Analysis
-
max time kernel
596s -
max time network
600s -
platform
windows11-21h2_x64 -
resource
win11-20231215-en -
resource tags
-
submitted
20-12-2023 01:43
General
-
Target
1c133b9bb476879df8145370ce1069ec92f28cade85a839e0159158a3e1b1afd.exe
-
Size
262KB
-
MD5
19fc87c57a679a0d13237b98b5238494
-
SHA1
225b2955c3ef066629dfe2a6f70e6f685d361cbb
-
SHA256
1c133b9bb476879df8145370ce1069ec92f28cade85a839e0159158a3e1b1afd
-
SHA512
25802228b2ce71d52de9436ae465b79731bfe10142c22b3fb9618420c3fdf9b917a73426b3b22831f009a5db85276237d14146cfbc5cf41eaacf324f432a983e
-
SSDEEP
3072:DHWR0eTZb0s2XCO6bi9Syoe3e5MbrfgDDRIWG7Oh5y9iFzCgfsDr18IPoyvbOQ87:ovWo+eErfSB8qWz6IwyvhAthNYfsY
Score
10/10
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c133b9bb476879df8145370ce1069ec92f28cade85a839e0159158a3e1b1afd.exe"C:\Users\Admin\AppData\Local\Temp\1c133b9bb476879df8145370ce1069ec92f28cade85a839e0159158a3e1b1afd.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
288KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
6.1MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
1.8MB
-
Filesize
304KB
-
Filesize
1.0MB
-
Filesize
408KB
-
Filesize
7.7MB
-
Filesize
64KB