Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
20/10/2024, 21:52
General
- Target Z_y_x.exe
- Size 1.2MB
- Sample241020-1rd8nstfnl
- SHA256 7e15567c88d2ff2677f19fcb64c3814851f8433e819f57f550c1c82bc787468c
Malware Config
Signatures
- AdWind
A Java-based RAT family operated as malware-as-a-service.
- Class file contains resources related to AdWind 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Z_y_x.exe"C:\Users\Admin\AppData\Local\Temp\Z_y_x.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\Zelo-Client.jar"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1729461169361.tmp3⤵
- Views/modifies file attributes
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1729461169361.tmp" /f"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1729461169361.tmp" /f4⤵
- Adds Run key to start application
-
-
-
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\dawaw.jar"2⤵
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
Zelo-Client.jar
dawaw.jar
memory/1040-1-0x0000000000BF0000-0x0000000000D2E000-memory.dmp
memory/1040-3-0x00007FFA287E0000-0x00007FFA292A1000-memory.dmp
memory/1040-0-0x00007FFA287E3000-0x00007FFA287E5000-memory.dmp
memory/1040-16-0x00007FFA287E0000-0x00007FFA292A1000-memory.dmp
memory/1372-67-0x00000163F1CA0000-0x00000163F1CA1000-memory.dmp
memory/1372-15-0x0000016380000000-0x0000016380270000-memory.dmp
memory/1372-41-0x00000163F1CA0000-0x00000163F1CA1000-memory.dmp
memory/1372-89-0x0000016380000000-0x0000016380270000-memory.dmp
memory/1372-71-0x00000163F1CA0000-0x00000163F1CA1000-memory.dmp
memory/3296-106-0x0000028B0B730000-0x0000028B0B731000-memory.dmp
memory/3296-131-0x0000028B0B730000-0x0000028B0B731000-memory.dmp
memory/3296-77-0x0000028B0B730000-0x0000028B0B731000-memory.dmp
memory/3296-78-0x0000028B0B730000-0x0000028B0B731000-memory.dmp
memory/3296-79-0x0000028B0B730000-0x0000028B0B731000-memory.dmp
memory/3296-83-0x0000028B0B750000-0x0000028B0B9C0000-memory.dmp
memory/3296-85-0x0000028B0B730000-0x0000028B0B731000-memory.dmp
memory/3296-40-0x0000028B0B730000-0x0000028B0B731000-memory.dmp
memory/3296-104-0x0000028B0B730000-0x0000028B0B731000-memory.dmp
memory/3296-105-0x0000028B0B730000-0x0000028B0B731000-memory.dmp
memory/3296-10-0x0000028B0B750000-0x0000028B0B9C0000-memory.dmp
memory/3296-109-0x0000028B0B730000-0x0000028B0B731000-memory.dmp
memory/3296-112-0x0000028B0B730000-0x0000028B0B731000-memory.dmp
memory/3296-115-0x0000028B0B730000-0x0000028B0B731000-memory.dmp
memory/3296-117-0x0000028B0B730000-0x0000028B0B731000-memory.dmp
memory/3296-122-0x0000028B0B730000-0x0000028B0B731000-memory.dmp
memory/3296-128-0x0000028B0B730000-0x0000028B0B731000-memory.dmp
memory/3296-68-0x0000028B0B730000-0x0000028B0B731000-memory.dmp
memory/3296-132-0x0000028B0B730000-0x0000028B0B731000-memory.dmp
memory/3296-133-0x0000028B0B730000-0x0000028B0B731000-memory.dmp
memory/3296-136-0x0000028B0B730000-0x0000028B0B731000-memory.dmp
memory/3296-138-0x0000028B0B730000-0x0000028B0B731000-memory.dmp
memory/3296-146-0x0000028B0B730000-0x0000028B0B731000-memory.dmp
memory/3296-151-0x0000028B0B730000-0x0000028B0B731000-memory.dmp
memory/3296-152-0x0000028B0B730000-0x0000028B0B731000-memory.dmp
memory/3296-153-0x0000028B0B730000-0x0000028B0B731000-memory.dmp
memory/3296-156-0x0000028B0B730000-0x0000028B0B731000-memory.dmp
memory/3296-158-0x0000028B0B730000-0x0000028B0B731000-memory.dmp
memory/3296-161-0x0000028B0B730000-0x0000028B0B731000-memory.dmp
memory/3296-163-0x0000028B0B730000-0x0000028B0B731000-memory.dmp
memory/3296-166-0x0000028B0B730000-0x0000028B0B731000-memory.dmp
memory/3296-168-0x0000028B0B730000-0x0000028B0B731000-memory.dmp
memory/3296-171-0x0000028B0B730000-0x0000028B0B731000-memory.dmp
memory/3296-173-0x0000028B0B730000-0x0000028B0B731000-memory.dmp