Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-04-2024 01:19

General

  • Target

    40c251a8afb49d3b567a370e67ca7861a4cc2008c7deef39c3739284c1b7e3e8.exe

  • Size

    14.6MB

  • MD5

    7efdb8104be2cb54cb77ee615d9c6197

  • SHA1

    f937e4c7ce6151d2a662f180420ab8e6ac654ac5

  • SHA256

    40c251a8afb49d3b567a370e67ca7861a4cc2008c7deef39c3739284c1b7e3e8

  • SHA512

    77fc43b3e3b89bba626735e7dbc6129bfead17a430bffc61eee861bb6edfb477db74f6f646bad04de360f512fb6676e27cf739812fa628b308592a42295aded6

  • SSDEEP

    393216:sHCoIgksmCvTUu++OqYW1cVXWLkbl+L+QU+:4BIgLSu65W2V+1yQU+

Malware Config

Extracted

Family

meduza

C2

109.107.181.83

Signatures

  • Detect ZGRat V1 35 IoCs
  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

  • Meduza Stealer payload 2 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Executes dropped EXE 2 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\40c251a8afb49d3b567a370e67ca7861a4cc2008c7deef39c3739284c1b7e3e8.exe
    "C:\Users\Admin\AppData\Local\Temp\40c251a8afb49d3b567a370e67ca7861a4cc2008c7deef39c3739284c1b7e3e8.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:5104
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3788
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
        3⤵
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • outlook_office_path
        • outlook_win_path
        PID:2676
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" Start-Sleep -Seconds 5; Remove-Item -Path 'C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe' -Force
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1216
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsiibilitylead.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsiibilitylead.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:532

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe

    Filesize

    6.6MB

    MD5

    7cf0ba422c37585d399e4dffb0b7757c

    SHA1

    d7b1b39ccdb9287edbae0aa9496ab1d678a4780b

    SHA256

    b20de9452f77b912c49bd307cc1e2550abb4e17d8497655e64ed0883ce4cfcbe

    SHA512

    f28f438298954bdabfeb8848dcafe35e074b1750c32e9f01268e41ced8a2acac3e298159b85f159e9c9d4814f73ce2b89c1d8a8afc4a7a2ab30c2258dc3237c1

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsiibilitylead.exe

    Filesize

    8.0MB

    MD5

    c5dd39b204b859209ec38a1aba1c8eca

    SHA1

    0006ad5d81c98fec6e83dc5d4a1e900f4de77bc1

    SHA256

    60209ed2588da5b44174095073e31fe775ac8a2e9e02118f8fa1eea4c69607a6

    SHA512

    dca32db70c4d6349c5ee86d303a188f9eccfe7b4143c15ed4e39e41564d0b253ba69aa9b2df8589041cf3f336aaa1081c9feece5d50d3ab0605383efae750bde

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mgaulkdr.aqc.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/532-7712-0x0000000074F10000-0x00000000756C0000-memory.dmp

    Filesize

    7.7MB

  • memory/532-4919-0x0000000074F10000-0x00000000756C0000-memory.dmp

    Filesize

    7.7MB

  • memory/532-9818-0x0000000006D70000-0x0000000006DD6000-memory.dmp

    Filesize

    408KB

  • memory/532-9817-0x0000000006B80000-0x0000000006C74000-memory.dmp

    Filesize

    976KB

  • memory/532-9816-0x0000000006340000-0x0000000006341000-memory.dmp

    Filesize

    4KB

  • memory/532-4929-0x0000000006090000-0x0000000006122000-memory.dmp

    Filesize

    584KB

  • memory/532-4928-0x0000000006550000-0x0000000006AF4000-memory.dmp

    Filesize

    5.6MB

  • memory/532-4927-0x0000000005BE0000-0x0000000005E98000-memory.dmp

    Filesize

    2.7MB

  • memory/532-4920-0x0000000000B60000-0x000000000135A000-memory.dmp

    Filesize

    8.0MB

  • memory/532-9815-0x0000000005B60000-0x0000000005B70000-memory.dmp

    Filesize

    64KB

  • memory/1216-5306-0x00007FF93DDE0000-0x00007FF93E8A1000-memory.dmp

    Filesize

    10.8MB

  • memory/1216-4918-0x0000019AD4150000-0x0000019AD4172000-memory.dmp

    Filesize

    136KB

  • memory/1216-4907-0x0000019AD3760000-0x0000019AD3770000-memory.dmp

    Filesize

    64KB

  • memory/1216-4908-0x0000019AD3760000-0x0000019AD3770000-memory.dmp

    Filesize

    64KB

  • memory/1216-4906-0x00007FF93DDE0000-0x00007FF93E8A1000-memory.dmp

    Filesize

    10.8MB

  • memory/2676-5620-0x0000000140000000-0x00000001400DA000-memory.dmp

    Filesize

    872KB

  • memory/2676-4901-0x0000000140000000-0x00000001400DA000-memory.dmp

    Filesize

    872KB

  • memory/3788-23-0x000001BBB4450000-0x000001BBB46C0000-memory.dmp

    Filesize

    2.4MB

  • memory/3788-4894-0x000001BB9BD00000-0x000001BB9BD4C000-memory.dmp

    Filesize

    304KB

  • memory/3788-43-0x000001BBB4450000-0x000001BBB46C0000-memory.dmp

    Filesize

    2.4MB

  • memory/3788-47-0x000001BBB4450000-0x000001BBB46C0000-memory.dmp

    Filesize

    2.4MB

  • memory/3788-49-0x000001BBB4450000-0x000001BBB46C0000-memory.dmp

    Filesize

    2.4MB

  • memory/3788-51-0x000001BBB4450000-0x000001BBB46C0000-memory.dmp

    Filesize

    2.4MB

  • memory/3788-53-0x000001BBB4450000-0x000001BBB46C0000-memory.dmp

    Filesize

    2.4MB

  • memory/3788-55-0x000001BBB4450000-0x000001BBB46C0000-memory.dmp

    Filesize

    2.4MB

  • memory/3788-59-0x000001BBB4450000-0x000001BBB46C0000-memory.dmp

    Filesize

    2.4MB

  • memory/3788-57-0x000001BBB4450000-0x000001BBB46C0000-memory.dmp

    Filesize

    2.4MB

  • memory/3788-61-0x000001BBB4450000-0x000001BBB46C0000-memory.dmp

    Filesize

    2.4MB

  • memory/3788-63-0x000001BBB4450000-0x000001BBB46C0000-memory.dmp

    Filesize

    2.4MB

  • memory/3788-65-0x000001BBB4450000-0x000001BBB46C0000-memory.dmp

    Filesize

    2.4MB

  • memory/3788-67-0x000001BBB4450000-0x000001BBB46C0000-memory.dmp

    Filesize

    2.4MB

  • memory/3788-71-0x000001BBB4450000-0x000001BBB46C0000-memory.dmp

    Filesize

    2.4MB

  • memory/3788-69-0x000001BBB4450000-0x000001BBB46C0000-memory.dmp

    Filesize

    2.4MB

  • memory/3788-73-0x000001BBB4450000-0x000001BBB46C0000-memory.dmp

    Filesize

    2.4MB

  • memory/3788-3437-0x00007FF93D810000-0x00007FF93E2D1000-memory.dmp

    Filesize

    10.8MB

  • memory/3788-4891-0x000001BB9A410000-0x000001BB9A420000-memory.dmp

    Filesize

    64KB

  • memory/3788-4892-0x000001BB9A3F0000-0x000001BB9A3F1000-memory.dmp

    Filesize

    4KB

  • memory/3788-4893-0x000001BBB47C0000-0x000001BBB4872000-memory.dmp

    Filesize

    712KB

  • memory/3788-45-0x000001BBB4450000-0x000001BBB46C0000-memory.dmp

    Filesize

    2.4MB

  • memory/3788-4896-0x000001BBB5320000-0x000001BBB5374000-memory.dmp

    Filesize

    336KB

  • memory/3788-35-0x000001BBB4450000-0x000001BBB46C0000-memory.dmp

    Filesize

    2.4MB

  • memory/3788-4902-0x00007FF93D810000-0x00007FF93E2D1000-memory.dmp

    Filesize

    10.8MB

  • memory/3788-41-0x000001BBB4450000-0x000001BBB46C0000-memory.dmp

    Filesize

    2.4MB

  • memory/3788-39-0x000001BBB4450000-0x000001BBB46C0000-memory.dmp

    Filesize

    2.4MB

  • memory/3788-37-0x000001BBB4450000-0x000001BBB46C0000-memory.dmp

    Filesize

    2.4MB

  • memory/3788-33-0x000001BBB4450000-0x000001BBB46C0000-memory.dmp

    Filesize

    2.4MB

  • memory/3788-31-0x000001BBB4450000-0x000001BBB46C0000-memory.dmp

    Filesize

    2.4MB

  • memory/3788-27-0x000001BBB4450000-0x000001BBB46C0000-memory.dmp

    Filesize

    2.4MB

  • memory/3788-29-0x000001BBB4450000-0x000001BBB46C0000-memory.dmp

    Filesize

    2.4MB

  • memory/3788-25-0x000001BBB4450000-0x000001BBB46C0000-memory.dmp

    Filesize

    2.4MB

  • memory/3788-21-0x000001BBB4450000-0x000001BBB46C0000-memory.dmp

    Filesize

    2.4MB

  • memory/3788-19-0x000001BBB4450000-0x000001BBB46C0000-memory.dmp

    Filesize

    2.4MB

  • memory/3788-17-0x000001BBB4450000-0x000001BBB46C0000-memory.dmp

    Filesize

    2.4MB

  • memory/3788-15-0x000001BBB4450000-0x000001BBB46C0000-memory.dmp

    Filesize

    2.4MB

  • memory/3788-13-0x000001BBB4450000-0x000001BBB46C0000-memory.dmp

    Filesize

    2.4MB

  • memory/3788-11-0x000001BBB4450000-0x000001BBB46C0000-memory.dmp

    Filesize

    2.4MB

  • memory/3788-10-0x000001BBB4450000-0x000001BBB46C0000-memory.dmp

    Filesize

    2.4MB

  • memory/3788-9-0x000001BBB4450000-0x000001BBB46C6000-memory.dmp

    Filesize

    2.5MB

  • memory/3788-8-0x00007FF93D810000-0x00007FF93E2D1000-memory.dmp

    Filesize

    10.8MB

  • memory/3788-7-0x000001BB99950000-0x000001BB99FF0000-memory.dmp

    Filesize

    6.6MB