Analysis
-
max time kernel
118s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13-05-2024 22:34
Static task
static1
Behavioral task
behavioral1
Sample
leadiadequatepro.exe
Resource
win10v2004-20240226-en
General
-
Target
leadiadequatepro.exe
-
Size
14.1MB
-
MD5
b149f82964b1e269ade2686612a9e777
-
SHA1
9ccccc1fe6c947dcbc779624ffa9a0fd1b7e7790
-
SHA256
9f2c70239fe518552ee44423564b075a85e0fc1e7bd80dc233bcc1f882ffceb9
-
SHA512
5c07589d51c21310415fb2fd616ac6fe23b1ec7e26007b6a3d2ce948bcbc3613db14bbc5686f5f352fb614cea00b3af657d1d6a9e2a078c3487d345d145ec2c9
-
SSDEEP
393216:FwI5aqRbG66MMgLaDArf6tY5yParKZwVgIZlds:FwSHLyMytYYP8KZwKI
Malware Config
Extracted
meduza
109.107.181.83
Signatures
-
Detect ZGRat V1 35 IoCs
Processes:
resource yara_rule behavioral1/memory/696-10-0x00000253809F0000-0x0000025380C6E000-memory.dmp family_zgrat_v1 behavioral1/memory/696-14-0x00000253809F0000-0x0000025380C69000-memory.dmp family_zgrat_v1 behavioral1/memory/696-12-0x00000253809F0000-0x0000025380C69000-memory.dmp family_zgrat_v1 behavioral1/memory/696-11-0x00000253809F0000-0x0000025380C69000-memory.dmp family_zgrat_v1 behavioral1/memory/696-26-0x00000253809F0000-0x0000025380C69000-memory.dmp family_zgrat_v1 behavioral1/memory/696-68-0x00000253809F0000-0x0000025380C69000-memory.dmp family_zgrat_v1 behavioral1/memory/696-72-0x00000253809F0000-0x0000025380C69000-memory.dmp family_zgrat_v1 behavioral1/memory/696-74-0x00000253809F0000-0x0000025380C69000-memory.dmp family_zgrat_v1 behavioral1/memory/696-70-0x00000253809F0000-0x0000025380C69000-memory.dmp family_zgrat_v1 behavioral1/memory/696-66-0x00000253809F0000-0x0000025380C69000-memory.dmp family_zgrat_v1 behavioral1/memory/696-64-0x00000253809F0000-0x0000025380C69000-memory.dmp family_zgrat_v1 behavioral1/memory/696-62-0x00000253809F0000-0x0000025380C69000-memory.dmp family_zgrat_v1 behavioral1/memory/696-60-0x00000253809F0000-0x0000025380C69000-memory.dmp family_zgrat_v1 behavioral1/memory/696-58-0x00000253809F0000-0x0000025380C69000-memory.dmp family_zgrat_v1 behavioral1/memory/696-56-0x00000253809F0000-0x0000025380C69000-memory.dmp family_zgrat_v1 behavioral1/memory/696-54-0x00000253809F0000-0x0000025380C69000-memory.dmp family_zgrat_v1 behavioral1/memory/696-50-0x00000253809F0000-0x0000025380C69000-memory.dmp family_zgrat_v1 behavioral1/memory/696-48-0x00000253809F0000-0x0000025380C69000-memory.dmp family_zgrat_v1 behavioral1/memory/696-46-0x00000253809F0000-0x0000025380C69000-memory.dmp family_zgrat_v1 behavioral1/memory/696-44-0x00000253809F0000-0x0000025380C69000-memory.dmp family_zgrat_v1 behavioral1/memory/696-52-0x00000253809F0000-0x0000025380C69000-memory.dmp family_zgrat_v1 behavioral1/memory/696-42-0x00000253809F0000-0x0000025380C69000-memory.dmp family_zgrat_v1 behavioral1/memory/696-40-0x00000253809F0000-0x0000025380C69000-memory.dmp family_zgrat_v1 behavioral1/memory/696-38-0x00000253809F0000-0x0000025380C69000-memory.dmp family_zgrat_v1 behavioral1/memory/696-36-0x00000253809F0000-0x0000025380C69000-memory.dmp family_zgrat_v1 behavioral1/memory/696-34-0x00000253809F0000-0x0000025380C69000-memory.dmp family_zgrat_v1 behavioral1/memory/696-32-0x00000253809F0000-0x0000025380C69000-memory.dmp family_zgrat_v1 behavioral1/memory/696-31-0x00000253809F0000-0x0000025380C69000-memory.dmp family_zgrat_v1 behavioral1/memory/696-24-0x00000253809F0000-0x0000025380C69000-memory.dmp family_zgrat_v1 behavioral1/memory/696-22-0x00000253809F0000-0x0000025380C69000-memory.dmp family_zgrat_v1 behavioral1/memory/696-20-0x00000253809F0000-0x0000025380C69000-memory.dmp family_zgrat_v1 behavioral1/memory/696-18-0x00000253809F0000-0x0000025380C69000-memory.dmp family_zgrat_v1 behavioral1/memory/696-28-0x00000253809F0000-0x0000025380C69000-memory.dmp family_zgrat_v1 behavioral1/memory/696-16-0x00000253809F0000-0x0000025380C69000-memory.dmp family_zgrat_v1 behavioral1/memory/812-4925-0x0000000009290000-0x0000000009546000-memory.dmp family_zgrat_v1 -
Meduza Stealer payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1892-4901-0x0000000140000000-0x00000001400E8000-memory.dmp family_meduza -
Executes dropped EXE 2 IoCs
Processes:
leadadequate.exeleadiadequate.exepid process 696 leadadequate.exe 812 leadiadequate.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
leadiadequatepro.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" leadiadequatepro.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 56 api.ipify.org 57 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
leadadequate.exedescription pid process target process PID 696 set thread context of 1892 696 leadadequate.exe InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 892 powershell.exe 892 powershell.exe 892 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
leadadequate.exepowershell.exedescription pid process Token: SeDebugPrivilege 696 leadadequate.exe Token: SeDebugPrivilege 696 leadadequate.exe Token: SeDebugPrivilege 892 powershell.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
leadiadequatepro.exeleadadequate.exedescription pid process target process PID 2512 wrote to memory of 696 2512 leadiadequatepro.exe leadadequate.exe PID 2512 wrote to memory of 696 2512 leadiadequatepro.exe leadadequate.exe PID 696 wrote to memory of 1892 696 leadadequate.exe InstallUtil.exe PID 696 wrote to memory of 1892 696 leadadequate.exe InstallUtil.exe PID 696 wrote to memory of 1892 696 leadadequate.exe InstallUtil.exe PID 696 wrote to memory of 1892 696 leadadequate.exe InstallUtil.exe PID 696 wrote to memory of 1892 696 leadadequate.exe InstallUtil.exe PID 696 wrote to memory of 1892 696 leadadequate.exe InstallUtil.exe PID 696 wrote to memory of 1892 696 leadadequate.exe InstallUtil.exe PID 696 wrote to memory of 1892 696 leadadequate.exe InstallUtil.exe PID 696 wrote to memory of 1892 696 leadadequate.exe InstallUtil.exe PID 696 wrote to memory of 1892 696 leadadequate.exe InstallUtil.exe PID 696 wrote to memory of 1892 696 leadadequate.exe InstallUtil.exe PID 696 wrote to memory of 892 696 leadadequate.exe powershell.exe PID 696 wrote to memory of 892 696 leadadequate.exe powershell.exe PID 2512 wrote to memory of 812 2512 leadiadequatepro.exe leadiadequate.exe PID 2512 wrote to memory of 812 2512 leadiadequatepro.exe leadiadequate.exe PID 2512 wrote to memory of 812 2512 leadiadequatepro.exe leadiadequate.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\leadiadequatepro.exe"C:\Users\Admin\AppData\Local\Temp\leadiadequatepro.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\leadadequate.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\leadadequate.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Start-Sleep -Seconds 5; Remove-Item -Path 'C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\leadadequate.exe' -Force3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\leadiadequate.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\leadiadequate.exe2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1400 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\leadadequate.exeFilesize
14.6MB
MD5938ea9e68b80a685337ed40667037a21
SHA1520a3984265c13d4f289eb162f5a25108a9b7d9c
SHA2562cbf1a9a727ec04dc73f38be06befd8e3d162346807afb95ae1189cbd8376a19
SHA512e756f76dca6a6aacb7b5e1b017be4d583890c13f41059f3a4a5da24733f0b141c7d074a5a4b032275b03bac331c628f008d0178e85e53d348d506a8c50255c50
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\leadiadequate.exeFilesize
16.4MB
MD540f6d61aae921cc7ec31836a7fac3c2a
SHA1fcb93eb39a221d68978f3943acba0699e032a16c
SHA256e8cabc3a065dd38f596cfc67ae3231dc728a35125b2d1677c73b3682dcaa9b29
SHA51222cb185a1f492d4d695702605a26f4b8ad154b0a6130297cbb705462043dee7d07e85f9f8637381e574e8f7970d747ff7ab136ebc1c01a5695eef5df84dee6db
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hap2g5ed.gfx.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/696-7-0x00007FF97B673000-0x00007FF97B675000-memory.dmpFilesize
8KB
-
memory/696-8-0x00000253E4AC0000-0x00000253E5964000-memory.dmpFilesize
14.6MB
-
memory/696-9-0x00007FF97B670000-0x00007FF97C131000-memory.dmpFilesize
10.8MB
-
memory/696-10-0x00000253809F0000-0x0000025380C6E000-memory.dmpFilesize
2.5MB
-
memory/696-14-0x00000253809F0000-0x0000025380C69000-memory.dmpFilesize
2.5MB
-
memory/696-12-0x00000253809F0000-0x0000025380C69000-memory.dmpFilesize
2.5MB
-
memory/696-11-0x00000253809F0000-0x0000025380C69000-memory.dmpFilesize
2.5MB
-
memory/696-26-0x00000253809F0000-0x0000025380C69000-memory.dmpFilesize
2.5MB
-
memory/696-68-0x00000253809F0000-0x0000025380C69000-memory.dmpFilesize
2.5MB
-
memory/696-72-0x00000253809F0000-0x0000025380C69000-memory.dmpFilesize
2.5MB
-
memory/696-74-0x00000253809F0000-0x0000025380C69000-memory.dmpFilesize
2.5MB
-
memory/696-70-0x00000253809F0000-0x0000025380C69000-memory.dmpFilesize
2.5MB
-
memory/696-66-0x00000253809F0000-0x0000025380C69000-memory.dmpFilesize
2.5MB
-
memory/696-64-0x00000253809F0000-0x0000025380C69000-memory.dmpFilesize
2.5MB
-
memory/696-62-0x00000253809F0000-0x0000025380C69000-memory.dmpFilesize
2.5MB
-
memory/696-60-0x00000253809F0000-0x0000025380C69000-memory.dmpFilesize
2.5MB
-
memory/696-58-0x00000253809F0000-0x0000025380C69000-memory.dmpFilesize
2.5MB
-
memory/696-56-0x00000253809F0000-0x0000025380C69000-memory.dmpFilesize
2.5MB
-
memory/696-54-0x00000253809F0000-0x0000025380C69000-memory.dmpFilesize
2.5MB
-
memory/696-50-0x00000253809F0000-0x0000025380C69000-memory.dmpFilesize
2.5MB
-
memory/696-48-0x00000253809F0000-0x0000025380C69000-memory.dmpFilesize
2.5MB
-
memory/696-46-0x00000253809F0000-0x0000025380C69000-memory.dmpFilesize
2.5MB
-
memory/696-44-0x00000253809F0000-0x0000025380C69000-memory.dmpFilesize
2.5MB
-
memory/696-52-0x00000253809F0000-0x0000025380C69000-memory.dmpFilesize
2.5MB
-
memory/696-42-0x00000253809F0000-0x0000025380C69000-memory.dmpFilesize
2.5MB
-
memory/696-40-0x00000253809F0000-0x0000025380C69000-memory.dmpFilesize
2.5MB
-
memory/696-38-0x00000253809F0000-0x0000025380C69000-memory.dmpFilesize
2.5MB
-
memory/696-36-0x00000253809F0000-0x0000025380C69000-memory.dmpFilesize
2.5MB
-
memory/696-34-0x00000253809F0000-0x0000025380C69000-memory.dmpFilesize
2.5MB
-
memory/696-32-0x00000253809F0000-0x0000025380C69000-memory.dmpFilesize
2.5MB
-
memory/696-31-0x00000253809F0000-0x0000025380C69000-memory.dmpFilesize
2.5MB
-
memory/696-24-0x00000253809F0000-0x0000025380C69000-memory.dmpFilesize
2.5MB
-
memory/696-22-0x00000253809F0000-0x0000025380C69000-memory.dmpFilesize
2.5MB
-
memory/696-20-0x00000253809F0000-0x0000025380C69000-memory.dmpFilesize
2.5MB
-
memory/696-18-0x00000253809F0000-0x0000025380C69000-memory.dmpFilesize
2.5MB
-
memory/696-28-0x00000253809F0000-0x0000025380C69000-memory.dmpFilesize
2.5MB
-
memory/696-16-0x00000253809F0000-0x0000025380C69000-memory.dmpFilesize
2.5MB
-
memory/696-4891-0x00007FF97B670000-0x00007FF97C131000-memory.dmpFilesize
10.8MB
-
memory/696-4892-0x0000025380CA0000-0x0000025380D5A000-memory.dmpFilesize
744KB
-
memory/696-4893-0x0000025380D60000-0x0000025380DAC000-memory.dmpFilesize
304KB
-
memory/696-4894-0x00007FF97B673000-0x00007FF97B675000-memory.dmpFilesize
8KB
-
memory/696-4895-0x00007FF97B670000-0x00007FF97C131000-memory.dmpFilesize
10.8MB
-
memory/696-4897-0x0000025380FB0000-0x0000025381004000-memory.dmpFilesize
336KB
-
memory/696-4903-0x00007FF97B670000-0x00007FF97C131000-memory.dmpFilesize
10.8MB
-
memory/812-4923-0x00000000004A0000-0x0000000001508000-memory.dmpFilesize
16.4MB
-
memory/812-4924-0x0000000005E90000-0x0000000005F22000-memory.dmpFilesize
584KB
-
memory/812-4925-0x0000000009290000-0x0000000009546000-memory.dmpFilesize
2.7MB
-
memory/812-4928-0x0000000009B00000-0x000000000A0A4000-memory.dmpFilesize
5.6MB
-
memory/892-4909-0x00000199D1200000-0x00000199D1222000-memory.dmpFilesize
136KB
-
memory/1892-4901-0x0000000140000000-0x00000001400E8000-memory.dmpFilesize
928KB