Overview

overview

7

Static

static

7

00765a967c...18.exe

windows7-x64

7

00765a967c...18.exe

windows10-2004-x64

7

$LOCALAPPD...ly.exe

windows7-x64

7

$LOCALAPPD...ly.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows7-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...om.dll

windows7-x64

7

$PLUGINSDI...om.dll

windows10-2004-x64

7

$PLUGINSDI...dt.dll

windows7-x64

1

$PLUGINSDI...dt.dll

windows10-2004-x64

1

$PLUGINSDI...ry.dll

windows7-x64

3

$PLUGINSDI...ry.dll

windows10-2004-x64

3

$PLUGINSDI...on.dll

windows7-x64

7

$PLUGINSDI...on.dll

windows10-2004-x64

7

$_0_/exten...lts.js

windows7-x64

3

$_0_/exten...lts.js

windows10-2004-x64

3

background.html

windows7-x64

1

background.html

windows10-2004-x64

1

DealPlyIE.dll

windows7-x64

6

DealPlyIE.dll

windows10-2004-x64

6

vn-zugo.exe

windows7-x64

7

vn-zugo.exe

windows10-2004-x64

7

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDIR/Math.dll

windows7-x64

3

$PLUGINSDIR/Math.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows7-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    147s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/06/2024, 00:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    vn-zugo.exe
  • Size 720KB
  • Sample240622-ay91tasdpk
  • SHA256 a2efbc9b9a4d99cf60bd3e3b631dbe6116f31c15ccefc9f28ba3c95404afd63f
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\vn-zugo.exe
    "C:\Users\Admin\AppData\Local\Temp\vn-zugo.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    PID:4560

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        GetVersion.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsj51CB.tmp\GetVersion.dll
        • Size 6KB
        • SHA256 7d76c7dd8f7cd5a87e0118dacb434db3971a049501e22a5f4b947154621ab3d4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Math.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsj51CB.tmp\Math.dll
        • Size 66KB
        • SHA256 0598f7d83db44929b7170c1285457b52b4281185f63ced102e709bf065f10d67
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        NSISdl.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsj51CB.tmp\NSISdl.dll
        • Size 14KB
        • SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsj51CB.tmp\System.dll
        • Size 11KB
        • SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        inetc.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsj51CB.tmp\inetc.dll
        • Size 20KB
        • SHA256 4c4d85eb9725fc7fade03467990e3dd9671c29a7870c97e69babc2cb3c9adef9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        linker.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsj51CB.tmp\linker.dll
        • Size 6KB
        • SHA256 53aa57e582dc56421c1191a0a9efac9c36960b903b7d825f3b9682605ec2b612
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        md5dll.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsj51CB.tmp\md5dll.dll
        • Size 8KB
        • SHA256 9b05dd603f13c196f3f21c43f48834208fed2294f7090fcd1334931014611fb2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        nsProcess.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsj51CB.tmp\nsProcess.dll
        • Size 4KB
        • SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
        • MD5 SHA1 SHA512
        Submit Download

        nshist.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsj51CB.tmp\nshist.dll
        • Size 39KB
        • SHA256 77f38240d729758f04fbd6ac00dc638e99ba27c42fa48200c99f51449e245343
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tbdata.json
        • Path C:\Users\Admin\AppData\Local\Temp\nsj51CB.tmp\tbdata.json
        • Size 1KB
        • SHA256 48b675121808a7c7792934812ab1b4886c3c9de4acdaad30dd625552a8891b25
        • MD5 SHA1 SHA512
        Submit Download

        timepro.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsj51CB.tmp\timepro.dll
        • Size 20KB
        • SHA256 c1ed8c398108dc56fbb6fd6797c3c9df59447e2a2f198b72a45058124971b09c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/4560-19-0x00000000021D0000-0x00000000021EA000-memory.dmp
        Download

        memory/4560-226-0x0000000004020000-0x0000000004029000-memory.dmp
        Download

        memory/4560-34-0x0000000002200000-0x0000000002209000-memory.dmp
        Download