General
-
Target
DLL Injector Resou_nls..scr
-
Size
571KB
-
Sample
231208-crtrcsaa5t
-
MD5
b6d15bc82d811c30d7e9633402bee9c2
-
SHA1
c6fd47a1e8bb385bbce699d1e51b947e7fe780e2
-
SHA256
8177a82bb9f46bb3a6b01b59eb6fbfc1bfebd9ba5147a5685ee49d6a9aa22002
-
SHA512
fd76972ec643a9456d6612b96ca9eabd8ee23d9371d379777cc4cc7b7b31953e23373f60844a2559bea70cde86e72e55af2a052f1608aeb130fbbbf3033a860c
-
SSDEEP
12288:o3ubKEsUNigEpgsI02qw67AjvhExMv3AO25aBcTA:aubKDgEpywweIAMohA
Behavioral task
behavioral1
Sample
DLL Injector Resou_nls..scr
Resource
win7-20231130-en
Behavioral task
behavioral2
Sample
DLL Injector Resou_nls..scr
Resource
win10v2004-20231201-en
Malware Config
Extracted
asyncrat
0.5.7B
441d
88.248.18.120:33918
sdf324
-
delay
3
-
install
false
-
install_file
da44rks.exe
-
install_folder
%AppData%
Extracted
asyncrat
0.5.7B
Winlogoew
46.1.103.124:2341
Winlogore
-
delay
3
-
install
false
-
install_file
Winlog
-
install_folder
%AppData%
Extracted
asyncrat
0.5.7B
Winlogoewg
46.1.103.124:9371
Winlogoreg
-
delay
3
-
install
false
-
install_file
Winloggg
-
install_folder
%AppData%
Targets
-
-
Target
DLL Injector Resou_nls..scr
-
Size
571KB
-
MD5
b6d15bc82d811c30d7e9633402bee9c2
-
SHA1
c6fd47a1e8bb385bbce699d1e51b947e7fe780e2
-
SHA256
8177a82bb9f46bb3a6b01b59eb6fbfc1bfebd9ba5147a5685ee49d6a9aa22002
-
SHA512
fd76972ec643a9456d6612b96ca9eabd8ee23d9371d379777cc4cc7b7b31953e23373f60844a2559bea70cde86e72e55af2a052f1608aeb130fbbbf3033a860c
-
SSDEEP
12288:o3ubKEsUNigEpgsI02qw67AjvhExMv3AO25aBcTA:aubKDgEpywweIAMohA
-
Detect ZGRat V1
-
Async RAT payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1