Analysis
-
max time kernel
147s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
09-05-2024 04:50
General
-
Target
fd8f62d6d7b10884b640e716509e5ceacdd337f09a76d74dfdd177c7981385dc.exe
-
Size
365KB
-
MD5
a9afff3f9e5f1ef60e4155bb56f7801c
-
SHA1
a76f10bcb953c53629c6cef72fc7f5ec0e48fa1b
-
SHA256
fd8f62d6d7b10884b640e716509e5ceacdd337f09a76d74dfdd177c7981385dc
-
SHA512
1df802891744949b1a59cb443a0416a864f001cde90d39a54394aa4868f2f83014aefb25a3b9f3a60bb48bb0b06eb14c62a2e2bb20ab59ca05e535e5e6a09b79
-
SSDEEP
6144:PaX7EMN6qa0aDkM2fzyL8uD1OQma0Ow9bcip87002dK6:PM5NKPkM2fzg1OiFt7FyK6
Malware Config
Extracted
stealc
http://185.172.128.150
-
url_path
/c698e1bc8a2f5e6d.php
Signatures
-
Detect ZGRat V1 3 IoCs
-
Stealc
Stealc is an infostealer written in C++.
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 23 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 7 IoCs
-
Suspicious use of SendNotifyMessage 7 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd8f62d6d7b10884b640e716509e5ceacdd337f09a76d74dfdd177c7981385dc.exe"C:\Users\Admin\AppData\Local\Temp\fd8f62d6d7b10884b640e716509e5ceacdd337f09a76d74dfdd177c7981385dc.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\u1y4.0.exe"C:\Users\Admin\AppData\Local\Temp\u1y4.0.exe"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 12843⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\u1y4.1.exe"C:\Users\Admin\AppData\Local\Temp\u1y4.1.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 9802⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2524 -ip 25241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1604 -ip 16041⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD55113f47e468061681abc54cd9b4ff3c2
SHA179ca5239749c9ebb06026bb5910db81a56d94c2b
SHA25678d347595e5cd6893961e4457e96a569da197735944f27f84746c6b14f81c6ef
SHA5128153269545d4e18f5870542d5087f9dcefd25393e84e4a42a61a167a3b083a203dbcdd282e5f490f300c67182a842544b09931d3491a5df58d13013622df8bea
-
Filesize
260KB
MD56162ac18a404aca27ee981ce4231df59
SHA15b133899a53375e5d97540fba94a57a065bd8927
SHA256024294f22a290e5e1729596c49f2509955f301f29106fe0f67413f7e2a88f2d9
SHA51218ba20e182baab7addade3d282813833439dd1f1b7cf9ef4a1128e04409e2becd76c14d207887c8ec8413541c99581b864b046331c1b9791021f3f1507783695
-
Filesize
4.6MB
MD5397926927bca55be4a77839b1c44de6e
SHA1e10f3434ef3021c399dbba047832f02b3c898dbd
SHA2564f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7
SHA512cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.0MB
-
Filesize
39.1MB
-
Filesize
39.1MB
-
Filesize
432KB
-
Filesize
444KB
-
Filesize
1024KB
-
Filesize
444KB
-
Filesize
432KB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
168KB
-
Filesize
392KB
-
Filesize
712KB
-
Filesize
136KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
3.0MB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
56KB
-
Filesize
224KB
-
Filesize
320KB
-
Filesize
136KB
-
Filesize
40KB
-
Filesize
5.2MB
-
Filesize
48KB
-
Filesize
472KB
-
Filesize
144KB
-
Filesize
120KB
-
Filesize
1.0MB
-
Filesize
80KB
-
Filesize
48KB
-
Filesize
64KB
-
Filesize
56.2MB