Overview

overview

10

Static

static

1

utweb_installer.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    utweb_installer.exe

  • Size

    1.7MB

  • Sample

    240424-jxhdvafh3t

  • MD5

    3769ac2d13b3a162d156be9ef9bcacf7

  • SHA1

    b4dcbd90d3613188d6f8d1f17ba91dda8ff0a26f

  • SHA256

    322b72fde02347eee92faca2b199d63db65cbc61c9c315d367680197f7dd7baf

  • SHA512

    ba8eb2de6192ba6e251273e934730cd824a4f4244bc680f09079bc0b450cbcc91f84d7d498c393e7dd39b8fab8832c38196b2cf7a1c5464d4eafc020dea4c846

  • SSDEEP

    24576:Z7FUDowAyrTVE3U5Fre5Zm1Ig+0XsleKgE7WjhmjDAsN:ZBuZrEUm5Ah+08MKgE7WmH

Score
10/10
cobaltstrikezgratbackdoordiscoverypersistenceratspywarestealertrojan

Malware Config

Targets

    • Target

      utweb_installer.exe

    • Size

      1.7MB

    • MD5

      3769ac2d13b3a162d156be9ef9bcacf7

    • SHA1

      b4dcbd90d3613188d6f8d1f17ba91dda8ff0a26f

    • SHA256

      322b72fde02347eee92faca2b199d63db65cbc61c9c315d367680197f7dd7baf

    • SHA512

      ba8eb2de6192ba6e251273e934730cd824a4f4244bc680f09079bc0b450cbcc91f84d7d498c393e7dd39b8fab8832c38196b2cf7a1c5464d4eafc020dea4c846

    • SSDEEP

      24576:Z7FUDowAyrTVE3U5Fre5Zm1Ig+0XsleKgE7WjhmjDAsN:ZBuZrEUm5Ah+08MKgE7WmH

    Score
    10/10
    cobaltstrikezgratbackdoordiscoverypersistenceratspywarestealertrojan

    • Cobalt Strike reflective loader

      Detects the reflective loader used by Cobalt Strike.

    • Cobaltstrike

      Detected malicious payload which is part of Cobaltstrike.

      trojanbackdoorcobaltstrike

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Drops file in Drivers directory

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Checks for any installed AV software in registry

    • Downloads MZ/PE file

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks