Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-12-2023 08:13
Static task
static1
Behavioral task
behavioral1
Sample
113f59d0bd4384226e40c17bf899935d.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
113f59d0bd4384226e40c17bf899935d.exe
Resource
win10v2004-20231215-en
General
-
Target
113f59d0bd4384226e40c17bf899935d.exe
-
Size
955KB
-
MD5
113f59d0bd4384226e40c17bf899935d
-
SHA1
4bf159402cefe87d328182fee0e82297b1fff5c5
-
SHA256
b77f7c59b071608e552cf6ccae6f9e0e3f6790d83ec7d163713b0eedc6eccf25
-
SHA512
d8e3717916475013e8ec8cc5a5fef303c4467fe66b944f1031ee73ad964a6a699d3c872a305173ac7565e5000ade605e8cef1cbe3ca9438ac1f85993a69a3b78
-
SSDEEP
12288:gFrXv++Cjkemhes5D9Bq1U50kb9zU9uRyM3/CsUABjFG3CiEN4/PosRbOt/kUQQj:gFrpCDsz2SCyiJA+O9ENGZOMb
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2236-4-0x0000000000280000-0x0000000000296000-memory.dmp family_zgrat_v1 -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
113f59d0bd4384226e40c17bf899935d.exepid process 2236 113f59d0bd4384226e40c17bf899935d.exe 2236 113f59d0bd4384226e40c17bf899935d.exe 2236 113f59d0bd4384226e40c17bf899935d.exe 2236 113f59d0bd4384226e40c17bf899935d.exe 2236 113f59d0bd4384226e40c17bf899935d.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
113f59d0bd4384226e40c17bf899935d.exedescription pid process Token: SeDebugPrivilege 2236 113f59d0bd4384226e40c17bf899935d.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
113f59d0bd4384226e40c17bf899935d.exedescription pid process target process PID 2236 wrote to memory of 2812 2236 113f59d0bd4384226e40c17bf899935d.exe 113f59d0bd4384226e40c17bf899935d.exe PID 2236 wrote to memory of 2812 2236 113f59d0bd4384226e40c17bf899935d.exe 113f59d0bd4384226e40c17bf899935d.exe PID 2236 wrote to memory of 2812 2236 113f59d0bd4384226e40c17bf899935d.exe 113f59d0bd4384226e40c17bf899935d.exe PID 2236 wrote to memory of 2812 2236 113f59d0bd4384226e40c17bf899935d.exe 113f59d0bd4384226e40c17bf899935d.exe PID 2236 wrote to memory of 2816 2236 113f59d0bd4384226e40c17bf899935d.exe 113f59d0bd4384226e40c17bf899935d.exe PID 2236 wrote to memory of 2816 2236 113f59d0bd4384226e40c17bf899935d.exe 113f59d0bd4384226e40c17bf899935d.exe PID 2236 wrote to memory of 2816 2236 113f59d0bd4384226e40c17bf899935d.exe 113f59d0bd4384226e40c17bf899935d.exe PID 2236 wrote to memory of 2816 2236 113f59d0bd4384226e40c17bf899935d.exe 113f59d0bd4384226e40c17bf899935d.exe PID 2236 wrote to memory of 2828 2236 113f59d0bd4384226e40c17bf899935d.exe 113f59d0bd4384226e40c17bf899935d.exe PID 2236 wrote to memory of 2828 2236 113f59d0bd4384226e40c17bf899935d.exe 113f59d0bd4384226e40c17bf899935d.exe PID 2236 wrote to memory of 2828 2236 113f59d0bd4384226e40c17bf899935d.exe 113f59d0bd4384226e40c17bf899935d.exe PID 2236 wrote to memory of 2828 2236 113f59d0bd4384226e40c17bf899935d.exe 113f59d0bd4384226e40c17bf899935d.exe PID 2236 wrote to memory of 2848 2236 113f59d0bd4384226e40c17bf899935d.exe 113f59d0bd4384226e40c17bf899935d.exe PID 2236 wrote to memory of 2848 2236 113f59d0bd4384226e40c17bf899935d.exe 113f59d0bd4384226e40c17bf899935d.exe PID 2236 wrote to memory of 2848 2236 113f59d0bd4384226e40c17bf899935d.exe 113f59d0bd4384226e40c17bf899935d.exe PID 2236 wrote to memory of 2848 2236 113f59d0bd4384226e40c17bf899935d.exe 113f59d0bd4384226e40c17bf899935d.exe PID 2236 wrote to memory of 2800 2236 113f59d0bd4384226e40c17bf899935d.exe 113f59d0bd4384226e40c17bf899935d.exe PID 2236 wrote to memory of 2800 2236 113f59d0bd4384226e40c17bf899935d.exe 113f59d0bd4384226e40c17bf899935d.exe PID 2236 wrote to memory of 2800 2236 113f59d0bd4384226e40c17bf899935d.exe 113f59d0bd4384226e40c17bf899935d.exe PID 2236 wrote to memory of 2800 2236 113f59d0bd4384226e40c17bf899935d.exe 113f59d0bd4384226e40c17bf899935d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\113f59d0bd4384226e40c17bf899935d.exe"C:\Users\Admin\AppData\Local\Temp\113f59d0bd4384226e40c17bf899935d.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\113f59d0bd4384226e40c17bf899935d.exe"C:\Users\Admin\AppData\Local\Temp\113f59d0bd4384226e40c17bf899935d.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\113f59d0bd4384226e40c17bf899935d.exe"C:\Users\Admin\AppData\Local\Temp\113f59d0bd4384226e40c17bf899935d.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\113f59d0bd4384226e40c17bf899935d.exe"C:\Users\Admin\AppData\Local\Temp\113f59d0bd4384226e40c17bf899935d.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\113f59d0bd4384226e40c17bf899935d.exe"C:\Users\Admin\AppData\Local\Temp\113f59d0bd4384226e40c17bf899935d.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\113f59d0bd4384226e40c17bf899935d.exe"C:\Users\Admin\AppData\Local\Temp\113f59d0bd4384226e40c17bf899935d.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2236-1-0x0000000074570000-0x0000000074C5E000-memory.dmpFilesize
6.9MB
-
memory/2236-0-0x0000000000330000-0x0000000000424000-memory.dmpFilesize
976KB
-
memory/2236-2-0x0000000000690000-0x00000000006D0000-memory.dmpFilesize
256KB
-
memory/2236-3-0x0000000002230000-0x00000000022A8000-memory.dmpFilesize
480KB
-
memory/2236-4-0x0000000000280000-0x0000000000296000-memory.dmpFilesize
88KB
-
memory/2236-5-0x0000000074570000-0x0000000074C5E000-memory.dmpFilesize
6.9MB