Overview
overview
6Static
static
3Microsoft....re.dll
windows7-x64
1Microsoft....re.dll
windows10-2004-x64
1Microsoft....ms.dll
windows7-x64
1Microsoft....ms.dll
windows10-2004-x64
1Microsoft....pf.dll
windows7-x64
1Microsoft....pf.dll
windows10-2004-x64
1Newtonsoft.Json.dll
windows7-x64
1Newtonsoft.Json.dll
windows10-2004-x64
1Zorara.dll
windows7-x64
5Zorara.dll
windows10-2004-x64
5ZoraraUI.exe
windows7-x64
1ZoraraUI.exe
windows10-2004-x64
1ZoraraUI.exe
windows7-x64
1ZoraraUI.exe
windows10-2004-x64
1bin/Monaco/index.html
windows7-x64
6bin/Monaco/index.html
windows10-2004-x64
6bin/Monaco...ain.js
windows7-x64
3bin/Monaco...ain.js
windows10-2004-x64
3bin/Monaco...lua.js
windows7-x64
3bin/Monaco...lua.js
windows10-2004-x64
3bin/Monaco...ain.js
windows7-x64
3bin/Monaco...ain.js
windows10-2004-x64
3bin/Monaco....de.js
windows7-x64
3bin/Monaco....de.js
windows10-2004-x64
3bin/Monaco....es.js
windows7-x64
3bin/Monaco....es.js
windows10-2004-x64
3bin/Monaco....fr.js
windows7-x64
3bin/Monaco....fr.js
windows10-2004-x64
3bin/Monaco....it.js
windows7-x64
3bin/Monaco....it.js
windows10-2004-x64
3bin/Monaco....ja.js
windows7-x64
3bin/Monaco....ja.js
windows10-2004-x64
3Analysis
- max time kernel
118s - max time network
123s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system - submitted
29/09/2024, 15:21
Static task
static1
Behavioral task
behavioral1
Sample
Microsoft.Web.WebView2.Core.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
Microsoft.Web.WebView2.Core.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Microsoft.Web.WebView2.WinForms.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral4
Sample
Microsoft.Web.WebView2.WinForms.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Microsoft.Web.WebView2.Wpf.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
Microsoft.Web.WebView2.Wpf.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Newtonsoft.Json.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
Newtonsoft.Json.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Zorara.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
Zorara.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
ZoraraUI.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral12
Sample
ZoraraUI.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
ZoraraUI.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
ZoraraUI.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
bin/Monaco/index.html
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
bin/Monaco/index.html
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
bin/Monaco/vs/base/worker/workerMain.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
bin/Monaco/vs/base/worker/workerMain.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
bin/Monaco/vs/basic-languages/lua/lua.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
bin/Monaco/vs/basic-languages/lua/lua.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
bin/Monaco/vs/editor/editor.main.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral22
Sample
bin/Monaco/vs/editor/editor.main.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
bin/Monaco/vs/editor/editor.main.nls.de.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral24
Sample
bin/Monaco/vs/editor/editor.main.nls.de.js
Resource
win10v2004-20240910-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
bin/Monaco/vs/editor/editor.main.nls.es.js
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral26
Sample
bin/Monaco/vs/editor/editor.main.nls.es.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
bin/Monaco/vs/editor/editor.main.nls.fr.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral28
Sample
bin/Monaco/vs/editor/editor.main.nls.fr.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
bin/Monaco/vs/editor/editor.main.nls.it.js
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral30
Sample
bin/Monaco/vs/editor/editor.main.nls.it.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
bin/Monaco/vs/editor/editor.main.nls.ja.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral32
Sample
bin/Monaco/vs/editor/editor.main.nls.ja.js
Resource
win10v2004-20240802-en
windows10-2004-x64
General
- Target Zorara.dll
- Size 14.2MB
- Sample240929-srfshazapq
- SHA256 439c9fc897dd7026df5b9579f45b712516b4b22f4ffe3324694202530e3ba23c
- MD5 e9f7a600f1c3c30e2ef9576bf7cea03b
- SHA1 700017e157bec2e9f72bceffcdeab36004a9c820
- SHA512 81606aa1d2c3d2e604c201bd7803e28f22a0e60f0fe9e6b05d16c2cb1dd9bea54649d2b15bd1b1187a62e5fb6644964e7274d21d50854e33312d017e050f7a3c
- SSDEEP 393216:i8kK1+g5u+l7ylz47SB1S9v1b7z2N+KJeRV:ic+cue08w+KJe
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1696 rundll32.exe 1696 rundll32.exe