zgrat | 8c598c9782ffaf10ac7bd59c5a48acc267d15590eccba787b61cda62a7ea7138

General

Target

f95564a72a16d6a4efa39278f0721ac2.exe
Size

1.0MB
MD5

f95564a72a16d6a4efa39278f0721ac2
SHA1

4e93f6849ca3717ebb3fe64f01b2384592906464
SHA256

8c598c9782ffaf10ac7bd59c5a48acc267d15590eccba787b61cda62a7ea7138
SHA512

d371acb9407680c06f8991d06046419ae0dd156e214ed6ce1062e0499caced63ddd5a323ca8176947555e2770d6ca2cccf9f2f59becc2997d8fc2a102565ea8d
SSDEEP

24576:iJjAKND1LIQgBPiXOa8tspOJy2HNyCY3rw:iJjN9IQEiXOBywmr

Score

10^/10

zgrat persistence rat

Malware Config

Signatures

Detect ZGRat V1 34 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2580-7-0x0000000004EC0000-0x0000000004F2E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2580-8-0x0000000004EC0000-0x0000000004F27000-memory.dmp	family_zgrat_v1
behavioral1/memory/2580-9-0x0000000004EC0000-0x0000000004F27000-memory.dmp	family_zgrat_v1
behavioral1/memory/2580-11-0x0000000004EC0000-0x0000000004F27000-memory.dmp	family_zgrat_v1
behavioral1/memory/2580-15-0x0000000004EC0000-0x0000000004F27000-memory.dmp	family_zgrat_v1
behavioral1/memory/2580-13-0x0000000004EC0000-0x0000000004F27000-memory.dmp	family_zgrat_v1
behavioral1/memory/2580-17-0x0000000004EC0000-0x0000000004F27000-memory.dmp	family_zgrat_v1
behavioral1/memory/2580-19-0x0000000004EC0000-0x0000000004F27000-memory.dmp	family_zgrat_v1
behavioral1/memory/2580-21-0x0000000004EC0000-0x0000000004F27000-memory.dmp	family_zgrat_v1
behavioral1/memory/2580-25-0x0000000004EC0000-0x0000000004F27000-memory.dmp	family_zgrat_v1
behavioral1/memory/2580-23-0x0000000004EC0000-0x0000000004F27000-memory.dmp	family_zgrat_v1
behavioral1/memory/2580-31-0x0000000004EC0000-0x0000000004F27000-memory.dmp	family_zgrat_v1
behavioral1/memory/2580-47-0x0000000004EC0000-0x0000000004F27000-memory.dmp	family_zgrat_v1
behavioral1/memory/2580-63-0x0000000004EC0000-0x0000000004F27000-memory.dmp	family_zgrat_v1
behavioral1/memory/2580-71-0x0000000004EC0000-0x0000000004F27000-memory.dmp	family_zgrat_v1
behavioral1/memory/2580-69-0x0000000004EC0000-0x0000000004F27000-memory.dmp	family_zgrat_v1
behavioral1/memory/2580-67-0x0000000004EC0000-0x0000000004F27000-memory.dmp	family_zgrat_v1
behavioral1/memory/2580-65-0x0000000004EC0000-0x0000000004F27000-memory.dmp	family_zgrat_v1
behavioral1/memory/2580-61-0x0000000004EC0000-0x0000000004F27000-memory.dmp	family_zgrat_v1
behavioral1/memory/2580-59-0x0000000004EC0000-0x0000000004F27000-memory.dmp	family_zgrat_v1
behavioral1/memory/2580-57-0x0000000004EC0000-0x0000000004F27000-memory.dmp	family_zgrat_v1
behavioral1/memory/2580-55-0x0000000004EC0000-0x0000000004F27000-memory.dmp	family_zgrat_v1
behavioral1/memory/2580-53-0x0000000004EC0000-0x0000000004F27000-memory.dmp	family_zgrat_v1
behavioral1/memory/2580-51-0x0000000004EC0000-0x0000000004F27000-memory.dmp	family_zgrat_v1
behavioral1/memory/2580-49-0x0000000004EC0000-0x0000000004F27000-memory.dmp	family_zgrat_v1
behavioral1/memory/2580-45-0x0000000004EC0000-0x0000000004F27000-memory.dmp	family_zgrat_v1
behavioral1/memory/2580-43-0x0000000004EC0000-0x0000000004F27000-memory.dmp	family_zgrat_v1
behavioral1/memory/2580-41-0x0000000004EC0000-0x0000000004F27000-memory.dmp	family_zgrat_v1
behavioral1/memory/2580-39-0x0000000004EC0000-0x0000000004F27000-memory.dmp	family_zgrat_v1
behavioral1/memory/2580-37-0x0000000004EC0000-0x0000000004F27000-memory.dmp	family_zgrat_v1
behavioral1/memory/2580-35-0x0000000004EC0000-0x0000000004F27000-memory.dmp	family_zgrat_v1
behavioral1/memory/2580-33-0x0000000004EC0000-0x0000000004F27000-memory.dmp	family_zgrat_v1
behavioral1/memory/2580-29-0x0000000004EC0000-0x0000000004F27000-memory.dmp	family_zgrat_v1
behavioral1/memory/2580-27-0x0000000004EC0000-0x0000000004F27000-memory.dmp	family_zgrat_v1

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

f95564a72a16d6a4efa39278f0721ac2.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\JavaUpdate\\JavaUpdate.exe\","	f95564a72a16d6a4efa39278f0721ac2.exe

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 23 IoCs

Processes:

f95564a72a16d6a4efa39278f0721ac2.exepowershell.exe

pid	process
2580	f95564a72a16d6a4efa39278f0721ac2.exe
2580	f95564a72a16d6a4efa39278f0721ac2.exe
2580	f95564a72a16d6a4efa39278f0721ac2.exe
2580	f95564a72a16d6a4efa39278f0721ac2.exe
2580	f95564a72a16d6a4efa39278f0721ac2.exe
2580	f95564a72a16d6a4efa39278f0721ac2.exe
2580	f95564a72a16d6a4efa39278f0721ac2.exe
2580	f95564a72a16d6a4efa39278f0721ac2.exe
2580	f95564a72a16d6a4efa39278f0721ac2.exe
2580	f95564a72a16d6a4efa39278f0721ac2.exe
2580	f95564a72a16d6a4efa39278f0721ac2.exe
2580	f95564a72a16d6a4efa39278f0721ac2.exe
2580	f95564a72a16d6a4efa39278f0721ac2.exe
2580	f95564a72a16d6a4efa39278f0721ac2.exe
2580	f95564a72a16d6a4efa39278f0721ac2.exe
2580	f95564a72a16d6a4efa39278f0721ac2.exe
2580	f95564a72a16d6a4efa39278f0721ac2.exe
2580	f95564a72a16d6a4efa39278f0721ac2.exe
2580	f95564a72a16d6a4efa39278f0721ac2.exe
2580	f95564a72a16d6a4efa39278f0721ac2.exe
2580	f95564a72a16d6a4efa39278f0721ac2.exe
2580	f95564a72a16d6a4efa39278f0721ac2.exe
2864	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

f95564a72a16d6a4efa39278f0721ac2.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2580 f95564a72a16d6a4efa39278f0721ac2.exe
Token: SeDebugPrivilege 2864 powershell.exe

description	pid	process
Token: SeDebugPrivilege	2580	f95564a72a16d6a4efa39278f0721ac2.exe
Token: SeDebugPrivilege	2864	powershell.exe

Suspicious use of WriteProcessMemory 48 IoCs

Processes:

f95564a72a16d6a4efa39278f0721ac2.exeWScript.exe

C:\Users\Admin\AppData\Local\Temp\f95564a72a16d6a4efa39278f0721ac2.exe
"C:\Users\Admin\AppData\Local\Temp\f95564a72a16d6a4efa39278f0721ac2.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2580

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Xtsijkfgdndn.vbs"
2⤵
- Suspicious use of WriteProcessMemory
PID:2696

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Local\JavaUpdate\JavaUpdate.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2864

C:\Users\Admin\AppData\Local\Temp\f95564a72a16d6a4efa39278f0721ac2.exe
C:\Users\Admin\AppData\Local\Temp\f95564a72a16d6a4efa39278f0721ac2.exe
2⤵
PID:2732

C:\Users\Admin\AppData\Local\Temp\f95564a72a16d6a4efa39278f0721ac2.exe
C:\Users\Admin\AppData\Local\Temp\f95564a72a16d6a4efa39278f0721ac2.exe
2⤵
PID:2852

C:\Users\Admin\AppData\Local\Temp\f95564a72a16d6a4efa39278f0721ac2.exe
C:\Users\Admin\AppData\Local\Temp\f95564a72a16d6a4efa39278f0721ac2.exe
2⤵
PID:2856

C:\Users\Admin\AppData\Local\Temp\f95564a72a16d6a4efa39278f0721ac2.exe
C:\Users\Admin\AppData\Local\Temp\f95564a72a16d6a4efa39278f0721ac2.exe
2⤵
PID:1588

C:\Users\Admin\AppData\Local\Temp\f95564a72a16d6a4efa39278f0721ac2.exe
C:\Users\Admin\AppData\Local\Temp\f95564a72a16d6a4efa39278f0721ac2.exe
2⤵
PID:2960

C:\Users\Admin\AppData\Local\Temp\f95564a72a16d6a4efa39278f0721ac2.exe
C:\Users\Admin\AppData\Local\Temp\f95564a72a16d6a4efa39278f0721ac2.exe
2⤵
PID:2840

C:\Users\Admin\AppData\Local\Temp\f95564a72a16d6a4efa39278f0721ac2.exe
C:\Users\Admin\AppData\Local\Temp\f95564a72a16d6a4efa39278f0721ac2.exe
2⤵
PID:2728

C:\Users\Admin\AppData\Local\Temp\f95564a72a16d6a4efa39278f0721ac2.exe
C:\Users\Admin\AppData\Local\Temp\f95564a72a16d6a4efa39278f0721ac2.exe
2⤵
PID:2816

C:\Users\Admin\AppData\Local\Temp\f95564a72a16d6a4efa39278f0721ac2.exe
C:\Users\Admin\AppData\Local\Temp\f95564a72a16d6a4efa39278f0721ac2.exe
2⤵
PID:1372

C:\Users\Admin\AppData\Local\Temp\f95564a72a16d6a4efa39278f0721ac2.exe
C:\Users\Admin\AppData\Local\Temp\f95564a72a16d6a4efa39278f0721ac2.exe
2⤵
PID:2832

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_Xtsijkfgdndn.vbs
Filesize
149B

MD5
75fda8189e60e05655aea55fe68591c0

SHA1
de2177e12403c59f81d278497a387089ddd10d73

SHA256
cf8322af201e7b0f5d5b2b93c0df541c8785436ebdf04a32addc46b13caf81c5

SHA512
1bc581cbe6ba2f7f9a419bdb9b582ec5585d5cdfd8e245cab19c269d2bd4ecbc151cd98996b8d5f330304fda243c4a13388f1c601111dbab59fd0ad35e5ea647

Download Submit
memory/2580-0-0x0000000000300000-0x0000000000408000-memory.dmp

Filesize
1.0MB

Download
memory/2580-1-0x0000000073D90000-0x000000007447E000-memory.dmp

Filesize
6.9MB

Download
memory/2580-2-0x0000000004BF0000-0x0000000004C30000-memory.dmp

Filesize
256KB

Download
memory/2580-3-0x0000000004BF0000-0x0000000004C30000-memory.dmp

Filesize
256KB

Download
memory/2580-4-0x0000000073D90000-0x000000007447E000-memory.dmp

Filesize
6.9MB

Download
memory/2580-5-0x0000000004BF0000-0x0000000004C30000-memory.dmp

Filesize
256KB

Download
memory/2580-6-0x00000000004C0000-0x0000000000502000-memory.dmp

Filesize
264KB

Download
memory/2580-7-0x0000000004EC0000-0x0000000004F2E000-memory.dmp

Filesize
440KB

Download
memory/2580-8-0x0000000004EC0000-0x0000000004F27000-memory.dmp

Filesize
412KB

Download
memory/2580-9-0x0000000004EC0000-0x0000000004F27000-memory.dmp

Filesize
412KB

Download
memory/2580-11-0x0000000004EC0000-0x0000000004F27000-memory.dmp

Filesize
412KB

Download
memory/2580-15-0x0000000004EC0000-0x0000000004F27000-memory.dmp

Filesize
412KB

Download
memory/2580-13-0x0000000004EC0000-0x0000000004F27000-memory.dmp

Filesize
412KB

Download
memory/2580-17-0x0000000004EC0000-0x0000000004F27000-memory.dmp

Filesize
412KB

Download
memory/2580-19-0x0000000004EC0000-0x0000000004F27000-memory.dmp

Filesize
412KB

Download
memory/2580-21-0x0000000004EC0000-0x0000000004F27000-memory.dmp

Filesize
412KB

Download
memory/2580-25-0x0000000004EC0000-0x0000000004F27000-memory.dmp

Filesize
412KB

Download
memory/2580-23-0x0000000004EC0000-0x0000000004F27000-memory.dmp

Filesize
412KB

Download
memory/2580-31-0x0000000004EC0000-0x0000000004F27000-memory.dmp

Filesize
412KB

Download
memory/2580-47-0x0000000004EC0000-0x0000000004F27000-memory.dmp

Filesize
412KB

Download
memory/2580-63-0x0000000004EC0000-0x0000000004F27000-memory.dmp

Filesize
412KB

Download
memory/2580-71-0x0000000004EC0000-0x0000000004F27000-memory.dmp

Filesize
412KB

Download
memory/2580-69-0x0000000004EC0000-0x0000000004F27000-memory.dmp

Filesize
412KB

Download
memory/2580-67-0x0000000004EC0000-0x0000000004F27000-memory.dmp

Filesize
412KB

Download
memory/2580-65-0x0000000004EC0000-0x0000000004F27000-memory.dmp

Filesize
412KB

Download
memory/2580-61-0x0000000004EC0000-0x0000000004F27000-memory.dmp

Filesize
412KB

Download
memory/2580-59-0x0000000004EC0000-0x0000000004F27000-memory.dmp

Filesize
412KB

Download
memory/2580-57-0x0000000004EC0000-0x0000000004F27000-memory.dmp

Filesize
412KB

Download
memory/2580-55-0x0000000004EC0000-0x0000000004F27000-memory.dmp

Filesize
412KB

Download
memory/2580-53-0x0000000004EC0000-0x0000000004F27000-memory.dmp

Filesize
412KB

Download
memory/2580-51-0x0000000004EC0000-0x0000000004F27000-memory.dmp

Filesize
412KB

Download
memory/2580-49-0x0000000004EC0000-0x0000000004F27000-memory.dmp

Filesize
412KB

Download
memory/2580-45-0x0000000004EC0000-0x0000000004F27000-memory.dmp

Filesize
412KB

Download
memory/2580-43-0x0000000004EC0000-0x0000000004F27000-memory.dmp

Filesize
412KB

Download
memory/2580-41-0x0000000004EC0000-0x0000000004F27000-memory.dmp

Filesize
412KB

Download
memory/2580-39-0x0000000004EC0000-0x0000000004F27000-memory.dmp

Filesize
412KB

Download
memory/2580-37-0x0000000004EC0000-0x0000000004F27000-memory.dmp

Filesize
412KB

Download
memory/2580-35-0x0000000004EC0000-0x0000000004F27000-memory.dmp

Filesize
412KB

Download
memory/2580-33-0x0000000004EC0000-0x0000000004F27000-memory.dmp

Filesize
412KB

Download
memory/2580-29-0x0000000004EC0000-0x0000000004F27000-memory.dmp

Filesize
412KB

Download
memory/2580-27-0x0000000004EC0000-0x0000000004F27000-memory.dmp

Filesize
412KB

Download
memory/2580-540-0x0000000004BF0000-0x0000000004C30000-memory.dmp

Filesize
256KB

Download
memory/2580-1940-0x0000000073D90000-0x000000007447E000-memory.dmp

Filesize
6.9MB

Download
memory/2864-1943-0x00000000737F0000-0x0000000073D9B000-memory.dmp

Filesize
5.7MB

Download
memory/2864-1944-0x00000000737F0000-0x0000000073D9B000-memory.dmp

Filesize
5.7MB

Download
memory/2864-1946-0x00000000023D0000-0x0000000002410000-memory.dmp

Filesize
256KB

Download
memory/2864-1945-0x00000000023D0000-0x0000000002410000-memory.dmp

Filesize
256KB

Download
memory/2864-1947-0x00000000023D0000-0x0000000002410000-memory.dmp

Filesize
256KB

Download
memory/2864-1948-0x00000000737F0000-0x0000000073D9B000-memory.dmp

Filesize
5.7MB

Download

description	pid	process	target process
PID 2580 wrote to memory of 2696	2580	f95564a72a16d6a4efa39278f0721ac2.exe	WScript.exe
PID 2580 wrote to memory of 2696	2580	f95564a72a16d6a4efa39278f0721ac2.exe	WScript.exe
PID 2580 wrote to memory of 2696	2580	f95564a72a16d6a4efa39278f0721ac2.exe	WScript.exe
PID 2580 wrote to memory of 2696	2580	f95564a72a16d6a4efa39278f0721ac2.exe	WScript.exe
PID 2580 wrote to memory of 2732	2580	f95564a72a16d6a4efa39278f0721ac2.exe	f95564a72a16d6a4efa39278f0721ac2.exe
PID 2580 wrote to memory of 2732	2580	f95564a72a16d6a4efa39278f0721ac2.exe	f95564a72a16d6a4efa39278f0721ac2.exe
PID 2580 wrote to memory of 2732	2580	f95564a72a16d6a4efa39278f0721ac2.exe	f95564a72a16d6a4efa39278f0721ac2.exe
PID 2580 wrote to memory of 2732	2580	f95564a72a16d6a4efa39278f0721ac2.exe	f95564a72a16d6a4efa39278f0721ac2.exe
PID 2580 wrote to memory of 2852	2580	f95564a72a16d6a4efa39278f0721ac2.exe	f95564a72a16d6a4efa39278f0721ac2.exe
PID 2580 wrote to memory of 2852	2580	f95564a72a16d6a4efa39278f0721ac2.exe	f95564a72a16d6a4efa39278f0721ac2.exe
PID 2580 wrote to memory of 2852	2580	f95564a72a16d6a4efa39278f0721ac2.exe	f95564a72a16d6a4efa39278f0721ac2.exe
PID 2580 wrote to memory of 2852	2580	f95564a72a16d6a4efa39278f0721ac2.exe	f95564a72a16d6a4efa39278f0721ac2.exe
PID 2580 wrote to memory of 2856	2580	f95564a72a16d6a4efa39278f0721ac2.exe	f95564a72a16d6a4efa39278f0721ac2.exe
PID 2580 wrote to memory of 2856	2580	f95564a72a16d6a4efa39278f0721ac2.exe	f95564a72a16d6a4efa39278f0721ac2.exe
PID 2580 wrote to memory of 2856	2580	f95564a72a16d6a4efa39278f0721ac2.exe	f95564a72a16d6a4efa39278f0721ac2.exe
PID 2580 wrote to memory of 2856	2580	f95564a72a16d6a4efa39278f0721ac2.exe	f95564a72a16d6a4efa39278f0721ac2.exe
PID 2580 wrote to memory of 1588	2580	f95564a72a16d6a4efa39278f0721ac2.exe	f95564a72a16d6a4efa39278f0721ac2.exe
PID 2580 wrote to memory of 1588	2580	f95564a72a16d6a4efa39278f0721ac2.exe	f95564a72a16d6a4efa39278f0721ac2.exe
PID 2580 wrote to memory of 1588	2580	f95564a72a16d6a4efa39278f0721ac2.exe	f95564a72a16d6a4efa39278f0721ac2.exe
PID 2580 wrote to memory of 1588	2580	f95564a72a16d6a4efa39278f0721ac2.exe	f95564a72a16d6a4efa39278f0721ac2.exe
PID 2580 wrote to memory of 2960	2580	f95564a72a16d6a4efa39278f0721ac2.exe	f95564a72a16d6a4efa39278f0721ac2.exe
PID 2580 wrote to memory of 2960	2580	f95564a72a16d6a4efa39278f0721ac2.exe	f95564a72a16d6a4efa39278f0721ac2.exe
PID 2580 wrote to memory of 2960	2580	f95564a72a16d6a4efa39278f0721ac2.exe	f95564a72a16d6a4efa39278f0721ac2.exe
PID 2580 wrote to memory of 2960	2580	f95564a72a16d6a4efa39278f0721ac2.exe	f95564a72a16d6a4efa39278f0721ac2.exe
PID 2580 wrote to memory of 2840	2580	f95564a72a16d6a4efa39278f0721ac2.exe	f95564a72a16d6a4efa39278f0721ac2.exe
PID 2580 wrote to memory of 2840	2580	f95564a72a16d6a4efa39278f0721ac2.exe	f95564a72a16d6a4efa39278f0721ac2.exe
PID 2580 wrote to memory of 2840	2580	f95564a72a16d6a4efa39278f0721ac2.exe	f95564a72a16d6a4efa39278f0721ac2.exe
PID 2580 wrote to memory of 2840	2580	f95564a72a16d6a4efa39278f0721ac2.exe	f95564a72a16d6a4efa39278f0721ac2.exe
PID 2580 wrote to memory of 2728	2580	f95564a72a16d6a4efa39278f0721ac2.exe	f95564a72a16d6a4efa39278f0721ac2.exe
PID 2580 wrote to memory of 2728	2580	f95564a72a16d6a4efa39278f0721ac2.exe	f95564a72a16d6a4efa39278f0721ac2.exe
PID 2580 wrote to memory of 2728	2580	f95564a72a16d6a4efa39278f0721ac2.exe	f95564a72a16d6a4efa39278f0721ac2.exe
PID 2580 wrote to memory of 2728	2580	f95564a72a16d6a4efa39278f0721ac2.exe	f95564a72a16d6a4efa39278f0721ac2.exe
PID 2580 wrote to memory of 1372	2580	f95564a72a16d6a4efa39278f0721ac2.exe	f95564a72a16d6a4efa39278f0721ac2.exe
PID 2580 wrote to memory of 1372	2580	f95564a72a16d6a4efa39278f0721ac2.exe	f95564a72a16d6a4efa39278f0721ac2.exe
PID 2580 wrote to memory of 1372	2580	f95564a72a16d6a4efa39278f0721ac2.exe	f95564a72a16d6a4efa39278f0721ac2.exe
PID 2580 wrote to memory of 1372	2580	f95564a72a16d6a4efa39278f0721ac2.exe	f95564a72a16d6a4efa39278f0721ac2.exe
PID 2580 wrote to memory of 2816	2580	f95564a72a16d6a4efa39278f0721ac2.exe	f95564a72a16d6a4efa39278f0721ac2.exe
PID 2580 wrote to memory of 2816	2580	f95564a72a16d6a4efa39278f0721ac2.exe	f95564a72a16d6a4efa39278f0721ac2.exe
PID 2580 wrote to memory of 2816	2580	f95564a72a16d6a4efa39278f0721ac2.exe	f95564a72a16d6a4efa39278f0721ac2.exe
PID 2580 wrote to memory of 2816	2580	f95564a72a16d6a4efa39278f0721ac2.exe	f95564a72a16d6a4efa39278f0721ac2.exe
PID 2580 wrote to memory of 2832	2580	f95564a72a16d6a4efa39278f0721ac2.exe	f95564a72a16d6a4efa39278f0721ac2.exe
PID 2580 wrote to memory of 2832	2580	f95564a72a16d6a4efa39278f0721ac2.exe	f95564a72a16d6a4efa39278f0721ac2.exe
PID 2580 wrote to memory of 2832	2580	f95564a72a16d6a4efa39278f0721ac2.exe	f95564a72a16d6a4efa39278f0721ac2.exe
PID 2580 wrote to memory of 2832	2580	f95564a72a16d6a4efa39278f0721ac2.exe	f95564a72a16d6a4efa39278f0721ac2.exe
PID 2696 wrote to memory of 2864	2696	WScript.exe	powershell.exe
PID 2696 wrote to memory of 2864	2696	WScript.exe	powershell.exe
PID 2696 wrote to memory of 2864	2696	WScript.exe	powershell.exe
PID 2696 wrote to memory of 2864	2696	WScript.exe	powershell.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads