Analysis
-
max time kernel
135s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
15-05-2024 03:42
Static task
static1
Behavioral task
behavioral1
Sample
0513304ac8178fa00bce7b395fa824d0.exe
Resource
win7-20240215-en
General
-
Target
0513304ac8178fa00bce7b395fa824d0.exe
-
Size
386KB
-
MD5
0513304ac8178fa00bce7b395fa824d0
-
SHA1
a10f045ae42a32cc223fb81d121a074f1cfb6085
-
SHA256
08acad39a18e3a380043252aaa097232c57f3e1b0e587d4fb88351b28698f942
-
SHA512
039619a83b493790bc47010daa09f657a597009a77d7639b22a37346ce9fb6fce83e906f4a68cc6575a33d9ccebe8cd1662d856de3c32cfe7c235316c4f39e9a
-
SSDEEP
6144:TcykrZfMtgEBXGx0Xy5gul0n4Qgf3ONjMMejZxxXx+0jTw3I:TcyktfW/tXZbgf3ONj7elxJw3I
Malware Config
Extracted
stealc
http://185.172.128.150
-
url_path
/c698e1bc8a2f5e6d.php
Signatures
-
Detect ZGRat V1 3 IoCs
resource yara_rule behavioral2/memory/2056-129-0x0000019098400000-0x000001909BC34000-memory.dmp family_zgrat_v1 behavioral2/memory/2056-130-0x00000190B73F0000-0x00000190B74FA000-memory.dmp family_zgrat_v1 behavioral2/memory/2056-134-0x000001909D8E0000-0x000001909D904000-memory.dmp family_zgrat_v1 -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation u31o.1.exe Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation 0513304ac8178fa00bce7b395fa824d0.exe -
Executes dropped EXE 2 IoCs
pid Process 1888 u31o.0.exe 3832 u31o.1.exe -
Loads dropped DLL 2 IoCs
pid Process 1888 u31o.0.exe 1888 u31o.0.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 2420 3948 WerFault.exe 81 5072 1888 WerFault.exe 92 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI u31o.1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI u31o.1.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI u31o.1.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 u31o.0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString u31o.0.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 1888 u31o.0.exe 1888 u31o.0.exe 2056 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 2056 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 2056 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 2056 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 2056 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 2056 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 2056 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 2056 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 2056 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 2056 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 2056 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 2056 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 2056 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 2056 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 2056 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 2056 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 2056 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 2056 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 2056 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 2056 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 2056 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 2056 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 2056 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 2056 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2056 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 3832 u31o.1.exe 3832 u31o.1.exe 3832 u31o.1.exe 3832 u31o.1.exe 3832 u31o.1.exe 3832 u31o.1.exe 3832 u31o.1.exe -
Suspicious use of SendNotifyMessage 7 IoCs
pid Process 3832 u31o.1.exe 3832 u31o.1.exe 3832 u31o.1.exe 3832 u31o.1.exe 3832 u31o.1.exe 3832 u31o.1.exe 3832 u31o.1.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3948 wrote to memory of 1888 3948 0513304ac8178fa00bce7b395fa824d0.exe 92 PID 3948 wrote to memory of 1888 3948 0513304ac8178fa00bce7b395fa824d0.exe 92 PID 3948 wrote to memory of 1888 3948 0513304ac8178fa00bce7b395fa824d0.exe 92 PID 3948 wrote to memory of 3832 3948 0513304ac8178fa00bce7b395fa824d0.exe 95 PID 3948 wrote to memory of 3832 3948 0513304ac8178fa00bce7b395fa824d0.exe 95 PID 3948 wrote to memory of 3832 3948 0513304ac8178fa00bce7b395fa824d0.exe 95 PID 3832 wrote to memory of 2056 3832 u31o.1.exe 102 PID 3832 wrote to memory of 2056 3832 u31o.1.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\0513304ac8178fa00bce7b395fa824d0.exe"C:\Users\Admin\AppData\Local\Temp\0513304ac8178fa00bce7b395fa824d0.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\u31o.0.exe"C:\Users\Admin\AppData\Local\Temp\u31o.0.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1888 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 19963⤵
- Program crash
PID:5072
-
-
-
C:\Users\Admin\AppData\Local\Temp\u31o.1.exe"C:\Users\Admin\AppData\Local\Temp\u31o.1.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2056
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3948 -s 15082⤵
- Program crash
PID:2420
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3948 -ip 39481⤵PID:2832
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1888 -ip 18881⤵PID:4780
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5a33e5b189842c5867f46566bdbf7a095
SHA1e1c06359f6a76da90d19e8fd95e79c832edb3196
SHA2565abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
SHA512f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
Filesize
3KB
MD526eb9dbd6d0a93bd9d17b3abfa4361ed
SHA19166c7a8de55767e335f98637d65d7632a759fa4
SHA256756763d6ca61cda451f9779bb1bd17ed9f47a21238b5e7794a1107b26a05013e
SHA51228118a77a51b7ebd82fec176325bdc78217dd1d3b22ec7b869953ca45cf9a2ab3cd898efb89ff76f5229b0219bdbf094b653653f3c9fa4b93679f699d4983e90
-
Filesize
239KB
MD5431c601846123a7b4aa67d75e31a3dfd
SHA10704a6551c01b3b5744e7b743b33ffa5be2b4ced
SHA2560a9eab89753e07a01b1c5e0197acefea9cc05e5f7829823f811e7aa1d7b817b7
SHA51287a0f6eb99baf620b25216ba491f4891154224ad44ecbbe209c5189585d4cc8abea25ef7b34d78608f074c00ce76374fe49252d76b693521363aced52e4cda27
-
Filesize
4.6MB
MD5397926927bca55be4a77839b1c44de6e
SHA1e10f3434ef3021c399dbba047832f02b3c898dbd
SHA2564f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7
SHA512cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954