Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22/12/2023, 06:17
Behavioral task
behavioral1
Sample
75095cbcb500e62342be13314cb75838.exe
Resource
win7-20231215-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
75095cbcb500e62342be13314cb75838.exe
Resource
win10v2004-20231215-en
5 signatures
150 seconds
General
-
Target
75095cbcb500e62342be13314cb75838.exe
-
Size
1.9MB
-
MD5
75095cbcb500e62342be13314cb75838
-
SHA1
930b94479fb88c07fa4ff3fc400c77766642e8b6
-
SHA256
f298c1898a83e935d067a66c9ee1973aed989fc07d9761cce5045710012959ff
-
SHA512
7f4ee77604aaaa63fe40ce6dd97141860b300899658b5736189bb4c8d037be51557277130d4dcaf597eebb03aaed1857b3f22455a67329dd24d61165307c4639
-
SSDEEP
24576:bedatdC5JFfQnkwNei1zAGY84ausHbEgGtI59b+H7EnTVzBQfx/DKeGNIKP8yKP8:bedatdCNu9HNjTlBQfxpGN
Score
10/10
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
resource yara_rule behavioral1/memory/1052-0-0x0000000001190000-0x000000000137A000-memory.dmp family_zgrat_v1 -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\adb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\75095cbcb500e62342be13314cb75838.exe" 75095cbcb500e62342be13314cb75838.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1052 75095cbcb500e62342be13314cb75838.exe 1052 75095cbcb500e62342be13314cb75838.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1052 75095cbcb500e62342be13314cb75838.exe