd8313ed055

  • install_dir

    Install path

  • install_file

    Install name

  • tor_process

    tor

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

  • Detect ZGRat V1 34 IoCs
  • XenArmor Suite

    XenArmor is as suite of password recovery tools for various application.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: RenamesItself 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ezxotfkmz.exe
    "C:\Users\Admin\AppData\Local\Temp\Ezxotfkmz.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2168
    • C:\Users\Admin\AppData\Local\Temp\Ezxotfkmz.exe
      "C:\Users\Admin\AppData\Local\Temp\Ezxotfkmz.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4712
      • C:\Users\Admin\AppData\Local\Install path\Install name
        -a "C:\Users\Admin\AppData\Local\ef307005\plg\gRrqgoBq.json"
        3⤵
        • Executes dropped EXE
        PID:4632
      • C:\Users\Admin\AppData\Local\Temp\gRrqgoBq.exe
        -a "C:\Users\Admin\AppData\Local\ef307005\plg\gRrqgoBq.json"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1328
        • C:\Users\Admin\AppData\Local\Temp\gRrqgoBq.exe
          -a "C:\Users\Admin\AppData\Local\Temp\unk.xml"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Accesses Microsoft Outlook accounts
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4252

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Install path\Install name

    Filesize

    451KB

    MD5

    0d34f2b095cbff0be00eb45758929907

    SHA1

    3fa3b5e296d49c4d8e6dfc5d4b775a48609aca78

    SHA256

    89d511c97a4e0f4bf48a72fe764adb6d3de9007859c7632dc07477f2062c2b20

    SHA512

    6965e9d2c2b9a11bb428ba8ac47202b7d0d4aaf826f905fb0afee903b2ae4b85cec446b536721b84237aeeb08f03ff413a67c75c36ba78d85a6727831e7b6340

  • C:\Users\Admin\AppData\Local\Temp\License.XenArmor

    Filesize

    104B

    MD5

    4f3bde9212e17ef18226866d6ac739b6

    SHA1

    732733bec8314beb81437e60876ffa75e72ae6cd

    SHA256

    212173a405c78d70f90e8ec0699a60ed2f4a9f3a8070de62eabd666c268fb174

    SHA512

    10b7cdae0b9a7b0f8e1bfc66a60675fa9b25c523864d5ae3da243f4e6e4c5194f3bd92af57ac956157442f66414bdd3393d0a1e5ba4ef0f192561e8524d4e744

  • C:\Users\Admin\AppData\Local\Temp\License.XenArmor

    Filesize

    104B

    MD5

    bf5da170f7c9a8eae88d1cb1a191ff80

    SHA1

    dd1b991a1b03587a5d1edc94e919a2070e325610

    SHA256

    e5d5110feb21939d82d962981aeaaafc4643b40a9b87cbed800ace82135d57cd

    SHA512

    9e32247d8556fd6efffbf7b6b9c325652d8c4b223b0fa38020879171476a49ab1f64d8897b5d8d92b79c5484fd9d5899be26ca5f664ee1f9c2acb0857084121e

  • C:\Users\Admin\AppData\Local\Temp\Unknown.dll

    Filesize

    793KB

    MD5

    86114faba7e1ec4a667d2bcb2e23f024

    SHA1

    670df6e1ba1dc6bece046e8b2e573dd36748245e

    SHA256

    568da887725ccfdc4c5aae3ff66792fe60eca4e0818338f6a8434be66a6fe46d

    SHA512

    d26ee0da6ccd4022982cf848c46e40f6781b667e39d0c5daf5ea8d74c44e55c55a5f7590a4d2a60aa1911358ca783c4276a9b4e6311c4cea20df1ebd4f7f457f

  • C:\Users\Admin\AppData\Local\Temp\gRrqgoBq.exe

    Filesize

    402B

    MD5

    ca42e05f9d53c7ec9383307c1ea282bb

    SHA1

    ed0efa1b59b461dcda08121a39411bee72f6b4cb

    SHA256

    63a7295e66183379580db16d0d191bb261ccc9edb982980051291c8bdf6c4ade

    SHA512

    4a1e3655a93f5e29ac7191eb3249b5b5a61b90353e78cc0bae4e81008aaff43bd9db4c2fde0c5ffcdae5e7eb87dfccffd4a1f383c78f5d40d52cbc4d61890196

  • C:\Users\Admin\AppData\Local\Temp\unk.xml

    Filesize

    98B

    MD5

    67efe59fbf8aaf3e8de7d67dab21c2a7

    SHA1

    0869d3ea3b16639ed4a0803acea1c476e199b16c

    SHA256

    63ca5c5c3cf4be4765115926225c060d89ef54d6f6fc3ec284cb3ecb398b0cb1

    SHA512

    75f162ff2cc23dd7df018109264f157727fdecc869e3f493e4d0bed26b4429ab00fc9724a5ea420488ba1b4b102a07992357c0d3567c7acea6dd5333cd8cebbb

  • memory/1328-5353-0x0000000000400000-0x00000000008DC000-memory.dmp

    Filesize

    4.9MB

  • memory/1328-5356-0x0000000000400000-0x00000000008DC000-memory.dmp

    Filesize

    4.9MB

  • memory/1328-5437-0x0000000000400000-0x00000000008DC000-memory.dmp

    Filesize

    4.9MB

  • memory/2168-51-0x0000000006470000-0x000000000684F000-memory.dmp

    Filesize

    3.9MB

  • memory/2168-59-0x0000000006470000-0x000000000684F000-memory.dmp

    Filesize

    3.9MB

  • memory/2168-9-0x0000000006470000-0x000000000684F000-memory.dmp

    Filesize

    3.9MB

  • memory/2168-11-0x0000000006470000-0x000000000684F000-memory.dmp

    Filesize

    3.9MB

  • memory/2168-13-0x0000000006470000-0x000000000684F000-memory.dmp

    Filesize

    3.9MB

  • memory/2168-15-0x0000000006470000-0x000000000684F000-memory.dmp

    Filesize

    3.9MB

  • memory/2168-17-0x0000000006470000-0x000000000684F000-memory.dmp

    Filesize

    3.9MB

  • memory/2168-19-0x0000000006470000-0x000000000684F000-memory.dmp

    Filesize

    3.9MB

  • memory/2168-21-0x0000000006470000-0x000000000684F000-memory.dmp

    Filesize

    3.9MB

  • memory/2168-23-0x0000000006470000-0x000000000684F000-memory.dmp

    Filesize

    3.9MB

  • memory/2168-25-0x0000000006470000-0x000000000684F000-memory.dmp

    Filesize

    3.9MB

  • memory/2168-27-0x0000000006470000-0x000000000684F000-memory.dmp

    Filesize

    3.9MB

  • memory/2168-29-0x0000000006470000-0x000000000684F000-memory.dmp

    Filesize

    3.9MB

  • memory/2168-31-0x0000000006470000-0x000000000684F000-memory.dmp

    Filesize

    3.9MB

  • memory/2168-33-0x0000000006470000-0x000000000684F000-memory.dmp

    Filesize

    3.9MB

  • memory/2168-35-0x0000000006470000-0x000000000684F000-memory.dmp

    Filesize

    3.9MB

  • memory/2168-37-0x0000000006470000-0x000000000684F000-memory.dmp

    Filesize

    3.9MB

  • memory/2168-39-0x0000000006470000-0x000000000684F000-memory.dmp

    Filesize

    3.9MB

  • memory/2168-41-0x0000000006470000-0x000000000684F000-memory.dmp

    Filesize

    3.9MB

  • memory/2168-43-0x0000000006470000-0x000000000684F000-memory.dmp

    Filesize

    3.9MB

  • memory/2168-45-0x0000000006470000-0x000000000684F000-memory.dmp

    Filesize

    3.9MB

  • memory/2168-47-0x0000000006470000-0x000000000684F000-memory.dmp

    Filesize

    3.9MB

  • memory/2168-49-0x0000000006470000-0x000000000684F000-memory.dmp

    Filesize

    3.9MB

  • memory/2168-5-0x0000000006470000-0x000000000684F000-memory.dmp

    Filesize

    3.9MB

  • memory/2168-53-0x0000000006470000-0x000000000684F000-memory.dmp

    Filesize

    3.9MB

  • memory/2168-55-0x0000000006470000-0x000000000684F000-memory.dmp

    Filesize

    3.9MB

  • memory/2168-57-0x0000000006470000-0x000000000684F000-memory.dmp

    Filesize

    3.9MB

  • memory/2168-7-0x0000000006470000-0x000000000684F000-memory.dmp

    Filesize

    3.9MB

  • memory/2168-61-0x0000000006470000-0x000000000684F000-memory.dmp

    Filesize

    3.9MB

  • memory/2168-63-0x0000000006470000-0x000000000684F000-memory.dmp

    Filesize

    3.9MB

  • memory/2168-67-0x0000000006470000-0x000000000684F000-memory.dmp

    Filesize

    3.9MB

  • memory/2168-65-0x0000000006470000-0x000000000684F000-memory.dmp

    Filesize

    3.9MB

  • memory/2168-1452-0x0000000075210000-0x00000000759C1000-memory.dmp

    Filesize

    7.7MB

  • memory/2168-1624-0x0000000005BD0000-0x0000000005BE0000-memory.dmp

    Filesize

    64KB

  • memory/2168-4886-0x0000000001660000-0x0000000001661000-memory.dmp

    Filesize

    4KB

  • memory/2168-4887-0x0000000007B20000-0x0000000007D40000-memory.dmp

    Filesize

    2.1MB

  • memory/2168-4888-0x0000000001A60000-0x0000000001AAC000-memory.dmp

    Filesize

    304KB

  • memory/2168-4889-0x00000000082F0000-0x0000000008896000-memory.dmp

    Filesize

    5.6MB

  • memory/2168-4890-0x0000000001AF0000-0x0000000001B44000-memory.dmp

    Filesize

    336KB

  • memory/2168-4897-0x0000000075210000-0x00000000759C1000-memory.dmp

    Filesize

    7.7MB

  • memory/2168-1-0x0000000075210000-0x00000000759C1000-memory.dmp

    Filesize

    7.7MB

  • memory/2168-0-0x0000000000FF0000-0x0000000001066000-memory.dmp

    Filesize

    472KB

  • memory/2168-2-0x0000000005BD0000-0x0000000005BE0000-memory.dmp

    Filesize

    64KB

  • memory/2168-3-0x0000000006470000-0x0000000006854000-memory.dmp

    Filesize

    3.9MB

  • memory/2168-4-0x0000000006470000-0x000000000684F000-memory.dmp

    Filesize

    3.9MB

  • memory/4252-5385-0x0000000000400000-0x00000000006FE000-memory.dmp

    Filesize

    3.0MB

  • memory/4252-5390-0x0000000010000000-0x0000000010227000-memory.dmp

    Filesize

    2.2MB

  • memory/4252-5408-0x0000000000400000-0x00000000006FE000-memory.dmp

    Filesize

    3.0MB

  • memory/4252-5409-0x0000000010000000-0x0000000010227000-memory.dmp

    Filesize

    2.2MB

  • memory/4252-5382-0x0000000000400000-0x00000000006FE000-memory.dmp

    Filesize

    3.0MB

  • memory/4712-4900-0x0000000074F80000-0x0000000074FBC000-memory.dmp

    Filesize

    240KB

  • memory/4712-4898-0x0000000000400000-0x00000000007CE000-memory.dmp

    Filesize

    3.8MB

  • memory/4712-4908-0x0000000074BF0000-0x0000000074C2C000-memory.dmp

    Filesize

    240KB

  • memory/4712-4920-0x0000000000400000-0x00000000007CE000-memory.dmp

    Filesize

    3.8MB

  • memory/4712-4987-0x0000000074F80000-0x0000000074FBC000-memory.dmp

    Filesize

    240KB

  • memory/4712-4988-0x0000000074BF0000-0x0000000074C2C000-memory.dmp

    Filesize

    240KB