Analysis
-
max time kernel
93s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
10-09-2024 15:10
General
-
Target
DupeRobux.exe
-
Size
57KB
-
MD5
c870b1f3b3cf0d17f9c88655e65bcc64
-
SHA1
d8bd42eb5d6cb916cc1d0c4c42efc638b4047094
-
SHA256
34dd8e8bbf48f42744c0f18a53dd494cd383ae6b7f85b89cda97a788955c3531
-
SHA512
dccbe647e30e3c0c946b60ac2070dba4a20595510b22b1c03cfb555aa36314c17d0de147bdf72ddb5dd2974f09412866ce4adec361a675f16dd9df136c4d1a1d
-
SSDEEP
768:Qx6mRbM5xKw0nrDtfPTsOZn3X9LYRaUhehM78wOcOkPsgXDkO:Q1RbS0rD1PTsOZdLMeSAd63
Malware Config
Signatures
-
Zingo stealer
Zingo is an info stealer first seen in March 2022.
-
Zingo stealer payload 1 IoCs
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Downloads MZ/PE file
-
Loads dropped DLL 7 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DupeRobux.exe"C:\Users\Admin\AppData\Local\Temp\DupeRobux.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
461KB
MD5a999d7f3807564cc816c16f862a60bbe
SHA11ee724daaf70c6b0083bf589674b6f6d8427544f
SHA2568e9c0362e9bfb3c49af59e1b4d376d3e85b13aed0fbc3f5c0e1ebc99c07345f3
SHA5126f1f73314d86ae324cc7f55d8e6352e90d4a47f0200671f7069daa98592daaceea34cf89b47defbecdda7d3b3e4682de70e80a5275567b82aa81b002958e4414
-
Filesize
685KB
MD5081d9558bbb7adce142da153b2d5577a
SHA17d0ad03fbda1c24f883116b940717e596073ae96
SHA256b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3
SHA5122fdf035661f349206f58ea1feed8805b7f9517a21f9c113e7301c69de160f184c774350a12a710046e3ff6baa37345d319b6f47fd24fbba4e042d54014bee511
-
Filesize
384KB
MD555c797383dbbbfe93c0fe3215b99b8ec
SHA11b089157f3d8ae64c62ea15cdad3d82eafa1df4b
SHA2565fac5a9e9b8bbdad6cf661dbf3187e395914cd7139e34b725906efbb60122c0d
SHA512648a7da0bcda6ccd31b4d6cdc1c90c3bc3c11023fcceb569f1972b8f6ab8f92452d1a80205038edcf409669265b6756ba0da6b1a734bd1ae4b6c527bbebb8757
-
Filesize
1.3MB
MD58be215abf1f36aa3d23555a671e7e3be
SHA1547d59580b7843f90aaca238012a8a0c886330e6
SHA25683f332ea9535814f18be4ee768682ecc7720794aedc30659eb165e46257a7cae
SHA51238cf4aea676dacd2e719833ca504ac8751a5fe700214ff4ac2b77c0542928a6a1aa3780ed7418387affed67ab6be97f1439633249af22d62e075c1cdfdf5449b
-
Filesize
584KB
-
Filesize
3.3MB
-
Filesize
5.6MB
-
Filesize
320KB
-
Filesize
136KB
-
Filesize
7.7MB
-
Filesize
704KB
-
Filesize
4KB
-
Filesize
392KB
-
Filesize
4KB
-
Filesize
304KB
-
Filesize
7.7MB
-
Filesize
1.8MB
-
Filesize
132KB
-
Filesize
240KB
-
Filesize
408KB
-
Filesize
488KB
-
Filesize
80KB
-
Filesize
7.7MB