Analysis
-
max time kernel
118s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07-05-2024 01:47
Static task
static1
Behavioral task
behavioral1
Sample
d7a29a6c822d5ac4f4faef4105aa50a563832decca35cfab3c24cb1b389b7f03.exe
Resource
win7-20240221-en
General
-
Target
d7a29a6c822d5ac4f4faef4105aa50a563832decca35cfab3c24cb1b389b7f03.exe
-
Size
416KB
-
MD5
0251b972016cb69c049602a3d2aa3ff7
-
SHA1
24847d133682d9d820dc8163019359927b6d71c2
-
SHA256
d7a29a6c822d5ac4f4faef4105aa50a563832decca35cfab3c24cb1b389b7f03
-
SHA512
523e359293557144d8c4dc09a6196e4eae5cfa9d11bd8d1353ca8dc347415f019436505fb72e0a5f0332e3ea24fcb97440fce1f64ea0d7ab868d6fd81eb9f77d
-
SSDEEP
6144:EkIIKkd5F7LcRmt5tuGEBQ4ZHXbA/3TntkIKcqFWWgfLR8tai6:E3DkzF7gmt5tuPBQ6LO3btbKnuLWtf6
Malware Config
Extracted
stealc
http://185.172.128.150
-
url_path
/c698e1bc8a2f5e6d.php
Signatures
-
Detect ZGRat V1 3 IoCs
resource yara_rule behavioral1/memory/1684-130-0x00000000012F0000-0x0000000004B24000-memory.dmp family_zgrat_v1 behavioral1/memory/1684-131-0x000000001EEF0000-0x000000001EFFA000-memory.dmp family_zgrat_v1 behavioral1/memory/1684-135-0x00000000012D0000-0x00000000012F4000-memory.dmp family_zgrat_v1 -
Detect binaries embedding considerable number of MFA browser extension IDs. 2 IoCs
resource yara_rule behavioral1/memory/1988-117-0x0000000000400000-0x0000000001A04000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs behavioral1/memory/1988-160-0x0000000000400000-0x0000000001A04000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs -
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 2 IoCs
resource yara_rule behavioral1/memory/1988-117-0x0000000000400000-0x0000000001A04000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/1988-160-0x0000000000400000-0x0000000001A04000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs -
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 2 IoCs
resource yara_rule behavioral1/memory/1988-117-0x0000000000400000-0x0000000001A04000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1988-160-0x0000000000400000-0x0000000001A04000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers -
Detects encrypted or obfuscated .NET executables 1 IoCs
resource yara_rule behavioral1/memory/1684-130-0x00000000012F0000-0x0000000004B24000-memory.dmp INDICATOR_EXE_DotNET_Encrypted -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
pid Process 1988 uso.0.exe 2824 uso.1.exe -
Loads dropped DLL 10 IoCs
pid Process 1032 d7a29a6c822d5ac4f4faef4105aa50a563832decca35cfab3c24cb1b389b7f03.exe 1032 d7a29a6c822d5ac4f4faef4105aa50a563832decca35cfab3c24cb1b389b7f03.exe 1032 d7a29a6c822d5ac4f4faef4105aa50a563832decca35cfab3c24cb1b389b7f03.exe 1032 d7a29a6c822d5ac4f4faef4105aa50a563832decca35cfab3c24cb1b389b7f03.exe 1988 uso.0.exe 1988 uso.0.exe 1032 d7a29a6c822d5ac4f4faef4105aa50a563832decca35cfab3c24cb1b389b7f03.exe 1032 d7a29a6c822d5ac4f4faef4105aa50a563832decca35cfab3c24cb1b389b7f03.exe 1032 d7a29a6c822d5ac4f4faef4105aa50a563832decca35cfab3c24cb1b389b7f03.exe 1032 d7a29a6c822d5ac4f4faef4105aa50a563832decca35cfab3c24cb1b389b7f03.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI uso.1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI uso.1.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI uso.1.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 uso.0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString uso.0.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 1988 uso.0.exe 1684 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1684 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1684 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1684 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1684 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1988 uso.0.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1684 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 2824 uso.1.exe 2824 uso.1.exe 2824 uso.1.exe 2824 uso.1.exe 2824 uso.1.exe 2824 uso.1.exe 2824 uso.1.exe -
Suspicious use of SendNotifyMessage 7 IoCs
pid Process 2824 uso.1.exe 2824 uso.1.exe 2824 uso.1.exe 2824 uso.1.exe 2824 uso.1.exe 2824 uso.1.exe 2824 uso.1.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1032 wrote to memory of 1988 1032 d7a29a6c822d5ac4f4faef4105aa50a563832decca35cfab3c24cb1b389b7f03.exe 28 PID 1032 wrote to memory of 1988 1032 d7a29a6c822d5ac4f4faef4105aa50a563832decca35cfab3c24cb1b389b7f03.exe 28 PID 1032 wrote to memory of 1988 1032 d7a29a6c822d5ac4f4faef4105aa50a563832decca35cfab3c24cb1b389b7f03.exe 28 PID 1032 wrote to memory of 1988 1032 d7a29a6c822d5ac4f4faef4105aa50a563832decca35cfab3c24cb1b389b7f03.exe 28 PID 1032 wrote to memory of 2824 1032 d7a29a6c822d5ac4f4faef4105aa50a563832decca35cfab3c24cb1b389b7f03.exe 30 PID 1032 wrote to memory of 2824 1032 d7a29a6c822d5ac4f4faef4105aa50a563832decca35cfab3c24cb1b389b7f03.exe 30 PID 1032 wrote to memory of 2824 1032 d7a29a6c822d5ac4f4faef4105aa50a563832decca35cfab3c24cb1b389b7f03.exe 30 PID 1032 wrote to memory of 2824 1032 d7a29a6c822d5ac4f4faef4105aa50a563832decca35cfab3c24cb1b389b7f03.exe 30 PID 2824 wrote to memory of 1684 2824 uso.1.exe 31 PID 2824 wrote to memory of 1684 2824 uso.1.exe 31 PID 2824 wrote to memory of 1684 2824 uso.1.exe 31 PID 2824 wrote to memory of 1684 2824 uso.1.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\d7a29a6c822d5ac4f4faef4105aa50a563832decca35cfab3c24cb1b389b7f03.exe"C:\Users\Admin\AppData\Local\Temp\d7a29a6c822d5ac4f4faef4105aa50a563832decca35cfab3c24cb1b389b7f03.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\uso.0.exe"C:\Users\Admin\AppData\Local\Temp\uso.0.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1988
-
-
C:\Users\Admin\AppData\Local\Temp\uso.1.exe"C:\Users\Admin\AppData\Local\Temp\uso.1.exe"2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1684
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\ApplicationInsights\f40fa09571ae3e4604ca1ef5093c12d04345052412cd199086553bfab6d3b7c7\7c6339f462b54fe39fb4edd2aeebe32b.tmp
Filesize1KB
MD56647e04756390c5f73e449a5e3611901
SHA1f454b86bbcd0cf6b8cac04e6787b37b7c1584f59
SHA2561e32189a494da58253a8e380c6931c8aaa29789ad63a4fc8fceb11c3e31d6a13
SHA512c21ebfd465b735575dd271e65cb4a809c584dd03cd911712847fa7a81abeba543dbdf761f8cc9f04bde0090461c3ed9c139ed0e1488ee4275c7823a0c8680139
-
Filesize
2KB
MD55cd4972d36abebfb9a867bc0be97b93f
SHA1cad052df5c2aad07a239331346b18c3d710c1b47
SHA2565cc80fdddc9b83d627e5fdf17056a99ec183601460ad91e10180d75960d90923
SHA512c2572fab2331b2beebfbbb25f15741da9698c94e67840cf336c2397949870b9cc2dbc1e171fa63b7b4d3ab1cde194ba86e91d7ba536e41c1f2f43507b9b80f0d
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
Filesize
230KB
MD52c1f5406f854370921a90cc0f3f11145
SHA16969f52309b66f6a09f08c0e67db4956df150346
SHA25679678293aad51fc96c947e496351048672ece528457daab0cfc93b35c16d1ab9
SHA5126104eaa7a60a29b5962b3cff8cde7b7c237ced82f11a7c581df30725d1d5aec187b30ebbe7d6d61f45964cf4f70ea605c9b20c504e5dddc2451f440ecb50e2ac
-
Filesize
4.6MB
MD5397926927bca55be4a77839b1c44de6e
SHA1e10f3434ef3021c399dbba047832f02b3c898dbd
SHA2564f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7
SHA512cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954