Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231130-en -
resource tags
-
submitted
11/12/2023, 04:19
General
-
Target
SecuriteInfo.com.Win64.TrojanX-gen.32623.1958.exe
-
Size
5KB
-
MD5
8b95800de56f2a64f7b7cd95e86dd589
-
SHA1
3a686e8fb346f6e7ad07b2fb10fea1faaed887bd
-
SHA256
d0f93d98529b19fc436ea00567f23e9e012d440669b8e728e17d8d8e20a147cd
-
SHA512
35d3e9b4a18e118e0879f09c6ce9cb17cdb7f8af37e8b55858f331755a5f8fee71939a2e25ba0e152f353d4f434ae8f82e91fcbf2f6af892af6739451724b099
-
SSDEEP
96:yLuDs+WNUUrytGdcsq+kdk4uo5tdf2zNt:yi3u+Ecmf4PPQ
Malware Config
Signatures
-
Detect ZGRat V1 34 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.TrojanX-gen.32623.1958.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.TrojanX-gen.32623.1958.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.TrojanX-gen.32623.1958.exeC:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.TrojanX-gen.32623.1958.exe2⤵
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD5ad959160c024981e11e38f3d70102df1
SHA1342dabe112d8f7a11848a201d68104cfc12cd03e
SHA256c27f7569d4b7d221d3f18a8214b2f4eaee6c788180ef6d4651ddc672a4c0416a
SHA512583c20ad9dfa39f4803d6ee40959228ac38c7acdab57d6f6920e3cf786cc07ed31f287d9a7fb7c5a73f8d6caf0f36c8a0a91015d38ef6cdc3a5a30b7a92a8f41
-
Filesize
32KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
304KB
-
Filesize
1024KB
-
Filesize
9.9MB
-
Filesize
1.0MB
-
Filesize
512KB
-
Filesize
9.9MB
-
Filesize
904KB
-
Filesize
32KB
-
Filesize
632KB
-
Filesize
2.1MB
-
Filesize
9.9MB
-
Filesize
432KB
-
Filesize
488KB
-
Filesize
148KB
-
Filesize
9.9MB