Overview
overview
7Static
static
3Zorara.zip
windows11-21h2-x64
7Microsoft....re.dll
windows11-21h2-x64
1Microsoft....ms.dll
windows11-21h2-x64
1Microsoft....pf.dll
windows11-21h2-x64
1Newtonsoft.Json.dll
windows11-21h2-x64
1Zorara.dll
windows11-21h2-x64
5ZoraraUI.exe
windows11-21h2-x64
1ZoraraUI.exe
windows11-21h2-x64
6bin/Monaco/index.html
windows11-21h2-x64
6bin/Monaco...ain.js
windows11-21h2-x64
3bin/Monaco...lua.js
windows11-21h2-x64
3bin/Monaco...ain.js
windows11-21h2-x64
3bin/Monaco....de.js
windows11-21h2-x64
3bin/Monaco....es.js
windows11-21h2-x64
3bin/Monaco....fr.js
windows11-21h2-x64
3bin/Monaco....it.js
windows11-21h2-x64
3bin/Monaco....ja.js
windows11-21h2-x64
3bin/Monaco...nls.js
windows11-21h2-x64
3bin/Monaco....ko.js
windows11-21h2-x64
3bin/Monaco....ru.js
windows11-21h2-x64
3bin/Monaco...-cn.js
windows11-21h2-x64
3bin/Monaco...-tw.js
windows11-21h2-x64
3bin/Monaco...der.js
windows11-21h2-x64
3bin/editor.js
windows11-21h2-x64
3libcrypto-3-x64.dll
windows11-21h2-x64
1libssl-3-x64.dll
windows11-21h2-x64
1runtimes/w...er.dll
windows11-21h2-x64
1runtimes/w...er.dll
windows11-21h2-x64
1runtimes/w...er.dll
windows11-21h2-x64
3scripts/IY.js
windows11-21h2-x64
3scripts/UNCTest.js
windows11-21h2-x64
3scripts/unnamedesp.js
windows11-21h2-x64
3Analysis
-
max time kernel
91s -
max time network
97s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
09/11/2024, 21:03
Static task
static1
Behavioral task
behavioral1
Sample
Zorara.zip
Resource
win11-20241007-en
Behavioral task
behavioral2
Sample
Microsoft.Web.WebView2.Core.dll
Resource
win11-20241007-en
Behavioral task
behavioral3
Sample
Microsoft.Web.WebView2.WinForms.dll
Resource
win11-20241007-en
Behavioral task
behavioral4
Sample
Microsoft.Web.WebView2.Wpf.dll
Resource
win11-20241007-en
Behavioral task
behavioral5
Sample
Newtonsoft.Json.dll
Resource
win11-20241007-en
Behavioral task
behavioral6
Sample
Zorara.dll
Resource
win11-20241007-en
Behavioral task
behavioral7
Sample
ZoraraUI.exe
Resource
win11-20241007-en
Behavioral task
behavioral8
Sample
ZoraraUI.exe
Resource
win11-20241007-en
Behavioral task
behavioral9
Sample
bin/Monaco/index.html
Resource
win11-20241007-en
Behavioral task
behavioral10
Sample
bin/Monaco/vs/base/worker/workerMain.js
Resource
win11-20241007-en
Behavioral task
behavioral11
Sample
bin/Monaco/vs/basic-languages/lua/lua.js
Resource
win11-20241007-en
Behavioral task
behavioral12
Sample
bin/Monaco/vs/editor/editor.main.js
Resource
win11-20241023-en
Behavioral task
behavioral13
Sample
bin/Monaco/vs/editor/editor.main.nls.de.js
Resource
win11-20241007-en
Behavioral task
behavioral14
Sample
bin/Monaco/vs/editor/editor.main.nls.es.js
Resource
win11-20241007-en
Behavioral task
behavioral15
Sample
bin/Monaco/vs/editor/editor.main.nls.fr.js
Resource
win11-20241007-en
Behavioral task
behavioral16
Sample
bin/Monaco/vs/editor/editor.main.nls.it.js
Resource
win11-20241007-en
Behavioral task
behavioral17
Sample
bin/Monaco/vs/editor/editor.main.nls.ja.js
Resource
win11-20241007-en
Behavioral task
behavioral18
Sample
bin/Monaco/vs/editor/editor.main.nls.js
Resource
win11-20241007-en
Behavioral task
behavioral19
Sample
bin/Monaco/vs/editor/editor.main.nls.ko.js
Resource
win11-20241007-en
Behavioral task
behavioral20
Sample
bin/Monaco/vs/editor/editor.main.nls.ru.js
Resource
win11-20241007-en
Behavioral task
behavioral21
Sample
bin/Monaco/vs/editor/editor.main.nls.zh-cn.js
Resource
win11-20241007-en
Behavioral task
behavioral22
Sample
bin/Monaco/vs/editor/editor.main.nls.zh-tw.js
Resource
win11-20241023-en
Behavioral task
behavioral23
Sample
bin/Monaco/vs/loader.js
Resource
win11-20241007-en
Behavioral task
behavioral24
Sample
bin/editor.js
Resource
win11-20241007-en
Behavioral task
behavioral25
Sample
libcrypto-3-x64.dll
Resource
win11-20241007-en
Behavioral task
behavioral26
Sample
libssl-3-x64.dll
Resource
win11-20241007-en
Behavioral task
behavioral27
Sample
runtimes/win-arm64/native/WebView2Loader.dll
Resource
win11-20241007-en
Behavioral task
behavioral28
Sample
runtimes/win-x64/native/WebView2Loader.dll
Resource
win11-20241007-en
Behavioral task
behavioral29
Sample
runtimes/win-x86/native/WebView2Loader.dll
Resource
win11-20241007-en
Behavioral task
behavioral30
Sample
scripts/IY.js
Resource
win11-20241007-en
Behavioral task
behavioral31
Sample
scripts/UNCTest.js
Resource
win11-20241007-en
Behavioral task
behavioral32
Sample
scripts/unnamedesp.js
Resource
win11-20241007-en
General
-
Target
runtimes/win-x86/native/WebView2Loader.dll
-
Size
113KB
-
MD5
a362185b50f302563ef03ee1cbf68fd2
-
SHA1
2c68639cb53fc995d38ba632e77b6a2abf2c7f51
-
SHA256
cd5bd9cf068c312ecc6ce09e1c413b68ba12393581ae3869daef6b22f70a0cd6
-
SHA512
16660e2f6e9d7b633256b00b7425ae6887080f776a83b28d2bf8af4e15988645dbaeea71df701d45c63a40d72e5565c1ba8e38ae3676a7503521867395166f4b
-
SSDEEP
3072:UqTt9WJtX8ri9f2+DP6zmDgqeNZPTjREtJhAlCH3gf4fmzn:Ui9WJtswdSzX9EtJ6Yg2mT
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2904 884 WerFault.exe 77 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3432 wrote to memory of 884 3432 rundll32.exe 77 PID 3432 wrote to memory of 884 3432 rundll32.exe 77 PID 3432 wrote to memory of 884 3432 rundll32.exe 77
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\runtimes\win-x86\native\WebView2Loader.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\runtimes\win-x86\native\WebView2Loader.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:884 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 4483⤵
- Program crash
PID:2904
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 884 -ip 8841⤵PID:4348