Analysis
-
max time kernel
191s -
max time network
201s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
12/10/2023, 11:16
General
-
Target
a22f38c26dc96fa285efd4c0732a22e9bb81b105ad65c75c609a478dd551ac13.exe
-
Size
628KB
-
MD5
1173a1f0469d241b02c1d57dc29cdf4d
-
SHA1
b789fd20e546ce3da045f30ae4ca5d02f260cc68
-
SHA256
a22f38c26dc96fa285efd4c0732a22e9bb81b105ad65c75c609a478dd551ac13
-
SHA512
ca7fa41e3fe0812231ffdaad853534327bbad987c31b7431debc17a2ee042fab1339d01d8a1ba5cc054248e4276337bf3cf770a6862fc001f36bc50af1934498
-
SSDEEP
12288:i8VYM4g/lRdZYbcyqeI9ZPH7H7sxIhDJsCeuR8mmTKfut:RB3RvGoJHEkNsPuKmmT
Score
10/10
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\a22f38c26dc96fa285efd4c0732a22e9bb81b105ad65c75c609a478dd551ac13.exe"C:\Users\Admin\AppData\Local\Temp\a22f38c26dc96fa285efd4c0732a22e9bb81b105ad65c75c609a478dd551ac13.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
648KB
-
Filesize
1024KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
344KB
-
Filesize
304KB
-
Filesize
336KB
-
Filesize
10.8MB