Analysis
-
max time kernel
93s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17-04-2024 14:11
Behavioral task
behavioral1
Sample
1f64bc9469a33c77561e22beea18d9bbdd343dae89bc6f02bc85e24873d93f4e.exe
Resource
win7-20231129-en
General
-
Target
1f64bc9469a33c77561e22beea18d9bbdd343dae89bc6f02bc85e24873d93f4e.exe
-
Size
328KB
-
MD5
2fa8c24b42f6542a290d85a9a3723e2a
-
SHA1
d7a518d0d6eae7732a59c6a7c397f0777d111255
-
SHA256
1f64bc9469a33c77561e22beea18d9bbdd343dae89bc6f02bc85e24873d93f4e
-
SHA512
764731d7ac9329083fc3a3db505b12c0a0f63ef3de3f07db80ebaab237a698b980961daaaa6b14b49ea63f93d5a848e81de6a50898c36f8609109c3ef70dc6db
-
SSDEEP
6144:3eY+jinF8jE9sKKegRcd2cS8ADT+5amtQuicddRp:fJf5vr9AuYOp
Malware Config
Signatures
-
Detect Xehook Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3564-5-0x0000000000400000-0x000000000042C000-memory.dmp xehook -
Detect ZGRat V1 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4988-0-0x00000000006D0000-0x0000000000724000-memory.dmp family_zgrat_v1 -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 14 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1f64bc9469a33c77561e22beea18d9bbdd343dae89bc6f02bc85e24873d93f4e.exedescription pid process target process PID 4988 set thread context of 3564 4988 1f64bc9469a33c77561e22beea18d9bbdd343dae89bc6f02bc85e24873d93f4e.exe RegAsm.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4448 3564 WerFault.exe RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 3564 RegAsm.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
1f64bc9469a33c77561e22beea18d9bbdd343dae89bc6f02bc85e24873d93f4e.exedescription pid process target process PID 4988 wrote to memory of 3564 4988 1f64bc9469a33c77561e22beea18d9bbdd343dae89bc6f02bc85e24873d93f4e.exe RegAsm.exe PID 4988 wrote to memory of 3564 4988 1f64bc9469a33c77561e22beea18d9bbdd343dae89bc6f02bc85e24873d93f4e.exe RegAsm.exe PID 4988 wrote to memory of 3564 4988 1f64bc9469a33c77561e22beea18d9bbdd343dae89bc6f02bc85e24873d93f4e.exe RegAsm.exe PID 4988 wrote to memory of 3564 4988 1f64bc9469a33c77561e22beea18d9bbdd343dae89bc6f02bc85e24873d93f4e.exe RegAsm.exe PID 4988 wrote to memory of 3564 4988 1f64bc9469a33c77561e22beea18d9bbdd343dae89bc6f02bc85e24873d93f4e.exe RegAsm.exe PID 4988 wrote to memory of 3564 4988 1f64bc9469a33c77561e22beea18d9bbdd343dae89bc6f02bc85e24873d93f4e.exe RegAsm.exe PID 4988 wrote to memory of 3564 4988 1f64bc9469a33c77561e22beea18d9bbdd343dae89bc6f02bc85e24873d93f4e.exe RegAsm.exe PID 4988 wrote to memory of 3564 4988 1f64bc9469a33c77561e22beea18d9bbdd343dae89bc6f02bc85e24873d93f4e.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f64bc9469a33c77561e22beea18d9bbdd343dae89bc6f02bc85e24873d93f4e.exe"C:\Users\Admin\AppData\Local\Temp\1f64bc9469a33c77561e22beea18d9bbdd343dae89bc6f02bc85e24873d93f4e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 18043⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 3564 -ip 35641⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3564-13-0x0000000006810000-0x00000000068A2000-memory.dmpFilesize
584KB
-
memory/3564-5-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/3564-8-0x00000000054E0000-0x00000000054FA000-memory.dmpFilesize
104KB
-
memory/3564-10-0x0000000005C30000-0x00000000061D4000-memory.dmpFilesize
5.6MB
-
memory/3564-12-0x0000000074490000-0x0000000074C40000-memory.dmpFilesize
7.7MB
-
memory/3564-14-0x00000000079D0000-0x0000000007A36000-memory.dmpFilesize
408KB
-
memory/3564-16-0x0000000074490000-0x0000000074C40000-memory.dmpFilesize
7.7MB
-
memory/4988-1-0x0000000074490000-0x0000000074C40000-memory.dmpFilesize
7.7MB
-
memory/4988-2-0x00000000050E0000-0x00000000050F0000-memory.dmpFilesize
64KB
-
memory/4988-9-0x0000000074490000-0x0000000074C40000-memory.dmpFilesize
7.7MB
-
memory/4988-11-0x0000000002B30000-0x0000000004B30000-memory.dmpFilesize
32.0MB
-
memory/4988-0-0x00000000006D0000-0x0000000000724000-memory.dmpFilesize
336KB
-
memory/4988-17-0x0000000002B30000-0x0000000004B30000-memory.dmpFilesize
32.0MB