Edit tour
Windows
Analysis Report
Celery.exe
Overview
General Information
| Sample name: | Celery.exe |
| Analysis ID: | 1432517 |
| MD5: | 42c32b8ee377ce3bcf36f51fb7bc93a8 |
| SHA1: | 819d0926c93704884a882967d820d6f753732d37 |
| SHA256: | c91c0745dcd02dbffa34747dd26e85e3e124a62d0812c125b6bc67792b66c8dc |
| Tags: | exe |
| Infos: |   |
 | |
Detection
PureLog Stealer, RedLine, zgRAT
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Search for Antivirus process
Yara detected PureLog Stealer
Yara detected RedLine Stealer
Yara detected zgRAT
Drops PE files with a suspicious file extension
Drops large PE files
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Writes to foreign memory regions
Allocates memory with a write watch (potentially for evading sandboxes)
Contains functionality for read data from the clipboard
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to launch a program with higher privileges
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to shutdown / reboot the system
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a DirectInput object (often for capturing keystrokes)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
File is packed with WinRar
Found dropped PE file which has not been started or loaded
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sigma detected: Execution of Suspicious File Type Extension
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Yara signature match
Classification
- System is w10x64
Celery.exe (PID: 5608 cmdline: "C:\Users\ user\Deskt op\Celery. exe" MD5: 42C32B8EE377CE3BCF36F51FB7BC93A8) 
Celery V3.exe (PID: 7012 cmdline: "C:\Users\ user\AppDa ta\Local\T emp\RarSFX 0\Celery V 3.exe" MD5: 06E7DDAE83EEE00448A508F9BADAB598) 
cmd.exe (PID: 5964 cmdline: "C:\Window s\System32 \cmd.exe" /c move Ea rned Earne d.cmd && E arned.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 5436 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
tasklist.exe (PID: 3592 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1) - findstr.exe (PID: 7036 cmdline:
findstr /I "wrsa.exe opssvc.ex e" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E) - tasklist.exe (PID: 928 cmdline:
tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1) - findstr.exe (PID: 5500 cmdline:
findstr /I "avastui. exe avgui. exe nswscs vc.exe sop hoshealth. exe" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E) - cmd.exe (PID: 7116 cmdline:
cmd /c md 1101 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - findstr.exe (PID: 1396 cmdline:
findstr /V "Calculat ionsExpedi aJumpExcha nges" Appl ication MD5: F1D4BE0E99EC734376FDE474A8D4EA3E) - cmd.exe (PID: 6608 cmdline:
cmd /c cop y /b Trial s + Explai ns + Exter nal + Figh ting + Get + Rights 1101\z MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) 
Spy.pif (PID: 6816 cmdline: 1101\Spy.p if 1101\z MD5: 6EE7DDEBFF0A2B78C7AC30F6E00D1D11) - RegAsm.exe (PID: 6120 cmdline:
C:\Users\u ser\AppDat a\Local\Mi crosoft\Wi ndows\INet Cache\1101 \RegAsm.ex e MD5: 0D5DF43AF2916F47D00C1573797C1A13) - conhost.exe (PID: 2700 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - PING.EXE (PID: 1856 cmdline:
ping -n 5 127.0.0.1 MD5: B3624DD758CCECF93A1226CEF252CA12)
- cleanup
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| RedLine Stealer | RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer. | No Attribution |
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| zgRAT | zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on. | No Attribution |
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_PureLogStealer | Yara detected PureLog Stealer | Joe Security | ||
| JoeSecurity_RedLine | Yara detected RedLine Stealer | Joe Security |
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_zgRAT_1 | Yara detected zgRAT | Joe Security | ||
| JoeSecurity_PureLogStealer | Yara detected PureLog Stealer | Joe Security | ||
| JoeSecurity_RedLine | Yara detected RedLine Stealer | Joe Security | ||
| MALWARE_Win_zgRAT | Detects zgRAT | ditekSHen |
|
System Summary |   |
|---|
| Source: | Author: Oleg Kolesnikov @securonix invrep_de, oscd.community, Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems): | ||
| Source: | Author: Max Altgelt (Nextron Systems): | ||
HIPS / PFW / Operating System Protection Evasion | |
|---|
| Source: | Author: Joe Security: | ||
⊘No Snort rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection | |
|---|
| Source: | Virustotal: | Perma Link | ||
| Source: | Virustotal: | Perma Link | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||