Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
11-12-2023 15:56
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe
Resource
win10v2004-20231130-en
General
-
Target
SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe
-
Size
542KB
-
MD5
40c1ba471569a321aa99ccd124f1454f
-
SHA1
2a9c3cb89d12d2a549e3f8d6d2186462a8a92015
-
SHA256
955d7e07ea9b12cd8b719bfbb7bcc463cec11103b7f3040d36ecf5e6c8ef04aa
-
SHA512
d47229f04ed806228ad5dbf220b4c948f22f20fc435f4241ec96bc6b07ceba2a156c219aa168bae42175b6c89b1d2ea8f10cf2e7eee38b677679875d9f254a3c
-
SSDEEP
12288:C3IU8S6eUdCUxnTauA5+Imp9npsijaTIXTx0zHh7L3gX6T/r:YItSAdDTFXp9nppd0zB7L3wY
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2848-3-0x0000000000480000-0x0000000000498000-memory.dmp family_zgrat_v1 -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.2588.29559.exepid process 2848 SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe 2848 SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe 2848 SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe 2848 SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe 2848 SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.2588.29559.exedescription pid process Token: SeDebugPrivilege 2848 SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.2588.29559.exedescription pid process target process PID 2848 wrote to memory of 2572 2848 SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe PID 2848 wrote to memory of 2572 2848 SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe PID 2848 wrote to memory of 2572 2848 SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe PID 2848 wrote to memory of 2572 2848 SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe PID 2848 wrote to memory of 2580 2848 SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe PID 2848 wrote to memory of 2580 2848 SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe PID 2848 wrote to memory of 2580 2848 SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe PID 2848 wrote to memory of 2580 2848 SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe PID 2848 wrote to memory of 2640 2848 SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe PID 2848 wrote to memory of 2640 2848 SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe PID 2848 wrote to memory of 2640 2848 SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe PID 2848 wrote to memory of 2640 2848 SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe PID 2848 wrote to memory of 2644 2848 SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe PID 2848 wrote to memory of 2644 2848 SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe PID 2848 wrote to memory of 2644 2848 SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe PID 2848 wrote to memory of 2644 2848 SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe PID 2848 wrote to memory of 2664 2848 SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe PID 2848 wrote to memory of 2664 2848 SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe PID 2848 wrote to memory of 2664 2848 SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe PID 2848 wrote to memory of 2664 2848 SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe"2⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe"2⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe"2⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe"2⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2588.29559.exe"2⤵PID:2664