Analysis
-
max time kernel
94s -
max time network
87s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
30-04-2024 01:42
Static task
static1
Behavioral task
behavioral1
Sample
9f2c70239fe518552ee44423564b075a85e0fc1e7bd80dc233bcc1f882ffceb9.exe
Resource
win10v2004-20240419-en
General
-
Target
9f2c70239fe518552ee44423564b075a85e0fc1e7bd80dc233bcc1f882ffceb9.exe
-
Size
14.1MB
-
MD5
b149f82964b1e269ade2686612a9e777
-
SHA1
9ccccc1fe6c947dcbc779624ffa9a0fd1b7e7790
-
SHA256
9f2c70239fe518552ee44423564b075a85e0fc1e7bd80dc233bcc1f882ffceb9
-
SHA512
5c07589d51c21310415fb2fd616ac6fe23b1ec7e26007b6a3d2ce948bcbc3613db14bbc5686f5f352fb614cea00b3af657d1d6a9e2a078c3487d345d145ec2c9
-
SSDEEP
393216:FwI5aqRbG66MMgLaDArf6tY5yParKZwVgIZlds:FwSHLyMytYYP8KZwKI
Malware Config
Extracted
meduza
109.107.181.83
Signatures
-
Detect ZGRat V1 35 IoCs
Processes:
resource yara_rule behavioral1/memory/2500-10-0x000001636A8D0000-0x000001636AB4E000-memory.dmp family_zgrat_v1 behavioral1/memory/2500-12-0x000001636A8D0000-0x000001636AB49000-memory.dmp family_zgrat_v1 behavioral1/memory/2500-16-0x000001636A8D0000-0x000001636AB49000-memory.dmp family_zgrat_v1 behavioral1/memory/2500-14-0x000001636A8D0000-0x000001636AB49000-memory.dmp family_zgrat_v1 behavioral1/memory/2500-11-0x000001636A8D0000-0x000001636AB49000-memory.dmp family_zgrat_v1 behavioral1/memory/2500-22-0x000001636A8D0000-0x000001636AB49000-memory.dmp family_zgrat_v1 behavioral1/memory/2500-32-0x000001636A8D0000-0x000001636AB49000-memory.dmp family_zgrat_v1 behavioral1/memory/2500-54-0x000001636A8D0000-0x000001636AB49000-memory.dmp family_zgrat_v1 behavioral1/memory/2500-58-0x000001636A8D0000-0x000001636AB49000-memory.dmp family_zgrat_v1 behavioral1/memory/2500-74-0x000001636A8D0000-0x000001636AB49000-memory.dmp family_zgrat_v1 behavioral1/memory/2500-72-0x000001636A8D0000-0x000001636AB49000-memory.dmp family_zgrat_v1 behavioral1/memory/2500-70-0x000001636A8D0000-0x000001636AB49000-memory.dmp family_zgrat_v1 behavioral1/memory/2500-68-0x000001636A8D0000-0x000001636AB49000-memory.dmp family_zgrat_v1 behavioral1/memory/2500-66-0x000001636A8D0000-0x000001636AB49000-memory.dmp family_zgrat_v1 behavioral1/memory/2500-64-0x000001636A8D0000-0x000001636AB49000-memory.dmp family_zgrat_v1 behavioral1/memory/2500-62-0x000001636A8D0000-0x000001636AB49000-memory.dmp family_zgrat_v1 behavioral1/memory/2500-60-0x000001636A8D0000-0x000001636AB49000-memory.dmp family_zgrat_v1 behavioral1/memory/2500-56-0x000001636A8D0000-0x000001636AB49000-memory.dmp family_zgrat_v1 behavioral1/memory/2500-52-0x000001636A8D0000-0x000001636AB49000-memory.dmp family_zgrat_v1 behavioral1/memory/2500-50-0x000001636A8D0000-0x000001636AB49000-memory.dmp family_zgrat_v1 behavioral1/memory/2500-48-0x000001636A8D0000-0x000001636AB49000-memory.dmp family_zgrat_v1 behavioral1/memory/2500-46-0x000001636A8D0000-0x000001636AB49000-memory.dmp family_zgrat_v1 behavioral1/memory/2500-44-0x000001636A8D0000-0x000001636AB49000-memory.dmp family_zgrat_v1 behavioral1/memory/2500-42-0x000001636A8D0000-0x000001636AB49000-memory.dmp family_zgrat_v1 behavioral1/memory/2500-40-0x000001636A8D0000-0x000001636AB49000-memory.dmp family_zgrat_v1 behavioral1/memory/2500-38-0x000001636A8D0000-0x000001636AB49000-memory.dmp family_zgrat_v1 behavioral1/memory/2500-36-0x000001636A8D0000-0x000001636AB49000-memory.dmp family_zgrat_v1 behavioral1/memory/2500-34-0x000001636A8D0000-0x000001636AB49000-memory.dmp family_zgrat_v1 behavioral1/memory/2500-30-0x000001636A8D0000-0x000001636AB49000-memory.dmp family_zgrat_v1 behavioral1/memory/2500-28-0x000001636A8D0000-0x000001636AB49000-memory.dmp family_zgrat_v1 behavioral1/memory/2500-26-0x000001636A8D0000-0x000001636AB49000-memory.dmp family_zgrat_v1 behavioral1/memory/2500-25-0x000001636A8D0000-0x000001636AB49000-memory.dmp family_zgrat_v1 behavioral1/memory/2500-20-0x000001636A8D0000-0x000001636AB49000-memory.dmp family_zgrat_v1 behavioral1/memory/2500-18-0x000001636A8D0000-0x000001636AB49000-memory.dmp family_zgrat_v1 behavioral1/memory/4120-4919-0x0000000009AE0000-0x0000000009D96000-memory.dmp family_zgrat_v1 -
Meduza Stealer payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/4572-4902-0x0000000140000000-0x00000001400E8000-memory.dmp family_meduza -
Executes dropped EXE 2 IoCs
Processes:
leadadequate.exeleadiadequate.exepid process 2500 leadadequate.exe 4120 leadiadequate.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
9f2c70239fe518552ee44423564b075a85e0fc1e7bd80dc233bcc1f882ffceb9.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 9f2c70239fe518552ee44423564b075a85e0fc1e7bd80dc233bcc1f882ffceb9.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
leadadequate.exedescription pid process target process PID 2500 set thread context of 4572 2500 leadadequate.exe InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 2880 powershell.exe 2880 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
leadadequate.exepowershell.exeleadiadequate.exedescription pid process Token: SeDebugPrivilege 2500 leadadequate.exe Token: SeDebugPrivilege 2500 leadadequate.exe Token: SeDebugPrivilege 2880 powershell.exe Token: SeDebugPrivilege 4120 leadiadequate.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
9f2c70239fe518552ee44423564b075a85e0fc1e7bd80dc233bcc1f882ffceb9.exeleadadequate.exedescription pid process target process PID 3912 wrote to memory of 2500 3912 9f2c70239fe518552ee44423564b075a85e0fc1e7bd80dc233bcc1f882ffceb9.exe leadadequate.exe PID 3912 wrote to memory of 2500 3912 9f2c70239fe518552ee44423564b075a85e0fc1e7bd80dc233bcc1f882ffceb9.exe leadadequate.exe PID 2500 wrote to memory of 4572 2500 leadadequate.exe InstallUtil.exe PID 2500 wrote to memory of 4572 2500 leadadequate.exe InstallUtil.exe PID 2500 wrote to memory of 4572 2500 leadadequate.exe InstallUtil.exe PID 2500 wrote to memory of 4572 2500 leadadequate.exe InstallUtil.exe PID 2500 wrote to memory of 4572 2500 leadadequate.exe InstallUtil.exe PID 2500 wrote to memory of 4572 2500 leadadequate.exe InstallUtil.exe PID 2500 wrote to memory of 4572 2500 leadadequate.exe InstallUtil.exe PID 2500 wrote to memory of 4572 2500 leadadequate.exe InstallUtil.exe PID 2500 wrote to memory of 4572 2500 leadadequate.exe InstallUtil.exe PID 2500 wrote to memory of 4572 2500 leadadequate.exe InstallUtil.exe PID 2500 wrote to memory of 4572 2500 leadadequate.exe InstallUtil.exe PID 2500 wrote to memory of 2880 2500 leadadequate.exe powershell.exe PID 2500 wrote to memory of 2880 2500 leadadequate.exe powershell.exe PID 3912 wrote to memory of 4120 3912 9f2c70239fe518552ee44423564b075a85e0fc1e7bd80dc233bcc1f882ffceb9.exe leadiadequate.exe PID 3912 wrote to memory of 4120 3912 9f2c70239fe518552ee44423564b075a85e0fc1e7bd80dc233bcc1f882ffceb9.exe leadiadequate.exe PID 3912 wrote to memory of 4120 3912 9f2c70239fe518552ee44423564b075a85e0fc1e7bd80dc233bcc1f882ffceb9.exe leadiadequate.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f2c70239fe518552ee44423564b075a85e0fc1e7bd80dc233bcc1f882ffceb9.exe"C:\Users\Admin\AppData\Local\Temp\9f2c70239fe518552ee44423564b075a85e0fc1e7bd80dc233bcc1f882ffceb9.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\leadadequate.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\leadadequate.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Start-Sleep -Seconds 5; Remove-Item -Path 'C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\leadadequate.exe' -Force3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\leadiadequate.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\leadiadequate.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\leadadequate.exeFilesize
14.6MB
MD5938ea9e68b80a685337ed40667037a21
SHA1520a3984265c13d4f289eb162f5a25108a9b7d9c
SHA2562cbf1a9a727ec04dc73f38be06befd8e3d162346807afb95ae1189cbd8376a19
SHA512e756f76dca6a6aacb7b5e1b017be4d583890c13f41059f3a4a5da24733f0b141c7d074a5a4b032275b03bac331c628f008d0178e85e53d348d506a8c50255c50
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\leadiadequate.exeFilesize
16.4MB
MD540f6d61aae921cc7ec31836a7fac3c2a
SHA1fcb93eb39a221d68978f3943acba0699e032a16c
SHA256e8cabc3a065dd38f596cfc67ae3231dc728a35125b2d1677c73b3682dcaa9b29
SHA51222cb185a1f492d4d695702605a26f4b8ad154b0a6130297cbb705462043dee7d07e85f9f8637381e574e8f7970d747ff7ab136ebc1c01a5695eef5df84dee6db
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wyb2zqbc.dcg.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/2500-7-0x00007FFBF4160000-0x00007FFBF4C21000-memory.dmpFilesize
10.8MB
-
memory/2500-8-0x0000016366AE0000-0x0000016367984000-memory.dmpFilesize
14.6MB
-
memory/2500-9-0x0000016369ED0000-0x0000016369EE0000-memory.dmpFilesize
64KB
-
memory/2500-10-0x000001636A8D0000-0x000001636AB4E000-memory.dmpFilesize
2.5MB
-
memory/2500-12-0x000001636A8D0000-0x000001636AB49000-memory.dmpFilesize
2.5MB
-
memory/2500-16-0x000001636A8D0000-0x000001636AB49000-memory.dmpFilesize
2.5MB
-
memory/2500-14-0x000001636A8D0000-0x000001636AB49000-memory.dmpFilesize
2.5MB
-
memory/2500-11-0x000001636A8D0000-0x000001636AB49000-memory.dmpFilesize
2.5MB
-
memory/2500-22-0x000001636A8D0000-0x000001636AB49000-memory.dmpFilesize
2.5MB
-
memory/2500-32-0x000001636A8D0000-0x000001636AB49000-memory.dmpFilesize
2.5MB
-
memory/2500-54-0x000001636A8D0000-0x000001636AB49000-memory.dmpFilesize
2.5MB
-
memory/2500-58-0x000001636A8D0000-0x000001636AB49000-memory.dmpFilesize
2.5MB
-
memory/2500-74-0x000001636A8D0000-0x000001636AB49000-memory.dmpFilesize
2.5MB
-
memory/2500-72-0x000001636A8D0000-0x000001636AB49000-memory.dmpFilesize
2.5MB
-
memory/2500-70-0x000001636A8D0000-0x000001636AB49000-memory.dmpFilesize
2.5MB
-
memory/2500-68-0x000001636A8D0000-0x000001636AB49000-memory.dmpFilesize
2.5MB
-
memory/2500-66-0x000001636A8D0000-0x000001636AB49000-memory.dmpFilesize
2.5MB
-
memory/2500-64-0x000001636A8D0000-0x000001636AB49000-memory.dmpFilesize
2.5MB
-
memory/2500-62-0x000001636A8D0000-0x000001636AB49000-memory.dmpFilesize
2.5MB
-
memory/2500-60-0x000001636A8D0000-0x000001636AB49000-memory.dmpFilesize
2.5MB
-
memory/2500-56-0x000001636A8D0000-0x000001636AB49000-memory.dmpFilesize
2.5MB
-
memory/2500-52-0x000001636A8D0000-0x000001636AB49000-memory.dmpFilesize
2.5MB
-
memory/2500-50-0x000001636A8D0000-0x000001636AB49000-memory.dmpFilesize
2.5MB
-
memory/2500-48-0x000001636A8D0000-0x000001636AB49000-memory.dmpFilesize
2.5MB
-
memory/2500-46-0x000001636A8D0000-0x000001636AB49000-memory.dmpFilesize
2.5MB
-
memory/2500-44-0x000001636A8D0000-0x000001636AB49000-memory.dmpFilesize
2.5MB
-
memory/2500-42-0x000001636A8D0000-0x000001636AB49000-memory.dmpFilesize
2.5MB
-
memory/2500-40-0x000001636A8D0000-0x000001636AB49000-memory.dmpFilesize
2.5MB
-
memory/2500-38-0x000001636A8D0000-0x000001636AB49000-memory.dmpFilesize
2.5MB
-
memory/2500-36-0x000001636A8D0000-0x000001636AB49000-memory.dmpFilesize
2.5MB
-
memory/2500-34-0x000001636A8D0000-0x000001636AB49000-memory.dmpFilesize
2.5MB
-
memory/2500-30-0x000001636A8D0000-0x000001636AB49000-memory.dmpFilesize
2.5MB
-
memory/2500-28-0x000001636A8D0000-0x000001636AB49000-memory.dmpFilesize
2.5MB
-
memory/2500-26-0x000001636A8D0000-0x000001636AB49000-memory.dmpFilesize
2.5MB
-
memory/2500-25-0x000001636A8D0000-0x000001636AB49000-memory.dmpFilesize
2.5MB
-
memory/2500-20-0x000001636A8D0000-0x000001636AB49000-memory.dmpFilesize
2.5MB
-
memory/2500-18-0x000001636A8D0000-0x000001636AB49000-memory.dmpFilesize
2.5MB
-
memory/2500-4891-0x0000016369DC0000-0x0000016369DC1000-memory.dmpFilesize
4KB
-
memory/2500-4892-0x0000016369FE0000-0x000001636A09A000-memory.dmpFilesize
744KB
-
memory/2500-4893-0x0000016369DF0000-0x0000016369E3C000-memory.dmpFilesize
304KB
-
memory/2500-4894-0x00007FFBF4160000-0x00007FFBF4C21000-memory.dmpFilesize
10.8MB
-
memory/2500-4895-0x0000016369ED0000-0x0000016369EE0000-memory.dmpFilesize
64KB
-
memory/2500-4897-0x0000016369E50000-0x0000016369EA4000-memory.dmpFilesize
336KB
-
memory/2500-4903-0x00007FFBF4160000-0x00007FFBF4C21000-memory.dmpFilesize
10.8MB
-
memory/2880-4913-0x0000028728190000-0x00000287281B2000-memory.dmpFilesize
136KB
-
memory/4120-4917-0x0000000000E00000-0x0000000001E68000-memory.dmpFilesize
16.4MB
-
memory/4120-4918-0x00000000067F0000-0x0000000006882000-memory.dmpFilesize
584KB
-
memory/4120-4919-0x0000000009AE0000-0x0000000009D96000-memory.dmpFilesize
2.7MB
-
memory/4120-4920-0x000000000A350000-0x000000000A8F4000-memory.dmpFilesize
5.6MB
-
memory/4120-9803-0x0000000006C60000-0x0000000006D54000-memory.dmpFilesize
976KB
-
memory/4572-4902-0x0000000140000000-0x00000001400E8000-memory.dmpFilesize
928KB