Overview

overview

7

Static

static

7

00765a967c...18.exe

windows7-x64

7

00765a967c...18.exe

windows10-2004-x64

7

$LOCALAPPD...ly.exe

windows7-x64

7

$LOCALAPPD...ly.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows7-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...om.dll

windows7-x64

7

$PLUGINSDI...om.dll

windows10-2004-x64

7

$PLUGINSDI...dt.dll

windows7-x64

1

$PLUGINSDI...dt.dll

windows10-2004-x64

1

$PLUGINSDI...ry.dll

windows7-x64

3

$PLUGINSDI...ry.dll

windows10-2004-x64

3

$PLUGINSDI...on.dll

windows7-x64

7

$PLUGINSDI...on.dll

windows10-2004-x64

7

$_0_/exten...lts.js

windows7-x64

3

$_0_/exten...lts.js

windows10-2004-x64

3

background.html

windows7-x64

1

background.html

windows10-2004-x64

1

DealPlyIE.dll

windows7-x64

6

DealPlyIE.dll

windows10-2004-x64

6

vn-zugo.exe

windows7-x64

7

vn-zugo.exe

windows10-2004-x64

7

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDIR/Math.dll

windows7-x64

3

$PLUGINSDIR/Math.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows7-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    22/06/2024, 00:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    vn-zugo.exe
  • Size 720KB
  • Sample240622-ay91tasdpk
  • SHA256 a2efbc9b9a4d99cf60bd3e3b631dbe6116f31c15ccefc9f28ba3c95404afd63f
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Loads dropped DLL 63 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\vn-zugo.exe
    "C:\Users\Admin\AppData\Local\Temp\vn-zugo.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    PID:2496

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        GetVersion.dll
        • Path \Users\Admin\AppData\Local\Temp\nsiBA6.tmp\GetVersion.dll
        • Size 6KB
        • SHA256 7d76c7dd8f7cd5a87e0118dacb434db3971a049501e22a5f4b947154621ab3d4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Math.dll
        • Path \Users\Admin\AppData\Local\Temp\nsiBA6.tmp\Math.dll
        • Size 66KB
        • SHA256 0598f7d83db44929b7170c1285457b52b4281185f63ced102e709bf065f10d67
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        NSISdl.dll
        • Path \Users\Admin\AppData\Local\Temp\nsiBA6.tmp\NSISdl.dll
        • Size 14KB
        • SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.dll
        • Path \Users\Admin\AppData\Local\Temp\nsiBA6.tmp\System.dll
        • Size 11KB
        • SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        inetc.dll
        • Path \Users\Admin\AppData\Local\Temp\nsiBA6.tmp\inetc.dll
        • Size 20KB
        • SHA256 4c4d85eb9725fc7fade03467990e3dd9671c29a7870c97e69babc2cb3c9adef9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        linker.dll
        • Path \Users\Admin\AppData\Local\Temp\nsiBA6.tmp\linker.dll
        • Size 6KB
        • SHA256 53aa57e582dc56421c1191a0a9efac9c36960b903b7d825f3b9682605ec2b612
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        md5dll.dll
        • Path \Users\Admin\AppData\Local\Temp\nsiBA6.tmp\md5dll.dll
        • Size 8KB
        • SHA256 9b05dd603f13c196f3f21c43f48834208fed2294f7090fcd1334931014611fb2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        nsProcess.dll
        • Path \Users\Admin\AppData\Local\Temp\nsiBA6.tmp\nsProcess.dll
        • Size 4KB
        • SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
        • MD5 SHA1 SHA512
        Submit Download

        nshist.dll
        • Path \Users\Admin\AppData\Local\Temp\nsiBA6.tmp\nshist.dll
        • Size 39KB
        • SHA256 77f38240d729758f04fbd6ac00dc638e99ba27c42fa48200c99f51449e245343
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        timepro.dll
        • Path \Users\Admin\AppData\Local\Temp\nsiBA6.tmp\timepro.dll
        • Size 20KB
        • SHA256 c1ed8c398108dc56fbb6fd6797c3c9df59447e2a2f198b72a45058124971b09c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/2496-18-0x0000000000550000-0x000000000056A000-memory.dmp
        Download

        memory/2496-166-0x00000000007A0000-0x00000000007A9000-memory.dmp
        Download

        memory/2496-29-0x00000000003F0000-0x00000000003F9000-memory.dmp
        Download