zeppelin | 60b290310f67adb0ae186b4b938ca466a6b55653b2519261fa425127f5500a1f

Resubmissions

12-09-2024 02:23

240912-cvfznswere 10

04-09-2024 00:09

240904-afvheascla 10

03-09-2024 18:57

240903-xl8csavfrb 10

03-09-2024 18:12

240903-ws828asgnm 10

Analysis

max time kernel
1793s
max time network
1587s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
04-09-2024 00:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Ransomware/default.exe
Size

211KB
MD5

f42abb7569dbc2ff5faa7e078cb71476
SHA1

04530a6165fc29ab536bab1be16f6b87c46288e6
SHA256

516475caf3fbd1f0c0283572550528f1f9e7b502dce5fb6b89d40f366a150bfd
SHA512

3277534a02435538e144dea3476416e1d9117fcddef3dcb4379b82f33516c3e87767c3b0d2b880e61a3d803b583c96d772a0bdeecbfc109fe66444e9b29216af
SSDEEP

6144:zia1vcaEaA+HPsISAzG44DQFu/U3buRKlemZ9DnGAeWBES+:zHctWvVSAx4DQFu/U3buRKlemZ9DnGAn

Score

10^/10

zeppelin discovery persistence ransomware

Malware Config

Signatures

Detects Zeppelin payload 3 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe	family_zeppelin
behavioral10/memory/4948-30-0x0000000000EF0000-0x0000000001030000-memory.dmp	family_zeppelin
behavioral10/memory/3476-44-0x0000000000C10000-0x0000000000D50000-memory.dmp	family_zeppelin

Zeppelin Ransomware
Ransomware-as-a-service (RaaS) written in Delphi and first seen in 2019.
ransomware zeppelin
Deletes itself 1 IoCs

Processes:

notepad.exe

pid process

4784 notepad.exe
Executes dropped EXE 1 IoCs

Processes:

lsass.exe

pid process

3476 lsass.exe

pid	process
4784	notepad.exe

pid	process
3476	lsass.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

default.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\lsass.exe\" -start"	default.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

19 iplogger.org
17 iplogger.org
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

1 geoiptool.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1972 3476 WerFault.exe lsass.exe

flow	ioc
19	iplogger.org
17	iplogger.org

flow	ioc
1	geoiptool.com

pid	pid_target	process	target process
1972	3476	WerFault.exe	lsass.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

default.exelsass.exenotepad.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	default.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

default.exe

description pid process

Token: SeDebugPrivilege 4948 default.exe
Token: SeDebugPrivilege 4948 default.exe

description	pid	process
Token: SeDebugPrivilege	4948	default.exe
Token: SeDebugPrivilege	4948	default.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

default.exe

description	pid	process	target process
PID 4948 wrote to memory of 3476	4948	default.exe	lsass.exe
PID 4948 wrote to memory of 3476	4948	default.exe	lsass.exe
PID 4948 wrote to memory of 3476	4948	default.exe	lsass.exe
PID 4948 wrote to memory of 4784	4948	default.exe	notepad.exe
PID 4948 wrote to memory of 4784	4948	default.exe	notepad.exe
PID 4948 wrote to memory of 4784	4948	default.exe	notepad.exe
PID 4948 wrote to memory of 4784	4948	default.exe	notepad.exe
PID 4948 wrote to memory of 4784	4948	default.exe	notepad.exe
PID 4948 wrote to memory of 4784	4948	default.exe	notepad.exe

C:\Users\Admin\AppData\Local\Temp\Ransomware\default.exe
"C:\Users\Admin\AppData\Local\Temp\Ransomware\default.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe" -start
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3476
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 1736
    3⤵
    - Program crash
    PID:1972
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:4784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB

Filesize
2KB

MD5
e496751cd2219f672baccfe069c05607

SHA1
d43326345986e0c3a25bcfef2febf570a1794915

SHA256
272f89d727d01fec581fffb1a38e02ce025eb523663aa3e102f77ae9aa9e0f1b

SHA512
e84c7c29f3aa5b2184bd6590f3660ec3c67b5814e226f4f7c4ae9bfb11080ab0eb2fe43697710bd64beef869e368fa1ddd85495f7f92b0ff6a61a9c59264b5b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\204C1AA6F6114E6A513754A2AB5760FA_268232F9B7ADFD0751C3D83F667CFB78

Filesize
472B

MD5
e387a9f080832e4bca0e0ae7c79fdb11

SHA1
c99371faf5dc3ab43070d461fe39dca6aa7c65be

SHA256
c3e1220f4f61b0ad193dbe795702db897aec33891b59974e06f16c88d870ec8e

SHA512
98c469f5b2c3325391a079437d18561f46ea39ef0b87d6ce7525da53a59fc1d8a09b6437a2650e1f0ceb275005314e5add9f76ad12ab41af1b0794c5c7e17bd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
1KB

MD5
d8e9a72a6c3f0f85aa9c1191fd7f475b

SHA1
6ca59986f7442dd4cc86f8d9ccbbe60bf0bb5521

SHA256
7be0516557405ce6902e0029557412f8c439745532018adc581770b4177edaa3

SHA512
186de583be2ab6928a31ca38fd6419437a26a3c7c75c854818ccf48ec6d79fa76902cb1ed0168772d4aaf817a26263b8f0a2d9dc338d86d5fa2433920fc16bd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB

Filesize
484B

MD5
8bdf6bcad6f0aa08637526b6edfda7a2

SHA1
66ee07b21061b25f9852940ef749737a607f579d

SHA256
5143525b3f5aea4eae9e6deac9ce0b55b6460f10110d4f1f43288627014b9a43

SHA512
386215b15f3c010a3d4bd5b11366e3cd36dca8f7da17aeb34a3f0ee34db1d3796085d8ca9b4ea966931b1afb282c3dfb7be015f00aa50786ef5b439122f27f9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\204C1AA6F6114E6A513754A2AB5760FA_268232F9B7ADFD0751C3D83F667CFB78

Filesize
488B

MD5
037451e9aa73f0432a97a1efbbfce344

SHA1
11654141acd7a0e0a20c10ada033a12ea75fc451

SHA256
03ebe0d576e4bb3fbabbe9b4a4b792887aa2b1eca01bfefa9d877093ca0e69d5

SHA512
3b51f70e73d3f98374d988873f029f79fee9e49898005e8b170210a8183ee646fbbd3d5c6e563d3bdfb6210678cb9dfe5f242bca7e3bd46c8a1dffb048f901b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
482B

MD5
a51fc634204febab8e37a044b7323feb

SHA1
79d71cd7071abb299cd3bd6f9751623c3e299632

SHA256
445e94815d7bcd19ca53e8b23552884a16c65732a12a9b38c55231d90253fbf6

SHA512
4bedfec798b3f49a418db2d7b8360e3de20a553bc73b3ac39c67fc8cb69a0ebdeb36a9e3a5374b02fb789165a6919c6c0999f2932c0fe260a27a1e7d0d9349ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8S7W85J5\WWNDCGM2.htm

Filesize
190B

MD5
6ebbeb8c70d5f8ffc3fb501950468594

SHA1
c06e60a316e48f5c35d39bcf7ed7e6254957ac9e

SHA256
a563426e24d132cd87b70d9cb5cd3d57c2e1428873a3f3eb94649cf42e37b6a1

SHA512
75cfab1c9f5a05c892cf3b564aed06d351c6dc40048faea03ae163154ff7635252817d66b72a6ef51c4f895eebf7728f302df51148acce2a0c285502bf13652c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FQ5JVXBW\F68LCHSV.htm

Filesize
18KB

MD5
3c9fb9fbbdd372a9ab7f4e11cde5e657

SHA1
06f7b35568d81ca65e30ac213ff1031220ac090f

SHA256
f363ad44f70cd532e08a53e7ea0323f68d2b58b448349034ccc3dc3b0a96296f

SHA512
dd585b080863512a9a933e39d7542b13b3501f43ddfbd153e266964c37846e4d7ebd798512f705457c2be74a80a1d0aaf98c11ba5e6c2ca3f07f29eee1f68fcb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe

Filesize
211KB

MD5
f42abb7569dbc2ff5faa7e078cb71476

SHA1
04530a6165fc29ab536bab1be16f6b87c46288e6

SHA256
516475caf3fbd1f0c0283572550528f1f9e7b502dce5fb6b89d40f366a150bfd

SHA512
3277534a02435538e144dea3476416e1d9117fcddef3dcb4379b82f33516c3e87767c3b0d2b880e61a3d803b583c96d772a0bdeecbfc109fe66444e9b29216af

Download Submit
memory/3476-44-0x0000000000C10000-0x0000000000D50000-memory.dmp

Filesize
1.2MB

Download
memory/4784-20-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/4948-30-0x0000000000EF0000-0x0000000001030000-memory.dmp

Filesize
1.2MB

Download