Analysis
-
max time kernel
130s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
15-05-2024 11:56
Static task
static1
Behavioral task
behavioral1
Sample
leadiadequatepro.exe
Resource
win10v2004-20240426-en
General
-
Target
leadiadequatepro.exe
-
Size
14.1MB
-
MD5
b149f82964b1e269ade2686612a9e777
-
SHA1
9ccccc1fe6c947dcbc779624ffa9a0fd1b7e7790
-
SHA256
9f2c70239fe518552ee44423564b075a85e0fc1e7bd80dc233bcc1f882ffceb9
-
SHA512
5c07589d51c21310415fb2fd616ac6fe23b1ec7e26007b6a3d2ce948bcbc3613db14bbc5686f5f352fb614cea00b3af657d1d6a9e2a078c3487d345d145ec2c9
-
SSDEEP
393216:FwI5aqRbG66MMgLaDArf6tY5yParKZwVgIZlds:FwSHLyMytYYP8KZwKI
Malware Config
Extracted
meduza
109.107.181.83
Signatures
-
Detect ZGRat V1 35 IoCs
resource yara_rule behavioral1/memory/5112-10-0x000001EEE5D50000-0x000001EEE5FCE000-memory.dmp family_zgrat_v1 behavioral1/memory/5112-12-0x000001EEE5D50000-0x000001EEE5FC9000-memory.dmp family_zgrat_v1 behavioral1/memory/5112-24-0x000001EEE5D50000-0x000001EEE5FC9000-memory.dmp family_zgrat_v1 behavioral1/memory/5112-54-0x000001EEE5D50000-0x000001EEE5FC9000-memory.dmp family_zgrat_v1 behavioral1/memory/5112-68-0x000001EEE5D50000-0x000001EEE5FC9000-memory.dmp family_zgrat_v1 behavioral1/memory/5112-62-0x000001EEE5D50000-0x000001EEE5FC9000-memory.dmp family_zgrat_v1 behavioral1/memory/5112-60-0x000001EEE5D50000-0x000001EEE5FC9000-memory.dmp family_zgrat_v1 behavioral1/memory/5112-58-0x000001EEE5D50000-0x000001EEE5FC9000-memory.dmp family_zgrat_v1 behavioral1/memory/5112-56-0x000001EEE5D50000-0x000001EEE5FC9000-memory.dmp family_zgrat_v1 behavioral1/memory/5112-52-0x000001EEE5D50000-0x000001EEE5FC9000-memory.dmp family_zgrat_v1 behavioral1/memory/5112-48-0x000001EEE5D50000-0x000001EEE5FC9000-memory.dmp family_zgrat_v1 behavioral1/memory/5112-74-0x000001EEE5D50000-0x000001EEE5FC9000-memory.dmp family_zgrat_v1 behavioral1/memory/5112-72-0x000001EEE5D50000-0x000001EEE5FC9000-memory.dmp family_zgrat_v1 behavioral1/memory/5112-70-0x000001EEE5D50000-0x000001EEE5FC9000-memory.dmp family_zgrat_v1 behavioral1/memory/5112-66-0x000001EEE5D50000-0x000001EEE5FC9000-memory.dmp family_zgrat_v1 behavioral1/memory/5112-64-0x000001EEE5D50000-0x000001EEE5FC9000-memory.dmp family_zgrat_v1 behavioral1/memory/5112-46-0x000001EEE5D50000-0x000001EEE5FC9000-memory.dmp family_zgrat_v1 behavioral1/memory/5112-44-0x000001EEE5D50000-0x000001EEE5FC9000-memory.dmp family_zgrat_v1 behavioral1/memory/5112-42-0x000001EEE5D50000-0x000001EEE5FC9000-memory.dmp family_zgrat_v1 behavioral1/memory/5112-38-0x000001EEE5D50000-0x000001EEE5FC9000-memory.dmp family_zgrat_v1 behavioral1/memory/5112-50-0x000001EEE5D50000-0x000001EEE5FC9000-memory.dmp family_zgrat_v1 behavioral1/memory/5112-40-0x000001EEE5D50000-0x000001EEE5FC9000-memory.dmp family_zgrat_v1 behavioral1/memory/5112-34-0x000001EEE5D50000-0x000001EEE5FC9000-memory.dmp family_zgrat_v1 behavioral1/memory/5112-32-0x000001EEE5D50000-0x000001EEE5FC9000-memory.dmp family_zgrat_v1 behavioral1/memory/5112-30-0x000001EEE5D50000-0x000001EEE5FC9000-memory.dmp family_zgrat_v1 behavioral1/memory/5112-28-0x000001EEE5D50000-0x000001EEE5FC9000-memory.dmp family_zgrat_v1 behavioral1/memory/5112-26-0x000001EEE5D50000-0x000001EEE5FC9000-memory.dmp family_zgrat_v1 behavioral1/memory/5112-22-0x000001EEE5D50000-0x000001EEE5FC9000-memory.dmp family_zgrat_v1 behavioral1/memory/5112-20-0x000001EEE5D50000-0x000001EEE5FC9000-memory.dmp family_zgrat_v1 behavioral1/memory/5112-18-0x000001EEE5D50000-0x000001EEE5FC9000-memory.dmp family_zgrat_v1 behavioral1/memory/5112-16-0x000001EEE5D50000-0x000001EEE5FC9000-memory.dmp family_zgrat_v1 behavioral1/memory/5112-14-0x000001EEE5D50000-0x000001EEE5FC9000-memory.dmp family_zgrat_v1 behavioral1/memory/5112-36-0x000001EEE5D50000-0x000001EEE5FC9000-memory.dmp family_zgrat_v1 behavioral1/memory/5112-11-0x000001EEE5D50000-0x000001EEE5FC9000-memory.dmp family_zgrat_v1 behavioral1/memory/3688-4925-0x0000000009650000-0x0000000009906000-memory.dmp family_zgrat_v1 -
Meduza Stealer payload 2 IoCs
resource yara_rule behavioral1/memory/4124-4902-0x0000000140000000-0x00000001400E8000-memory.dmp family_meduza behavioral1/memory/4124-9810-0x0000000140000000-0x00000001400E8000-memory.dmp family_meduza -
Executes dropped EXE 2 IoCs
pid Process 5112 leadadequate.exe 3688 leadiadequate.exe -
Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" leadiadequatepro.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 51 api.ipify.org 52 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5112 set thread context of 4124 5112 leadadequate.exe 98 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1256 powershell.exe 1256 powershell.exe 4124 InstallUtil.exe 4124 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5112 leadadequate.exe Token: SeDebugPrivilege 5112 leadadequate.exe Token: SeDebugPrivilege 1256 powershell.exe Token: SeDebugPrivilege 3688 leadiadequate.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 856 wrote to memory of 5112 856 leadiadequatepro.exe 84 PID 856 wrote to memory of 5112 856 leadiadequatepro.exe 84 PID 5112 wrote to memory of 4124 5112 leadadequate.exe 98 PID 5112 wrote to memory of 4124 5112 leadadequate.exe 98 PID 5112 wrote to memory of 4124 5112 leadadequate.exe 98 PID 5112 wrote to memory of 4124 5112 leadadequate.exe 98 PID 5112 wrote to memory of 4124 5112 leadadequate.exe 98 PID 5112 wrote to memory of 4124 5112 leadadequate.exe 98 PID 5112 wrote to memory of 4124 5112 leadadequate.exe 98 PID 5112 wrote to memory of 4124 5112 leadadequate.exe 98 PID 5112 wrote to memory of 4124 5112 leadadequate.exe 98 PID 5112 wrote to memory of 4124 5112 leadadequate.exe 98 PID 5112 wrote to memory of 4124 5112 leadadequate.exe 98 PID 5112 wrote to memory of 1256 5112 leadadequate.exe 99 PID 5112 wrote to memory of 1256 5112 leadadequate.exe 99 PID 856 wrote to memory of 3688 856 leadiadequatepro.exe 100 PID 856 wrote to memory of 3688 856 leadiadequatepro.exe 100 PID 856 wrote to memory of 3688 856 leadiadequatepro.exe 100 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\leadiadequatepro.exe"C:\Users\Admin\AppData\Local\Temp\leadiadequatepro.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\leadadequate.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\leadadequate.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"3⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path
PID:4124
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Start-Sleep -Seconds 5; Remove-Item -Path 'C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\leadadequate.exe' -Force3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1256
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\leadiadequate.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\leadiadequate.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3688
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14.6MB
MD5938ea9e68b80a685337ed40667037a21
SHA1520a3984265c13d4f289eb162f5a25108a9b7d9c
SHA2562cbf1a9a727ec04dc73f38be06befd8e3d162346807afb95ae1189cbd8376a19
SHA512e756f76dca6a6aacb7b5e1b017be4d583890c13f41059f3a4a5da24733f0b141c7d074a5a4b032275b03bac331c628f008d0178e85e53d348d506a8c50255c50
-
Filesize
16.4MB
MD540f6d61aae921cc7ec31836a7fac3c2a
SHA1fcb93eb39a221d68978f3943acba0699e032a16c
SHA256e8cabc3a065dd38f596cfc67ae3231dc728a35125b2d1677c73b3682dcaa9b29
SHA51222cb185a1f492d4d695702605a26f4b8ad154b0a6130297cbb705462043dee7d07e85f9f8637381e574e8f7970d747ff7ab136ebc1c01a5695eef5df84dee6db
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82