Analysis
- max time kernel
142s - max time network
118s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
01/05/2024, 01:40
General
- Target 815329af40c012e99c3adba70ebff5014fbde645b8e433344f51966d34580283.exe
- Size 1.4MB
- Sample240501-b33b7sda4x
- SHA256 815329af40c012e99c3adba70ebff5014fbde645b8e433344f51966d34580283
Malware Config
Extracted
-
Protocol
smtp
-
Host
mail.pcclimited.org
-
Port
587
-
Username
-
Password
tgbyhn@info
Signatures
- Detect ZGRat V1 33 IoCs
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- ZGRat
ZGRat is remote access trojan written in C#.
- Detect packed .NET executables. Mostly AgentTeslaV4. 33 IoCs
- ModiLoader Second Stage 2 IoCs
- Executes dropped EXE 1 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\815329af40c012e99c3adba70ebff5014fbde645b8e433344f51966d34580283.exe"C:\Users\Admin\AppData\Local\Temp\815329af40c012e99c3adba70ebff5014fbde645b8e433344f51966d34580283.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\extrac32.exeC:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Admin\AppData\Local\Temp\815329af40c012e99c3adba70ebff5014fbde645b8e433344f51966d34580283.exe C:\\Users\\Public\\Libraries\\Tbykekua.PIF2⤵
-
-
C:\Users\Public\Libraries\aukekybT.pifC:\Users\Public\Libraries\aukekybT.pif2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
aukekybT.pif
memory/3704-8-0x0000000000400000-0x0000000001400000-memory.dmp
memory/3704-11-0x0000000000400000-0x0000000001400000-memory.dmp
memory/3704-13-0x000000004C220000-0x000000004C27C000-memory.dmp
memory/3704-15-0x0000000074750000-0x0000000074F00000-memory.dmp
memory/3704-18-0x000000004C310000-0x000000004C320000-memory.dmp
memory/3704-19-0x000000004C8D0000-0x000000004C92A000-memory.dmp
memory/3704-17-0x000000004C310000-0x000000004C320000-memory.dmp
memory/3704-16-0x000000004C310000-0x000000004C320000-memory.dmp
memory/3704-14-0x000000004C320000-0x000000004C8C4000-memory.dmp
memory/3704-71-0x000000004C8D0000-0x000000004C924000-memory.dmp
memory/3704-79-0x000000004C8D0000-0x000000004C924000-memory.dmp
memory/3704-77-0x000000004C8D0000-0x000000004C924000-memory.dmp
memory/3704-76-0x000000004C8D0000-0x000000004C924000-memory.dmp
memory/3704-73-0x000000004C8D0000-0x000000004C924000-memory.dmp
memory/3704-69-0x000000004C8D0000-0x000000004C924000-memory.dmp
memory/3704-67-0x000000004C8D0000-0x000000004C924000-memory.dmp
memory/3704-66-0x000000004C8D0000-0x000000004C924000-memory.dmp
memory/3704-63-0x000000004C8D0000-0x000000004C924000-memory.dmp
memory/3704-61-0x000000004C8D0000-0x000000004C924000-memory.dmp
memory/3704-59-0x000000004C8D0000-0x000000004C924000-memory.dmp
memory/3704-58-0x000000004C8D0000-0x000000004C924000-memory.dmp
memory/3704-53-0x000000004C8D0000-0x000000004C924000-memory.dmp
memory/3704-49-0x000000004C8D0000-0x000000004C924000-memory.dmp
memory/3704-45-0x000000004C8D0000-0x000000004C924000-memory.dmp
memory/3704-39-0x000000004C8D0000-0x000000004C924000-memory.dmp
memory/3704-37-0x000000004C8D0000-0x000000004C924000-memory.dmp
memory/3704-55-0x000000004C8D0000-0x000000004C924000-memory.dmp
memory/3704-51-0x000000004C8D0000-0x000000004C924000-memory.dmp
memory/3704-47-0x000000004C8D0000-0x000000004C924000-memory.dmp
memory/3704-43-0x000000004C8D0000-0x000000004C924000-memory.dmp
memory/3704-41-0x000000004C8D0000-0x000000004C924000-memory.dmp
memory/3704-35-0x000000004C8D0000-0x000000004C924000-memory.dmp
memory/3704-33-0x000000004C8D0000-0x000000004C924000-memory.dmp
memory/3704-31-0x000000004C8D0000-0x000000004C924000-memory.dmp
memory/3704-29-0x000000004C8D0000-0x000000004C924000-memory.dmp
memory/3704-27-0x000000004C8D0000-0x000000004C924000-memory.dmp
memory/3704-25-0x000000004C8D0000-0x000000004C924000-memory.dmp
memory/3704-23-0x000000004C8D0000-0x000000004C924000-memory.dmp
memory/3704-21-0x000000004C8D0000-0x000000004C924000-memory.dmp
memory/3704-20-0x000000004C8D0000-0x000000004C924000-memory.dmp
memory/3704-1093-0x000000004CA30000-0x000000004CA96000-memory.dmp
memory/3704-1092-0x000000004C310000-0x000000004C320000-memory.dmp
memory/3704-1094-0x000000004D2D0000-0x000000004D320000-memory.dmp
memory/3704-1095-0x000000004D320000-0x000000004D3BC000-memory.dmp
memory/3704-1096-0x000000004D7C0000-0x000000004D852000-memory.dmp
memory/3704-1097-0x000000004D8E0000-0x000000004D8EA000-memory.dmp
memory/3704-1099-0x0000000074750000-0x0000000074F00000-memory.dmp
memory/3704-1101-0x000000004C310000-0x000000004C320000-memory.dmp
memory/3704-1102-0x000000004C310000-0x000000004C320000-memory.dmp
memory/3704-1103-0x000000004C310000-0x000000004C320000-memory.dmp
memory/3704-1104-0x000000004C310000-0x000000004C320000-memory.dmp
memory/4360-0-0x0000000000A60000-0x0000000000A61000-memory.dmp
memory/4360-12-0x0000000000400000-0x000000000056F000-memory.dmp