Analysis
- max time kernel
148s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-20231127-en - resource tags
- submitted
11/12/2023, 15:46
General
- Target sipariş formu_231510.exe
- Size 907KB
- Sample231211-s75fssbahp
- SHA256 cf07ccee4a997c438225cd4b3ca7f706fbc9be102e979da877390d3c9bf1d4ea
Malware Config
Signatures
- Detect ZGRat V1 1 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\sipariş formu_231510.exe"C:\Users\Admin\AppData\Local\Temp\sipariş formu_231510.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 11762⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 416 -ip 4161⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/416-1-0x0000000074770000-0x0000000074F20000-memory.dmp
memory/416-0-0x00000000005E0000-0x00000000006C8000-memory.dmp
memory/416-2-0x00000000056D0000-0x0000000005C74000-memory.dmp
memory/416-3-0x0000000005060000-0x00000000050F2000-memory.dmp
memory/416-4-0x0000000005310000-0x0000000005320000-memory.dmp
memory/416-5-0x0000000005130000-0x000000000513A000-memory.dmp
memory/416-6-0x00000000052E0000-0x00000000052F8000-memory.dmp
memory/416-7-0x0000000005400000-0x0000000005408000-memory.dmp
memory/416-8-0x0000000006380000-0x000000000638A000-memory.dmp
memory/416-9-0x0000000008C30000-0x0000000008CAC000-memory.dmp
memory/416-10-0x0000000006810000-0x00000000068AC000-memory.dmp
memory/416-11-0x0000000074770000-0x0000000074F20000-memory.dmp
memory/416-12-0x0000000005310000-0x0000000005320000-memory.dmp
memory/416-13-0x0000000074770000-0x0000000074F20000-memory.dmp
memory/2640-14-0x000001B2B3140000-0x000001B2B3150000-memory.dmp
memory/2640-30-0x000001B2B3240000-0x000001B2B3250000-memory.dmp
memory/2640-46-0x000001B2BB5B0000-0x000001B2BB5B1000-memory.dmp
memory/2640-48-0x000001B2BB5E0000-0x000001B2BB5E1000-memory.dmp
memory/2640-49-0x000001B2BB5E0000-0x000001B2BB5E1000-memory.dmp
memory/2640-50-0x000001B2BB6F0000-0x000001B2BB6F1000-memory.dmp