Analysis
-
max time kernel
151s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
25-12-2023 18:19
General
-
Target
33fe683a4f96d2b64616814f7473f9ad.exe
-
Size
486KB
-
MD5
33fe683a4f96d2b64616814f7473f9ad
-
SHA1
1dfecff86628341cb0f5208c6957a970e2729a99
-
SHA256
4b6d2d4d20ed03f56ffffc9c92549c99b7bd4494c7335790e9cae0e0b5824193
-
SHA512
3e8ae602b91151780f6b0c58f3409f19d7680ffd6bd979ee9c380966cf9442de06f031af4162da82204f87317c68bd59dc14a737e5e189b58171f343fd0963aa
-
SSDEEP
12288:tqXS3Nv68mo+UmaKOmGa1NoigDRlBda3w:wQtFYUUJUDX/a
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot1846829589:AAHSsEDTKvDOQ17YrNRY5_FXv5z4mpfGRIc/sendMessage?chat_id=1407381447
Signatures
-
Detect ZGRat V1 34 IoCs
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 1 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\33fe683a4f96d2b64616814f7473f9ad.exe"C:\Users\Admin\AppData\Local\Temp\33fe683a4f96d2b64616814f7473f9ad.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\33fe683a4f96d2b64616814f7473f9ad.exeC:\Users\Admin\AppData\Local\Temp\33fe683a4f96d2b64616814f7473f9ad.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 464 -s 18083⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 464 -ip 4641⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.7MB
-
Filesize
624KB
-
Filesize
64KB
-
Filesize
152KB
-
Filesize
7.7MB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
5.6MB
-
Filesize
492KB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
512KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
7.7MB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
584KB
-
Filesize
512KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
7.7MB