Analysis
- max time kernel
141s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
12/04/2024, 01:48
General
- Target 8ee5be3a46434194e0b151970993a367e654121b5ef1ef5fb03b8591a645f8e9.exe
- Size 1.7MB
- Sample240412-b8dk2afa5v
- SHA256 8ee5be3a46434194e0b151970993a367e654121b5ef1ef5fb03b8591a645f8e9
Malware Config
Signatures
- Detect ZGRat V1 30 IoCs
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- ZGRat
ZGRat is remote access trojan written in C#.
- ModiLoader Second Stage 1 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 1 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 25 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ee5be3a46434194e0b151970993a367e654121b5ef1ef5fb03b8591a645f8e9.exe"C:\Users\Admin\AppData\Local\Temp\8ee5be3a46434194e0b151970993a367e654121b5ef1ef5fb03b8591a645f8e9.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c mkdir "\\?\C:\Windows "2⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c mkdir "\\?\C:\Windows \System32"2⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Windows \System32\3819930.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows \System32\3819930.exe"C:\Windows \System32\3819930.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows \system32\KDECO.bat""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Windows\SysWOW64\extrac32.exeC:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Admin\AppData\Local\Temp\8ee5be3a46434194e0b151970993a367e654121b5ef1ef5fb03b8591a645f8e9.exe C:\\Users\\Public\\Libraries\\Ioytmbsd.PIF2⤵
-
-
C:\Users\Public\Libraries\dsbmtyoI.pifC:\Users\Public\Libraries\dsbmtyoI.pif2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_hlhi0zmb.zdz.ps1
dsbmtyoI.pif
3819930.exe
netutils.dll
KDECO.bat
memory/1460-29-0x0000027C76600000-0x0000027C76610000-memory.dmp
memory/1460-27-0x00007FF9B2000000-0x00007FF9B2AC1000-memory.dmp
memory/1460-28-0x0000027C76600000-0x0000027C76610000-memory.dmp
memory/1460-32-0x00007FF9B2000000-0x00007FF9B2AC1000-memory.dmp
memory/1460-17-0x0000027C76440000-0x0000027C76462000-memory.dmp
memory/1744-1-0x0000000002AD0000-0x0000000003AD0000-memory.dmp
memory/1744-0-0x0000000002450000-0x0000000002451000-memory.dmp
memory/1744-2-0x0000000002AD0000-0x0000000003AD0000-memory.dmp
memory/1744-4-0x0000000000400000-0x00000000005AF000-memory.dmp
memory/3876-73-0x0000000040A20000-0x0000000040A73000-memory.dmp
memory/3876-78-0x000000003DF10000-0x000000003DF20000-memory.dmp
memory/3876-45-0x0000000000400000-0x0000000001400000-memory.dmp
memory/3876-46-0x000000003DEA0000-0x000000003DEFA000-memory.dmp
memory/3876-47-0x0000000040430000-0x00000000409D4000-memory.dmp
memory/3876-48-0x0000000040A20000-0x0000000040A7A000-memory.dmp
memory/3876-49-0x0000000040A20000-0x0000000040A73000-memory.dmp
memory/3876-50-0x0000000040A20000-0x0000000040A73000-memory.dmp
memory/3876-52-0x0000000040A20000-0x0000000040A73000-memory.dmp
memory/3876-54-0x0000000040A20000-0x0000000040A73000-memory.dmp
memory/3876-55-0x0000000000400000-0x0000000001400000-memory.dmp
memory/3876-57-0x0000000040A20000-0x0000000040A73000-memory.dmp
memory/3876-59-0x0000000040A20000-0x0000000040A73000-memory.dmp
memory/3876-61-0x0000000040A20000-0x0000000040A73000-memory.dmp
memory/3876-63-0x0000000040A20000-0x0000000040A73000-memory.dmp
memory/3876-65-0x0000000040A20000-0x0000000040A73000-memory.dmp
memory/3876-67-0x0000000040A20000-0x0000000040A73000-memory.dmp
memory/3876-69-0x0000000040A20000-0x0000000040A73000-memory.dmp
memory/3876-40-0x0000000000400000-0x0000000001400000-memory.dmp
memory/3876-71-0x0000000040A20000-0x0000000040A73000-memory.dmp
memory/3876-75-0x0000000040A20000-0x0000000040A73000-memory.dmp
memory/3876-77-0x000000003DF10000-0x000000003DF20000-memory.dmp
memory/3876-82-0x0000000040A20000-0x0000000040A73000-memory.dmp
memory/3876-80-0x000000003DF10000-0x000000003DF20000-memory.dmp
memory/3876-79-0x0000000040A20000-0x0000000040A73000-memory.dmp
memory/3876-43-0x0000000000400000-0x0000000001400000-memory.dmp
memory/3876-84-0x0000000040A20000-0x0000000040A73000-memory.dmp
memory/3876-86-0x0000000040A20000-0x0000000040A73000-memory.dmp
memory/3876-90-0x0000000040A20000-0x0000000040A73000-memory.dmp
memory/3876-88-0x0000000040A20000-0x0000000040A73000-memory.dmp
memory/3876-92-0x0000000040A20000-0x0000000040A73000-memory.dmp
memory/3876-93-0x0000000074FE0000-0x0000000075790000-memory.dmp
memory/3876-95-0x0000000040A20000-0x0000000040A73000-memory.dmp
memory/3876-101-0x0000000040A20000-0x0000000040A73000-memory.dmp
memory/3876-107-0x0000000040A20000-0x0000000040A73000-memory.dmp
memory/3876-105-0x0000000040A20000-0x0000000040A73000-memory.dmp
memory/3876-103-0x0000000040A20000-0x0000000040A73000-memory.dmp
memory/3876-99-0x0000000040A20000-0x0000000040A73000-memory.dmp
memory/3876-97-0x0000000040A20000-0x0000000040A73000-memory.dmp
memory/3876-1104-0x0000000040B80000-0x0000000040BE6000-memory.dmp
memory/3876-1105-0x000000003DF10000-0x000000003DF20000-memory.dmp
memory/3876-1106-0x00000000412D0000-0x0000000041320000-memory.dmp
memory/3876-1107-0x0000000041320000-0x00000000413BC000-memory.dmp
memory/3876-1110-0x000000003DF10000-0x000000003DF20000-memory.dmp
memory/3876-1111-0x000000003DF10000-0x000000003DF20000-memory.dmp
memory/3876-1112-0x000000003DF10000-0x000000003DF20000-memory.dmp
memory/3876-1113-0x0000000074FE0000-0x0000000075790000-memory.dmp
memory/3876-1114-0x000000003DF10000-0x000000003DF20000-memory.dmp
memory/3876-1115-0x00000000417C0000-0x0000000041852000-memory.dmp
memory/3876-1116-0x00000000419E0000-0x00000000419EA000-memory.dmp
memory/4728-15-0x00000000613C0000-0x00000000613E3000-memory.dmp