Overview

overview

10

Static

static

3

SecuriteIn...46.exe

windows7-x64

10

SecuriteIn...46.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    11-12-2023 09:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Win32.PWSX-gen.22416.21846.exe

  • Size

    614KB

  • MD5

    534ada5dc43de51c86b758d10aa1b9ae

  • SHA1

    b3495d15c67904b4221628e99de6882e0ef5e637

  • SHA256

    b16a0aacd60385856b541ff2d1c01ea70bcaac5bb866083ca0f739268b800b50

  • SHA512

    8ceb9521201cdf925f14a5cade0535174f757a94eb7f3d5db0838e435a45375c15de76cd6e4002ee67e21a0b7648954db1bd2962f57915e98ce76593cb90748b

  • SSDEEP

    12288:u3IU8S6eUduix+CIh2c5dnY1JQWt+oCDFeEFwwPtjohbBc/X/E+2F0kKvRq:kItSAduix+CU2IYWFeXeUhtcv87yz0

Score
10/10
zgratrat

Malware Config

Signatures

  • Detect ZGRat V1 1 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22416.21846.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22416.21846.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2852
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\rBQuhEplCEs.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2652
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rBQuhEplCEs" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDF86.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2636
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22416.21846.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22416.21846.exe"
      2⤵
        PID:2520
      • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22416.21846.exe
        "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22416.21846.exe"
        2⤵
          PID:2708
        • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22416.21846.exe
          "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22416.21846.exe"
          2⤵
            PID:1368
          • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22416.21846.exe
            "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22416.21846.exe"
            2⤵
              PID:2628
            • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22416.21846.exe
              "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22416.21846.exe"
              2⤵
                PID:2604

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\tmpDF86.tmp
              Filesize

              1KB

              MD5

              324078b7648da70e60bd3b958b570ba1

              SHA1

              bce7dd4469e343f76136b9d8e1aaa26a19b4e01d

              SHA256

              c70d4b44872be9849c967bf6947cb6fc0125d940534b9766e6ab5f03a04154d2

              SHA512

              2af0c3f8e717a221687a8bf7b8ac9acdea451bb7bb84bacac9a68b9b58d1195ac9ff6cc7536869b01c61c005fd993984fd1e1f21c1837b3fe7032e1671ad0b2c

              Download Submit

            • memory/2652-19-0x000000006EE60000-0x000000006F40B000-memory.dmp

              Filesize

              5.7MB

              Download

            • memory/2652-18-0x00000000026C0000-0x0000000002700000-memory.dmp

              Filesize

              256KB

              Download

            • memory/2652-17-0x00000000026C0000-0x0000000002700000-memory.dmp

              Filesize

              256KB

              Download

            • memory/2652-16-0x000000006EE60000-0x000000006F40B000-memory.dmp

              Filesize

              5.7MB

              Download

            • memory/2652-14-0x000000006EE60000-0x000000006F40B000-memory.dmp

              Filesize

              5.7MB

              Download

            • memory/2852-3-0x0000000000410000-0x0000000000428000-memory.dmp

              Filesize

              96KB

              Download

            • memory/2852-6-0x00000000050E0000-0x000000000515A000-memory.dmp

              Filesize

              488KB

              Download

            • memory/2852-15-0x0000000074CF0000-0x00000000753DE000-memory.dmp

              Filesize

              6.9MB

              Download

            • memory/2852-5-0x0000000000430000-0x000000000043A000-memory.dmp

              Filesize

              40KB

              Download

            • memory/2852-4-0x0000000000350000-0x0000000000358000-memory.dmp

              Filesize

              32KB

              Download

            • memory/2852-0-0x0000000000370000-0x0000000000410000-memory.dmp

              Filesize

              640KB

              Download

            • memory/2852-2-0x0000000004DB0000-0x0000000004DF0000-memory.dmp

              Filesize

              256KB

              Download

            • memory/2852-1-0x0000000074CF0000-0x00000000753DE000-memory.dmp

              Filesize

              6.9MB

              Download