Analysis
- max time kernel
143s - max time network
121s - platform
windows7_x64 - resource
win7-20240215-en - resource tags
- submitted
01/05/2024, 01:40
General
- Target 815329af40c012e99c3adba70ebff5014fbde645b8e433344f51966d34580283.exe
- Size 1.4MB
- Sample240501-b33b7sda4x
- SHA256 815329af40c012e99c3adba70ebff5014fbde645b8e433344f51966d34580283
Malware Config
Signatures
- Detect ZGRat V1 33 IoCs
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- ZGRat
ZGRat is remote access trojan written in C#.
- Detect packed .NET executables. Mostly AgentTeslaV4. 33 IoCs
- ModiLoader Second Stage 2 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Modifies system certificate store 2 TTPs 2 IoCs
- Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\815329af40c012e99c3adba70ebff5014fbde645b8e433344f51966d34580283.exe"C:\Users\Admin\AppData\Local\Temp\815329af40c012e99c3adba70ebff5014fbde645b8e433344f51966d34580283.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\extrac32.exeC:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Admin\AppData\Local\Temp\815329af40c012e99c3adba70ebff5014fbde645b8e433344f51966d34580283.exe C:\\Users\\Public\\Libraries\\Tbykekua.PIF2⤵
-
-
C:\Users\Public\Libraries\aukekybT.pifC:\Users\Public\Libraries\aukekybT.pif2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
94308059B57B3142E455B38A6EB92015
Tar3412.tmp
aukekybT.pif
memory/2208-0-0x0000000000220000-0x0000000000221000-memory.dmp
memory/2208-1-0x0000000000400000-0x000000000056F000-memory.dmp
memory/2784-97-0x0000000049800000-0x0000000049854000-memory.dmp
memory/2784-89-0x0000000049800000-0x0000000049854000-memory.dmp
memory/2784-58-0x000000004C0E0000-0x000000004C120000-memory.dmp
memory/2784-57-0x0000000074650000-0x0000000074D3E000-memory.dmp
memory/2784-59-0x0000000049650000-0x00000000496AC000-memory.dmp
memory/2784-60-0x000000004C0E0000-0x000000004C120000-memory.dmp
memory/2784-61-0x0000000049800000-0x000000004985A000-memory.dmp
memory/2784-115-0x0000000049800000-0x0000000049854000-memory.dmp
memory/2784-113-0x0000000049800000-0x0000000049854000-memory.dmp
memory/2784-117-0x0000000049800000-0x0000000049854000-memory.dmp
memory/2784-111-0x0000000049800000-0x0000000049854000-memory.dmp
memory/2784-109-0x0000000049800000-0x0000000049854000-memory.dmp
memory/2784-107-0x0000000049800000-0x0000000049854000-memory.dmp
memory/2784-105-0x0000000049800000-0x0000000049854000-memory.dmp
memory/2784-103-0x0000000049800000-0x0000000049854000-memory.dmp
memory/2784-101-0x0000000049800000-0x0000000049854000-memory.dmp
memory/2784-99-0x0000000049800000-0x0000000049854000-memory.dmp
memory/2784-53-0x0000000000400000-0x0000000001400000-memory.dmp
memory/2784-95-0x0000000049800000-0x0000000049854000-memory.dmp
memory/2784-93-0x0000000049800000-0x0000000049854000-memory.dmp
memory/2784-91-0x0000000049800000-0x0000000049854000-memory.dmp
memory/2784-56-0x0000000000400000-0x0000000001400000-memory.dmp
memory/2784-87-0x0000000049800000-0x0000000049854000-memory.dmp
memory/2784-65-0x0000000049800000-0x0000000049854000-memory.dmp
memory/2784-85-0x0000000049800000-0x0000000049854000-memory.dmp
memory/2784-83-0x0000000049800000-0x0000000049854000-memory.dmp
memory/2784-81-0x0000000049800000-0x0000000049854000-memory.dmp
memory/2784-79-0x0000000049800000-0x0000000049854000-memory.dmp
memory/2784-77-0x0000000049800000-0x0000000049854000-memory.dmp
memory/2784-75-0x0000000049800000-0x0000000049854000-memory.dmp
memory/2784-73-0x0000000049800000-0x0000000049854000-memory.dmp
memory/2784-71-0x0000000049800000-0x0000000049854000-memory.dmp
memory/2784-63-0x0000000049800000-0x0000000049854000-memory.dmp
memory/2784-69-0x0000000049800000-0x0000000049854000-memory.dmp
memory/2784-67-0x0000000049800000-0x0000000049854000-memory.dmp
memory/2784-62-0x0000000049800000-0x0000000049854000-memory.dmp
memory/2784-121-0x0000000049800000-0x0000000049854000-memory.dmp
memory/2784-119-0x0000000049800000-0x0000000049854000-memory.dmp
memory/2784-1134-0x000000004C0E0000-0x000000004C120000-memory.dmp
memory/2784-1136-0x0000000074650000-0x0000000074D3E000-memory.dmp
memory/2784-1137-0x000000004C0E0000-0x000000004C120000-memory.dmp
memory/2784-1138-0x000000004C0E0000-0x000000004C120000-memory.dmp