zharkbot | 7a41fa61102269baa65f7f762cf868c3c6a506fb58b590b6ae1352b864f2831e

Analysis

max time kernel
137s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-08-2024 14:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

yoyf.exe
Size

906KB
MD5

e3dcc770ca9c865a719c2b1f1c5b174e
SHA1

3690617064fbcccba9eacc76be2e00cd34bac830
SHA256

7a41fa61102269baa65f7f762cf868c3c6a506fb58b590b6ae1352b864f2831e
SHA512

c569ebd0b2286307ba5fd18deee905b550a4a84c19a54d0c4eb1a0f006acf7814cda0f44d8fb79c72e059e997fc49c2114cdfb698734b7570b967a5c8004b1b6
SSDEEP

12288:bvsKwGRdLBBNNBqiLckdXZj8YNQDcodji13ywe4GOMvS5JfAu8G:bvs78RRNBqin7oYNCcoe3h9MeJ78G

Score

10^/10

zharkbot botnet credential_access discovery spyware stealer

Malware Config

Signatures

Detects ZharkBot payload 2 IoCs

ZharkBot is a botnet written C++.

resource	yara_rule
behavioral2/memory/4296-58-0x0000000000400000-0x0000000000450000-memory.dmp	zharkcore
behavioral2/memory/4296-60-0x0000000000400000-0x0000000000450000-memory.dmp	zharkcore

ZharkBot
ZharkBot is a botnet written C++.
botnet zharkbot
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4440 set thread context of 2204	4440	yoyf.exe	93
PID 4440 set thread context of 4296	4440	yoyf.exe	101
PID 2204 set thread context of 2220	2204	AddInProcess32.exe	102

Program crash 1 IoCs

pid	pid_target	Process	procid_target
744	4296	WerFault.exe	101

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yoyf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4440	yoyf.exe
4440	yoyf.exe
2204	AddInProcess32.exe
2204	AddInProcess32.exe
2220	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4440	yoyf.exe
Token: SeDebugPrivilege	2204	AddInProcess32.exe
Token: SeDebugPrivilege	2220	InstallUtil.exe
Token: SeBackupPrivilege	2220	InstallUtil.exe
Token: SeSecurityPrivilege	2220	InstallUtil.exe
Token: SeSecurityPrivilege	2220	InstallUtil.exe
Token: SeSecurityPrivilege	2220	InstallUtil.exe
Token: SeSecurityPrivilege	2220	InstallUtil.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 2204	4440	yoyf.exe	93
PID 4440 wrote to memory of 2204	4440	yoyf.exe	93
PID 4440 wrote to memory of 2204	4440	yoyf.exe	93
PID 4440 wrote to memory of 2204	4440	yoyf.exe	93
PID 4440 wrote to memory of 2204	4440	yoyf.exe	93
PID 4440 wrote to memory of 2204	4440	yoyf.exe	93
PID 4440 wrote to memory of 2204	4440	yoyf.exe	93
PID 4440 wrote to memory of 2204	4440	yoyf.exe	93
PID 4440 wrote to memory of 4296	4440	yoyf.exe	101
PID 4440 wrote to memory of 4296	4440	yoyf.exe	101
PID 4440 wrote to memory of 4296	4440	yoyf.exe	101
PID 4440 wrote to memory of 4296	4440	yoyf.exe	101
PID 4440 wrote to memory of 4296	4440	yoyf.exe	101
PID 4440 wrote to memory of 4296	4440	yoyf.exe	101
PID 4440 wrote to memory of 4296	4440	yoyf.exe	101
PID 4440 wrote to memory of 4296	4440	yoyf.exe	101
PID 4440 wrote to memory of 4296	4440	yoyf.exe	101
PID 2204 wrote to memory of 2220	2204	AddInProcess32.exe	102
PID 2204 wrote to memory of 2220	2204	AddInProcess32.exe	102
PID 2204 wrote to memory of 2220	2204	AddInProcess32.exe	102
PID 2204 wrote to memory of 2220	2204	AddInProcess32.exe	102
PID 2204 wrote to memory of 2220	2204	AddInProcess32.exe	102
PID 2204 wrote to memory of 2220	2204	AddInProcess32.exe	102
PID 2204 wrote to memory of 2220	2204	AddInProcess32.exe	102
PID 2204 wrote to memory of 2220	2204	AddInProcess32.exe	102

C:\Users\Admin\AppData\Local\Temp\yoyf.exe
"C:\Users\Admin\AppData\Local\Temp\yoyf.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2220
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:4296
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4296 -s 408
    3⤵
    - Program crash
    PID:744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4296 -ip 4296
1⤵
PID:1600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2204-16-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2204-64-0x00000000745C0000-0x0000000074D70000-memory.dmp

Filesize
7.7MB

Download
memory/2204-57-0x00000000745C0000-0x0000000074D70000-memory.dmp

Filesize
7.7MB

Download
memory/2204-56-0x00000000745C0000-0x0000000074D70000-memory.dmp

Filesize
7.7MB

Download
memory/2204-55-0x00000000745C0000-0x0000000074D70000-memory.dmp

Filesize
7.7MB

Download
memory/2204-34-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2204-40-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2204-42-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2204-44-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2204-20-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2204-22-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2204-24-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2204-26-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2204-18-0x00000000745C0000-0x0000000074D70000-memory.dmp

Filesize
7.7MB

Download
memory/2204-17-0x00000000745C0000-0x0000000074D70000-memory.dmp

Filesize
7.7MB

Download
memory/2204-15-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2220-62-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2220-65-0x0000000008DC0000-0x00000000093D8000-memory.dmp

Filesize
6.1MB

Download
memory/2220-74-0x000000000B170000-0x000000000B69C000-memory.dmp

Filesize
5.2MB

Download
memory/2220-73-0x000000000AA70000-0x000000000AC32000-memory.dmp

Filesize
1.8MB

Download
memory/2220-72-0x00000000098F0000-0x000000000990E000-memory.dmp

Filesize
120KB

Download
memory/2220-71-0x0000000009940000-0x00000000099B6000-memory.dmp

Filesize
472KB

Download
memory/2220-70-0x0000000009650000-0x00000000096B6000-memory.dmp

Filesize
408KB

Download
memory/2220-69-0x0000000008A30000-0x0000000008A7C000-memory.dmp

Filesize
304KB

Download
memory/2220-68-0x00000000088D0000-0x000000000890C000-memory.dmp

Filesize
240KB

Download
memory/2220-67-0x0000000008870000-0x0000000008882000-memory.dmp

Filesize
72KB

Download
memory/2220-66-0x0000000008920000-0x0000000008A2A000-memory.dmp

Filesize
1.0MB

Download
memory/4296-60-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4296-58-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4440-5-0x00000000053E0000-0x00000000053E6000-memory.dmp

Filesize
24KB

Download
memory/4440-4-0x0000000007FA0000-0x0000000008262000-memory.dmp

Filesize
2.8MB

Download
memory/4440-14-0x00000000745C0000-0x0000000074D70000-memory.dmp

Filesize
7.7MB

Download
memory/4440-61-0x00000000745C0000-0x0000000074D70000-memory.dmp

Filesize
7.7MB

Download
memory/4440-6-0x000000000ACC0000-0x000000000B264000-memory.dmp

Filesize
5.6MB

Download
memory/4440-1-0x00000000009F0000-0x0000000000AD6000-memory.dmp

Filesize
920KB

Download
memory/4440-2-0x0000000005920000-0x00000000059BC000-memory.dmp

Filesize
624KB

Download
memory/4440-3-0x00000000745C0000-0x0000000074D70000-memory.dmp

Filesize
7.7MB

Download
memory/4440-0-0x00000000745CE000-0x00000000745CF000-memory.dmp

Filesize
4KB

Download
memory/4440-7-0x000000000A7B0000-0x000000000A842000-memory.dmp

Filesize
584KB

Download
memory/4440-8-0x000000000A790000-0x000000000A79A000-memory.dmp

Filesize
40KB

Download
memory/4440-9-0x00000000745C0000-0x0000000074D70000-memory.dmp

Filesize
7.7MB

Download
memory/4440-10-0x00000000745CE000-0x00000000745CF000-memory.dmp

Filesize
4KB

Download
memory/4440-11-0x00000000745C0000-0x0000000074D70000-memory.dmp

Filesize
7.7MB

Download
memory/4440-12-0x0000000007D90000-0x0000000007DAA000-memory.dmp

Filesize
104KB

Download
memory/4440-13-0x0000000007DB0000-0x0000000007DB6000-memory.dmp

Filesize
24KB

Download