Overview

overview

10

Static

static

3

SecuriteIn...99.exe

windows7-x64

10

SecuriteIn...99.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    10/12/2023, 16:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Win32.PWSX-gen.24784.25099.exe

  • Size

    855KB

  • MD5

    90163fb614066a7abaa99b48bed01214

  • SHA1

    0495152453a74a29cc4effcf06e34f6b5e0c0d99

  • SHA256

    43ef89e27ca9e14fe36f2626444fd52557aa7a62c59ce2dc13e8ec4bec2a7b7b

  • SHA512

    8b2ffb990b123f87003127a9b8afb39c428d6dbad6093110455d1b4a8839b7338900e1c86908a443cbee3d8f3cf7aeed3a6b1e06c435838744a30c5d554f8dbe

  • SSDEEP

    12288:IBgOWP6i6+LhhQ0aRj1AYB5I9sT8eOQ0QpD3Ly6KZMWT8+ObVUG1ZiNZ0YapLlwn:ICgTlBPfOwI65WT8+Ob7X/HxClsfrY

Score
10/10
zgratrat

Malware Config

Signatures

  • Detect ZGRat V1 1 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.24784.25099.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.24784.25099.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2000
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.24784.25099.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.24784.25099.exe"
      2⤵
        PID:2996
      • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.24784.25099.exe
        "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.24784.25099.exe"
        2⤵
          PID:3016
        • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.24784.25099.exe
          "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.24784.25099.exe"
          2⤵
            PID:2876
          • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.24784.25099.exe
            "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.24784.25099.exe"
            2⤵
              PID:2572
            • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.24784.25099.exe
              "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.24784.25099.exe"
              2⤵
                PID:1916

            Network

                  MITRE ATT&CK Matrix

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • memory/2000-0-0x0000000000390000-0x000000000046A000-memory.dmp

                    Filesize

                    872KB

                    Download

                  • memory/2000-1-0x0000000074C10000-0x00000000752FE000-memory.dmp

                    Filesize

                    6.9MB

                    Download

                  • memory/2000-2-0x0000000004F20000-0x0000000004F60000-memory.dmp

                    Filesize

                    256KB

                    Download

                  • memory/2000-3-0x0000000000630000-0x0000000000648000-memory.dmp

                    Filesize

                    96KB

                    Download

                  • memory/2000-4-0x0000000000350000-0x0000000000358000-memory.dmp

                    Filesize

                    32KB

                    Download

                  • memory/2000-5-0x0000000000380000-0x000000000038A000-memory.dmp

                    Filesize

                    40KB

                    Download

                  • memory/2000-6-0x000000000A2E0000-0x000000000A39E000-memory.dmp

                    Filesize

                    760KB

                    Download

                  • memory/2000-7-0x0000000074C10000-0x00000000752FE000-memory.dmp

                    Filesize

                    6.9MB

                    Download