Resubmissions
09/04/2024, 07:01
240409-htps3scd2w1009/04/2024, 07:01
240409-htf6yacc9x1009/04/2024, 07:00
240409-hs6p7scc811009/04/2024, 07:00
240409-hss44scc7z1007/03/2024, 22:29
240307-2eh7jagg4110Analysis
- max time kernel
2s - max time network
54s - platform
windows11-21h2_x64 - resource
win11-20240221-en - resource tags
- submitted
09/04/2024, 07:01
General
- Target New Text Document mod.exe
- Size 8KB
- Sample240409-htps3scd2w
- SHA256 2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2
Malware Config
Extracted
-
redline
-
6077866846
-
https://pastebin.com/raw/KE5Mft0T
Extracted
-
metasploit
-
metasploit_stager
-
91.92.247.21:8405
Signatures
- Detect ZGRat V1 1 IoCs
- MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Downloads MZ/PE file
- Themida packer 3 IoCs
Detects Themida, an advanced Windows software protection system.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe"C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe"C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\jdQnoKbJ.exe"C:\Users\Admin\AppData\Local\Temp\jdQnoKbJ.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe"C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe"2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=crypted6077866846MVYQY.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.03⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xdc,0x110,0x7ffde7b63cb8,0x7ffde7b63cc8,0x7ffde7b63cd84⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe"C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe"C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\pclient.exe"C:\Users\Admin\AppData\Local\Temp\a\pclient.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\MStore.exe"C:\Users\Admin\AppData\Local\Temp\a\MStore.exe"2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell Add-MpPreference -ExclusionExtension .exe3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionExtension .exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Props.exe"C:\Users\Admin\AppData\Local\Temp\a\Props.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
settings.dat
responsibilitylead.exe
__PSScriptPolicyTest_0m13c33c.ljc.ps1
MStore.exe
Props.exe
crypted6077866846MVYQY.exe
disable-defender.exe
i1gcbW1E.exe
mQxBvlTA.exe
pclient.exe
wininit.exe
wininit.exe
xIPJVPDq.exe
jdQnoKbJ.exe
memory/1960-39-0x00000000006A0000-0x00000000006C2000-memory.dmp
memory/3084-118-0x0000023FB00E0000-0x0000023FB0102000-memory.dmp
memory/3084-120-0x0000023FAFFA0000-0x0000023FAFFB0000-memory.dmp
memory/3084-121-0x0000023FAFFA0000-0x0000023FAFFB0000-memory.dmp
memory/3084-119-0x00007FFDDB2E0000-0x00007FFDDBDA2000-memory.dmp
memory/3256-109-0x00007FFDDB2E0000-0x00007FFDDBDA2000-memory.dmp
memory/3256-0-0x00000000007F0000-0x00000000007F8000-memory.dmp
memory/3256-1-0x00007FFDDB2E0000-0x00007FFDDBDA2000-memory.dmp
memory/3256-2-0x000000001B440000-0x000000001B450000-memory.dmp
memory/3516-126-0x000001E56FE20000-0x000001E570096000-memory.dmp
memory/3516-84-0x00007FFDDB2E0000-0x00007FFDDBDA2000-memory.dmp
memory/3516-85-0x000001E56F3A0000-0x000001E56F3B0000-memory.dmp
memory/3516-82-0x000001E56D6C0000-0x000001E56D6C6000-memory.dmp
memory/3576-83-0x00000000009E0000-0x0000000001AFC000-memory.dmp
memory/3576-107-0x0000000000400000-0x000000000054E000-memory.dmp
memory/3576-108-0x0000000006940000-0x0000000006954000-memory.dmp
memory/3576-106-0x0000000006950000-0x000000000695A000-memory.dmp
memory/3576-54-0x0000000077396000-0x0000000077398000-memory.dmp
memory/3576-29-0x0000000076D60000-0x0000000076E50000-memory.dmp
memory/3576-24-0x0000000076D60000-0x0000000076E50000-memory.dmp
memory/3576-23-0x0000000077394000-0x0000000077395000-memory.dmp
memory/3576-88-0x00000000069C0000-0x0000000006A52000-memory.dmp
memory/3576-22-0x00000000009E0000-0x0000000001AFC000-memory.dmp
memory/3576-87-0x0000000006ED0000-0x0000000007476000-memory.dmp
memory/3576-86-0x00000000009E0000-0x0000000001AFC000-memory.dmp
memory/4780-104-0x0000000140000000-0x0000000140004278-memory.dmp