Analysis
- max time kernel
142s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20231020-en - resource tags
- submitted
16/11/2023, 03:51
General
- Target 5768eba6718c932e9caa87170c71edebe36888bc125a811ed59b7ec829f624f9.exe
- Size 7.9MB
- Sample231116-eezg7afe38
- SHA256 5768eba6718c932e9caa87170c71edebe36888bc125a811ed59b7ec829f624f9
Score
10/10
Malware Config
Signatures
- Detect ZGRat V1 1 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5768eba6718c932e9caa87170c71edebe36888bc125a811ed59b7ec829f624f9.exe"C:\Users\Admin\AppData\Local\Temp\5768eba6718c932e9caa87170c71edebe36888bc125a811ed59b7ec829f624f9.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2148-0-0x000001D98D120000-0x000001D98D90A000-memory.dmp
memory/2148-1-0x00007FF97C390000-0x00007FF97CE51000-memory.dmp
memory/2148-2-0x000001D9A7FF0000-0x000001D9A8000000-memory.dmp
memory/2148-3-0x000001D9A8100000-0x000001D9A870C000-memory.dmp
memory/2148-4-0x000001D98DEA0000-0x000001D98DEEC000-memory.dmp
memory/2148-5-0x000001D98DEF0000-0x000001D98DEF8000-memory.dmp
memory/2148-6-0x00007FF97C390000-0x00007FF97CE51000-memory.dmp