Analysis
- max time kernel
133s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20231127-en - resource tags
- submitted
11/12/2023, 15:48
General
- Target 支払い振込受領書.exe
- Size 719KB
- Sample231211-s8xgksbbbl
- SHA256 c059edfacb4d9f347c640dbf0b8d45533cda15bfcec2994bd09bcc0a318eecbc
Malware Config
Signatures
- Detect ZGRat V1 1 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\支払い振込受領書.exe"C:\Users\Admin\AppData\Local\Temp\支払い振込受領書.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1904 -s 12042⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1904 -ip 19041⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1904-0-0x0000000000C40000-0x0000000000CFA000-memory.dmp
memory/1904-1-0x0000000075080000-0x0000000075830000-memory.dmp
memory/1904-2-0x0000000005D80000-0x0000000006324000-memory.dmp
memory/1904-3-0x00000000056D0000-0x0000000005762000-memory.dmp
memory/1904-4-0x0000000005980000-0x0000000005990000-memory.dmp
memory/1904-5-0x0000000005790000-0x000000000579A000-memory.dmp
memory/1904-6-0x0000000005D40000-0x0000000005D58000-memory.dmp
memory/1904-7-0x0000000005970000-0x0000000005978000-memory.dmp
memory/1904-8-0x0000000005D20000-0x0000000005D2A000-memory.dmp
memory/1904-9-0x0000000006C80000-0x0000000006CFC000-memory.dmp
memory/1904-10-0x0000000006D10000-0x0000000006DAC000-memory.dmp
memory/1904-11-0x0000000075080000-0x0000000075830000-memory.dmp
memory/1904-12-0x0000000005980000-0x0000000005990000-memory.dmp
memory/1904-13-0x0000000075080000-0x0000000075830000-memory.dmp