Analysis
-
max time kernel
118s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-12-2023 03:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
033464d80692b6ffd9f6938d8dca921b.exe
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
033464d80692b6ffd9f6938d8dca921b.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
033464d80692b6ffd9f6938d8dca921b.exe
-
Size
806KB
-
MD5
033464d80692b6ffd9f6938d8dca921b
-
SHA1
5463c7b2e3928d029d9ef4e9ae834994b8650d13
-
SHA256
96007bdda9d12cf59fd2844843f62d3a86b85cb732ee76004e2f93ac38d8c8af
-
SHA512
3c439e201b019bf8a9965211abb10ededdae3c74559ce0fa6c476ddd09743aa280aca074be85d8a450be607fb4998fc1f39cffbd481bf0189bcdca5bddef0fd0
-
SSDEEP
3072:2lSqfUfx0swpErm4ymFvR1pKucd78GMupAuFP27hIbf1sPzUgIAzI9+mCz7C3BfU:NqAxspJ45j+uZXu9EIBsYg1Cg
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1236-4-0x00000000004D0000-0x00000000004E6000-memory.dmp family_zgrat_v1 -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
033464d80692b6ffd9f6938d8dca921b.exepid process 1236 033464d80692b6ffd9f6938d8dca921b.exe 1236 033464d80692b6ffd9f6938d8dca921b.exe 1236 033464d80692b6ffd9f6938d8dca921b.exe 1236 033464d80692b6ffd9f6938d8dca921b.exe 1236 033464d80692b6ffd9f6938d8dca921b.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
033464d80692b6ffd9f6938d8dca921b.exedescription pid process Token: SeDebugPrivilege 1236 033464d80692b6ffd9f6938d8dca921b.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
033464d80692b6ffd9f6938d8dca921b.exedescription pid process target process PID 1236 wrote to memory of 1820 1236 033464d80692b6ffd9f6938d8dca921b.exe 033464d80692b6ffd9f6938d8dca921b.exe PID 1236 wrote to memory of 1820 1236 033464d80692b6ffd9f6938d8dca921b.exe 033464d80692b6ffd9f6938d8dca921b.exe PID 1236 wrote to memory of 1820 1236 033464d80692b6ffd9f6938d8dca921b.exe 033464d80692b6ffd9f6938d8dca921b.exe PID 1236 wrote to memory of 1820 1236 033464d80692b6ffd9f6938d8dca921b.exe 033464d80692b6ffd9f6938d8dca921b.exe PID 1236 wrote to memory of 2288 1236 033464d80692b6ffd9f6938d8dca921b.exe 033464d80692b6ffd9f6938d8dca921b.exe PID 1236 wrote to memory of 2288 1236 033464d80692b6ffd9f6938d8dca921b.exe 033464d80692b6ffd9f6938d8dca921b.exe PID 1236 wrote to memory of 2288 1236 033464d80692b6ffd9f6938d8dca921b.exe 033464d80692b6ffd9f6938d8dca921b.exe PID 1236 wrote to memory of 2288 1236 033464d80692b6ffd9f6938d8dca921b.exe 033464d80692b6ffd9f6938d8dca921b.exe PID 1236 wrote to memory of 2708 1236 033464d80692b6ffd9f6938d8dca921b.exe 033464d80692b6ffd9f6938d8dca921b.exe PID 1236 wrote to memory of 2708 1236 033464d80692b6ffd9f6938d8dca921b.exe 033464d80692b6ffd9f6938d8dca921b.exe PID 1236 wrote to memory of 2708 1236 033464d80692b6ffd9f6938d8dca921b.exe 033464d80692b6ffd9f6938d8dca921b.exe PID 1236 wrote to memory of 2708 1236 033464d80692b6ffd9f6938d8dca921b.exe 033464d80692b6ffd9f6938d8dca921b.exe PID 1236 wrote to memory of 2692 1236 033464d80692b6ffd9f6938d8dca921b.exe 033464d80692b6ffd9f6938d8dca921b.exe PID 1236 wrote to memory of 2692 1236 033464d80692b6ffd9f6938d8dca921b.exe 033464d80692b6ffd9f6938d8dca921b.exe PID 1236 wrote to memory of 2692 1236 033464d80692b6ffd9f6938d8dca921b.exe 033464d80692b6ffd9f6938d8dca921b.exe PID 1236 wrote to memory of 2692 1236 033464d80692b6ffd9f6938d8dca921b.exe 033464d80692b6ffd9f6938d8dca921b.exe PID 1236 wrote to memory of 2760 1236 033464d80692b6ffd9f6938d8dca921b.exe 033464d80692b6ffd9f6938d8dca921b.exe PID 1236 wrote to memory of 2760 1236 033464d80692b6ffd9f6938d8dca921b.exe 033464d80692b6ffd9f6938d8dca921b.exe PID 1236 wrote to memory of 2760 1236 033464d80692b6ffd9f6938d8dca921b.exe 033464d80692b6ffd9f6938d8dca921b.exe PID 1236 wrote to memory of 2760 1236 033464d80692b6ffd9f6938d8dca921b.exe 033464d80692b6ffd9f6938d8dca921b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\033464d80692b6ffd9f6938d8dca921b.exe"C:\Users\Admin\AppData\Local\Temp\033464d80692b6ffd9f6938d8dca921b.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\033464d80692b6ffd9f6938d8dca921b.exe"C:\Users\Admin\AppData\Local\Temp\033464d80692b6ffd9f6938d8dca921b.exe"2⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\033464d80692b6ffd9f6938d8dca921b.exe"C:\Users\Admin\AppData\Local\Temp\033464d80692b6ffd9f6938d8dca921b.exe"2⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\033464d80692b6ffd9f6938d8dca921b.exe"C:\Users\Admin\AppData\Local\Temp\033464d80692b6ffd9f6938d8dca921b.exe"2⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\033464d80692b6ffd9f6938d8dca921b.exe"C:\Users\Admin\AppData\Local\Temp\033464d80692b6ffd9f6938d8dca921b.exe"2⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\033464d80692b6ffd9f6938d8dca921b.exe"C:\Users\Admin\AppData\Local\Temp\033464d80692b6ffd9f6938d8dca921b.exe"2⤵PID:1820