Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    02/05/2024, 01:09

General

  • Target

    37d95e56ed2ab7dbaeae0f8afad3d94ffd9286dee2447ad631b52ecd84a4f47a.xlam

  • Size

    654KB

  • MD5

    8216d3088f8358388dfcbdc7026f2ea1

  • SHA1

    3040eaecd169f745eae12c30652eebc676c3f234

  • SHA256

    37d95e56ed2ab7dbaeae0f8afad3d94ffd9286dee2447ad631b52ecd84a4f47a

  • SHA512

    029f80578514d71ea67d0140423a1732d95006d647d852ff5db3e0ad401499e7bc537c8302fd056187233100428c1f23ddeceed8616f3a62d78de821dc0586f5

  • SSDEEP

    12288:FnnWqkrsXN8zr24zzR80FjO/O4YONMYCJ4n44JhzwFjlIZhXDExExQeFZlW:daraiSK8CjOG4fg444zkjqw2d7E

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Detect ZGRat V1 33 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\37d95e56ed2ab7dbaeae0f8afad3d94ffd9286dee2447ad631b52ecd84a4f47a.xlam
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2876
  • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
    1⤵
    • Blocklisted process makes network request
    • Loads dropped DLL
    • Launches Equation Editor
    • Suspicious use of WriteProcessMemory
    PID:2960
    • C:\Users\Admin\AppData\Roaming\OIU.exe
      C:\Users\Admin\AppData\Roaming\OIU.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2600
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        C:\Users\Admin\AppData\Roaming\OIU.exe
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2480

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\Esher

          Filesize

          262KB

          MD5

          183ba29e3ba1a448c983a6772ea728e8

          SHA1

          43e8e4e6c8925d72f3b24ef74bd7017f6d7503c1

          SHA256

          2c74d0b73da91109988ea8ae9ae5be693fd1f565751dfd28e4d4f5f4bdea91b5

          SHA512

          f2bf3e7dccef67ae24d9401b10d726c0085616235b38cdefd9c8bf1c952f7aceb61e0aeea711ff7a797921f5bde8f75bb02cec26fdc5271840fd8723602b1c0d

        • \Users\Admin\AppData\Roaming\OIU.exe

          Filesize

          1.2MB

          MD5

          158c5c0367c262694f3c44ae85b891b6

          SHA1

          c8ae2619967b6fbf4962a57a34c614b7c6517b45

          SHA256

          82215185860a139b407ad688a9a83a05ef78a9af58ee96f575e8dba25b965340

          SHA512

          ef67d25306f175ab98e33f2730b2423fe20c433b1329d8c6c5812b428cb040dbb4965d8c59d5aa3a99a0e1afef54e0c918075768f6b3d2cf68119d1aa872d3ea

        • memory/2480-37-0x0000000000C30000-0x0000000000C7D000-memory.dmp

          Filesize

          308KB

        • memory/2480-33-0x0000000000C30000-0x0000000000C7D000-memory.dmp

          Filesize

          308KB

        • memory/2480-31-0x0000000000C30000-0x0000000000C7D000-memory.dmp

          Filesize

          308KB

        • memory/2480-20-0x0000000000400000-0x0000000000446000-memory.dmp

          Filesize

          280KB

        • memory/2480-23-0x0000000000400000-0x0000000000446000-memory.dmp

          Filesize

          280KB

        • memory/2480-22-0x0000000000400000-0x0000000000446000-memory.dmp

          Filesize

          280KB

        • memory/2480-24-0x0000000000BD0000-0x0000000000C24000-memory.dmp

          Filesize

          336KB

        • memory/2480-25-0x0000000000C30000-0x0000000000C82000-memory.dmp

          Filesize

          328KB

        • memory/2480-35-0x0000000000C30000-0x0000000000C7D000-memory.dmp

          Filesize

          308KB

        • memory/2480-41-0x0000000000C30000-0x0000000000C7D000-memory.dmp

          Filesize

          308KB

        • memory/2480-55-0x0000000000C30000-0x0000000000C7D000-memory.dmp

          Filesize

          308KB

        • memory/2480-57-0x0000000000C30000-0x0000000000C7D000-memory.dmp

          Filesize

          308KB

        • memory/2480-53-0x0000000000C30000-0x0000000000C7D000-memory.dmp

          Filesize

          308KB

        • memory/2480-51-0x0000000000C30000-0x0000000000C7D000-memory.dmp

          Filesize

          308KB

        • memory/2480-49-0x0000000000C30000-0x0000000000C7D000-memory.dmp

          Filesize

          308KB

        • memory/2480-47-0x0000000000C30000-0x0000000000C7D000-memory.dmp

          Filesize

          308KB

        • memory/2480-45-0x0000000000C30000-0x0000000000C7D000-memory.dmp

          Filesize

          308KB

        • memory/2480-63-0x0000000000C30000-0x0000000000C7D000-memory.dmp

          Filesize

          308KB

        • memory/2480-43-0x0000000000C30000-0x0000000000C7D000-memory.dmp

          Filesize

          308KB

        • memory/2480-39-0x0000000000C30000-0x0000000000C7D000-memory.dmp

          Filesize

          308KB

        • memory/2480-1057-0x0000000000400000-0x0000000000446000-memory.dmp

          Filesize

          280KB

        • memory/2480-59-0x0000000000C30000-0x0000000000C7D000-memory.dmp

          Filesize

          308KB

        • memory/2480-61-0x0000000000C30000-0x0000000000C7D000-memory.dmp

          Filesize

          308KB

        • memory/2480-29-0x0000000000C30000-0x0000000000C7D000-memory.dmp

          Filesize

          308KB

        • memory/2480-73-0x0000000000C30000-0x0000000000C7D000-memory.dmp

          Filesize

          308KB

        • memory/2480-27-0x0000000000C30000-0x0000000000C7D000-memory.dmp

          Filesize

          308KB

        • memory/2480-77-0x0000000000C30000-0x0000000000C7D000-memory.dmp

          Filesize

          308KB

        • memory/2480-26-0x0000000000C30000-0x0000000000C7D000-memory.dmp

          Filesize

          308KB

        • memory/2480-79-0x0000000000C30000-0x0000000000C7D000-memory.dmp

          Filesize

          308KB

        • memory/2480-85-0x0000000000C30000-0x0000000000C7D000-memory.dmp

          Filesize

          308KB

        • memory/2480-83-0x0000000000C30000-0x0000000000C7D000-memory.dmp

          Filesize

          308KB

        • memory/2480-81-0x0000000000C30000-0x0000000000C7D000-memory.dmp

          Filesize

          308KB

        • memory/2480-75-0x0000000000C30000-0x0000000000C7D000-memory.dmp

          Filesize

          308KB

        • memory/2480-71-0x0000000000C30000-0x0000000000C7D000-memory.dmp

          Filesize

          308KB

        • memory/2480-69-0x0000000000C30000-0x0000000000C7D000-memory.dmp

          Filesize

          308KB

        • memory/2480-67-0x0000000000C30000-0x0000000000C7D000-memory.dmp

          Filesize

          308KB

        • memory/2480-65-0x0000000000C30000-0x0000000000C7D000-memory.dmp

          Filesize

          308KB

        • memory/2600-19-0x00000000002B0000-0x00000000002B4000-memory.dmp

          Filesize

          16KB

        • memory/2876-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

          Filesize

          64KB

        • memory/2876-1056-0x00000000724DD000-0x00000000724E8000-memory.dmp

          Filesize

          44KB

        • memory/2876-1-0x00000000724DD000-0x00000000724E8000-memory.dmp

          Filesize

          44KB

        • memory/2876-1060-0x00000000724DD000-0x00000000724E8000-memory.dmp

          Filesize

          44KB