Analysis
-
max time kernel
25s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
31-12-2023 13:01
Static task
static1
Behavioral task
behavioral1
Sample
371b336da91abd01bf0522c7cbf47934.exe
Resource
win7-20231129-en
General
-
Target
371b336da91abd01bf0522c7cbf47934.exe
-
Size
2.9MB
-
MD5
371b336da91abd01bf0522c7cbf47934
-
SHA1
dca225e7018a9b628f2ae0998e6a01e7576751e4
-
SHA256
28952976aeedba181c346d3180d389d540c7a341b69e23d92529825820c4d06e
-
SHA512
52105ae02bab6066011e9bc9e4b06a2e79f90c92164974bc6508214c9234b04b29aeddc5715e73fe2fd93bc7b03644baf301f5e06c12243063e0361a56e55446
-
SSDEEP
49152:x6PaI2dBi0xNC76XQX5a+8kE3Qf+d1MqVhd+qnpWu1oEcBONXobPTTZy78kx0y2A:GaRB9xN46XQX5a+WQ2v+qnp9QO+rYItI
Malware Config
Extracted
bitrat
1.38
firewall.publicvm.com:25874
-
communication_password
a20ba4fb329f7dc66c0dd3562e9f9984
-
tor_process
tor
Signatures
-
Detect ZGRat V1 34 IoCs
Processes:
resource yara_rule behavioral1/memory/1984-39-0x0000000004440000-0x00000000044C0000-memory.dmp family_zgrat_v1 behavioral1/memory/1984-57-0x0000000004440000-0x00000000044BA000-memory.dmp family_zgrat_v1 behavioral1/memory/1984-83-0x0000000004440000-0x00000000044BA000-memory.dmp family_zgrat_v1 behavioral1/memory/1984-103-0x0000000004440000-0x00000000044BA000-memory.dmp family_zgrat_v1 behavioral1/memory/1984-101-0x0000000004440000-0x00000000044BA000-memory.dmp family_zgrat_v1 behavioral1/memory/1984-99-0x0000000004440000-0x00000000044BA000-memory.dmp family_zgrat_v1 behavioral1/memory/1984-97-0x0000000004440000-0x00000000044BA000-memory.dmp family_zgrat_v1 behavioral1/memory/1984-95-0x0000000004440000-0x00000000044BA000-memory.dmp family_zgrat_v1 behavioral1/memory/1984-93-0x0000000004440000-0x00000000044BA000-memory.dmp family_zgrat_v1 behavioral1/memory/1984-91-0x0000000004440000-0x00000000044BA000-memory.dmp family_zgrat_v1 behavioral1/memory/1984-89-0x0000000004440000-0x00000000044BA000-memory.dmp family_zgrat_v1 behavioral1/memory/1984-87-0x0000000004440000-0x00000000044BA000-memory.dmp family_zgrat_v1 behavioral1/memory/1984-85-0x0000000004440000-0x00000000044BA000-memory.dmp family_zgrat_v1 behavioral1/memory/1984-81-0x0000000004440000-0x00000000044BA000-memory.dmp family_zgrat_v1 behavioral1/memory/1984-79-0x0000000004440000-0x00000000044BA000-memory.dmp family_zgrat_v1 behavioral1/memory/1984-77-0x0000000004440000-0x00000000044BA000-memory.dmp family_zgrat_v1 behavioral1/memory/1984-75-0x0000000004440000-0x00000000044BA000-memory.dmp family_zgrat_v1 behavioral1/memory/1984-73-0x0000000004440000-0x00000000044BA000-memory.dmp family_zgrat_v1 behavioral1/memory/1984-71-0x0000000004440000-0x00000000044BA000-memory.dmp family_zgrat_v1 behavioral1/memory/1984-69-0x0000000004440000-0x00000000044BA000-memory.dmp family_zgrat_v1 behavioral1/memory/1984-67-0x0000000004440000-0x00000000044BA000-memory.dmp family_zgrat_v1 behavioral1/memory/1984-65-0x0000000004440000-0x00000000044BA000-memory.dmp family_zgrat_v1 behavioral1/memory/1984-63-0x0000000004440000-0x00000000044BA000-memory.dmp family_zgrat_v1 behavioral1/memory/1984-61-0x0000000004440000-0x00000000044BA000-memory.dmp family_zgrat_v1 behavioral1/memory/1984-59-0x0000000004440000-0x00000000044BA000-memory.dmp family_zgrat_v1 behavioral1/memory/1984-55-0x0000000004440000-0x00000000044BA000-memory.dmp family_zgrat_v1 behavioral1/memory/1984-53-0x0000000004440000-0x00000000044BA000-memory.dmp family_zgrat_v1 behavioral1/memory/1984-51-0x0000000004440000-0x00000000044BA000-memory.dmp family_zgrat_v1 behavioral1/memory/1984-49-0x0000000004440000-0x00000000044BA000-memory.dmp family_zgrat_v1 behavioral1/memory/1984-47-0x0000000004440000-0x00000000044BA000-memory.dmp family_zgrat_v1 behavioral1/memory/1984-45-0x0000000004440000-0x00000000044BA000-memory.dmp family_zgrat_v1 behavioral1/memory/1984-43-0x0000000004440000-0x00000000044BA000-memory.dmp family_zgrat_v1 behavioral1/memory/1984-41-0x0000000004440000-0x00000000044BA000-memory.dmp family_zgrat_v1 behavioral1/memory/1984-40-0x0000000004440000-0x00000000044BA000-memory.dmp family_zgrat_v1 -
Executes dropped EXE 3 IoCs
Processes:
Sys.pifBF4PureCracker0.exepid process 1984 Sys.pif 1728 BF4PureCracker0.exe 1268 -
Loads dropped DLL 6 IoCs
Processes:
371b336da91abd01bf0522c7cbf47934.exepid process 2912 371b336da91abd01bf0522c7cbf47934.exe 2912 371b336da91abd01bf0522c7cbf47934.exe 2912 371b336da91abd01bf0522c7cbf47934.exe 2912 371b336da91abd01bf0522c7cbf47934.exe 2912 371b336da91abd01bf0522c7cbf47934.exe 1432 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
BF4PureCracker0.exepid process 1728 BF4PureCracker0.exe 1728 BF4PureCracker0.exe 1728 BF4PureCracker0.exe 1728 BF4PureCracker0.exe 1728 BF4PureCracker0.exe 1728 BF4PureCracker0.exe 1728 BF4PureCracker0.exe 1728 BF4PureCracker0.exe 1728 BF4PureCracker0.exe 1728 BF4PureCracker0.exe 1728 BF4PureCracker0.exe 1728 BF4PureCracker0.exe 1728 BF4PureCracker0.exe 1728 BF4PureCracker0.exe 1728 BF4PureCracker0.exe 1728 BF4PureCracker0.exe 1728 BF4PureCracker0.exe 1728 BF4PureCracker0.exe 1728 BF4PureCracker0.exe 1728 BF4PureCracker0.exe 1728 BF4PureCracker0.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
BF4PureCracker0.exeSys.pifdescription pid process Token: SeDebugPrivilege 1728 BF4PureCracker0.exe Token: SeDebugPrivilege 1984 Sys.pif -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
BF4PureCracker0.exepid process 1728 BF4PureCracker0.exe 1728 BF4PureCracker0.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
BF4PureCracker0.exepid process 1728 BF4PureCracker0.exe 1728 BF4PureCracker0.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
BF4PureCracker0.exepid process 1728 BF4PureCracker0.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
371b336da91abd01bf0522c7cbf47934.exeSys.pifdescription pid process target process PID 2912 wrote to memory of 1984 2912 371b336da91abd01bf0522c7cbf47934.exe Sys.pif PID 2912 wrote to memory of 1984 2912 371b336da91abd01bf0522c7cbf47934.exe Sys.pif PID 2912 wrote to memory of 1984 2912 371b336da91abd01bf0522c7cbf47934.exe Sys.pif PID 2912 wrote to memory of 1984 2912 371b336da91abd01bf0522c7cbf47934.exe Sys.pif PID 2912 wrote to memory of 1728 2912 371b336da91abd01bf0522c7cbf47934.exe BF4PureCracker0.exe PID 2912 wrote to memory of 1728 2912 371b336da91abd01bf0522c7cbf47934.exe BF4PureCracker0.exe PID 2912 wrote to memory of 1728 2912 371b336da91abd01bf0522c7cbf47934.exe BF4PureCracker0.exe PID 2912 wrote to memory of 1728 2912 371b336da91abd01bf0522c7cbf47934.exe BF4PureCracker0.exe PID 1984 wrote to memory of 1028 1984 Sys.pif WScript.exe PID 1984 wrote to memory of 1028 1984 Sys.pif WScript.exe PID 1984 wrote to memory of 1028 1984 Sys.pif WScript.exe PID 1984 wrote to memory of 1028 1984 Sys.pif WScript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\371b336da91abd01bf0522c7cbf47934.exe"C:\Users\Admin\AppData\Local\Temp\371b336da91abd01bf0522c7cbf47934.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Origin\Install\Setup\Battlefield4\ErrorAssistant\BF4PureCracker0.exe"C:\Users\Admin\AppData\Local\Origin\Install\Setup\Battlefield4\ErrorAssistant\BF4PureCracker0.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Origin\Install\Setup\Battlefield4\ErrorAssistant\Sys.pif"C:\Users\Admin\AppData\Local\Origin\Install\Setup\Battlefield4\ErrorAssistant\Sys.pif"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Rwxjsmgul.vbs"3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NVIDIA\nvcontainer.exe'4⤵
-
C:\Users\Admin\AppData\Local\Temp\Sys.pifC:\Users\Admin\AppData\Local\Temp\Sys.pif3⤵
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Origin\Install\Setup\Battlefield4\ErrorAssistant\Sys.pifMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Users\Admin\AppData\Local\Origin\Install\Setup\Battlefield4\ErrorAssistant\Sys.pifFilesize
92KB
MD5fe6b4f1938c275a87806c3d911f8cf84
SHA11ba251bfd983e1368e3b4eb0d63e9ad606b240e2
SHA256e13fa281ae5b41a164dfeba9f4e061862867d1194573a06fd1d77e7472e44e3b
SHA51268025c8a6e1e029dbe0baf1c535f59bedaac1a56891c16af92d6976edc9b4dbe883e20224cc056fc408773a9bf638094a49c679ffb871d65c0f5be2a15dabb33
-
memory/380-2511-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/380-2496-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1728-31-0x000000001C050000-0x000000001C112000-memory.dmpFilesize
776KB
-
memory/1728-32-0x000000001B9F0000-0x000000001BA70000-memory.dmpFilesize
512KB
-
memory/1728-33-0x000000001B9F0000-0x000000001BA70000-memory.dmpFilesize
512KB
-
memory/1728-29-0x000000001B9F0000-0x000000001BA70000-memory.dmpFilesize
512KB
-
memory/1728-28-0x000007FEF5150000-0x000007FEF5B3C000-memory.dmpFilesize
9.9MB
-
memory/1728-2493-0x000000001B9F0000-0x000000001BA70000-memory.dmpFilesize
512KB
-
memory/1728-26-0x0000000000850000-0x0000000000902000-memory.dmpFilesize
712KB
-
memory/1728-2494-0x000000001B9F0000-0x000000001BA70000-memory.dmpFilesize
512KB
-
memory/1728-36-0x000007FEF5150000-0x000007FEF5B3C000-memory.dmpFilesize
9.9MB
-
memory/1728-37-0x000000001B9F0000-0x000000001BA70000-memory.dmpFilesize
512KB
-
memory/1816-2497-0x000000006ED00000-0x000000006F2AB000-memory.dmpFilesize
5.7MB
-
memory/1816-2500-0x000000006ED00000-0x000000006F2AB000-memory.dmpFilesize
5.7MB
-
memory/1816-2499-0x0000000000480000-0x00000000004C0000-memory.dmpFilesize
256KB
-
memory/1816-2501-0x0000000000480000-0x00000000004C0000-memory.dmpFilesize
256KB
-
memory/1816-2498-0x0000000000480000-0x00000000004C0000-memory.dmpFilesize
256KB
-
memory/1816-2502-0x000000006ED00000-0x000000006F2AB000-memory.dmpFilesize
5.7MB
-
memory/1984-77-0x0000000004440000-0x00000000044BA000-memory.dmpFilesize
488KB
-
memory/1984-53-0x0000000004440000-0x00000000044BA000-memory.dmpFilesize
488KB
-
memory/1984-95-0x0000000004440000-0x00000000044BA000-memory.dmpFilesize
488KB
-
memory/1984-93-0x0000000004440000-0x00000000044BA000-memory.dmpFilesize
488KB
-
memory/1984-91-0x0000000004440000-0x00000000044BA000-memory.dmpFilesize
488KB
-
memory/1984-89-0x0000000004440000-0x00000000044BA000-memory.dmpFilesize
488KB
-
memory/1984-87-0x0000000004440000-0x00000000044BA000-memory.dmpFilesize
488KB
-
memory/1984-85-0x0000000004440000-0x00000000044BA000-memory.dmpFilesize
488KB
-
memory/1984-81-0x0000000004440000-0x00000000044BA000-memory.dmpFilesize
488KB
-
memory/1984-79-0x0000000004440000-0x00000000044BA000-memory.dmpFilesize
488KB
-
memory/1984-99-0x0000000004440000-0x00000000044BA000-memory.dmpFilesize
488KB
-
memory/1984-75-0x0000000004440000-0x00000000044BA000-memory.dmpFilesize
488KB
-
memory/1984-73-0x0000000004440000-0x00000000044BA000-memory.dmpFilesize
488KB
-
memory/1984-71-0x0000000004440000-0x00000000044BA000-memory.dmpFilesize
488KB
-
memory/1984-69-0x0000000004440000-0x00000000044BA000-memory.dmpFilesize
488KB
-
memory/1984-67-0x0000000004440000-0x00000000044BA000-memory.dmpFilesize
488KB
-
memory/1984-65-0x0000000004440000-0x00000000044BA000-memory.dmpFilesize
488KB
-
memory/1984-63-0x0000000004440000-0x00000000044BA000-memory.dmpFilesize
488KB
-
memory/1984-61-0x0000000004440000-0x00000000044BA000-memory.dmpFilesize
488KB
-
memory/1984-59-0x0000000004440000-0x00000000044BA000-memory.dmpFilesize
488KB
-
memory/1984-55-0x0000000004440000-0x00000000044BA000-memory.dmpFilesize
488KB
-
memory/1984-97-0x0000000004440000-0x00000000044BA000-memory.dmpFilesize
488KB
-
memory/1984-51-0x0000000004440000-0x00000000044BA000-memory.dmpFilesize
488KB
-
memory/1984-955-0x0000000004400000-0x0000000004440000-memory.dmpFilesize
256KB
-
memory/1984-49-0x0000000004440000-0x00000000044BA000-memory.dmpFilesize
488KB
-
memory/1984-47-0x0000000004440000-0x00000000044BA000-memory.dmpFilesize
488KB
-
memory/1984-45-0x0000000004440000-0x00000000044BA000-memory.dmpFilesize
488KB
-
memory/1984-43-0x0000000004440000-0x00000000044BA000-memory.dmpFilesize
488KB
-
memory/1984-41-0x0000000004440000-0x00000000044BA000-memory.dmpFilesize
488KB
-
memory/1984-40-0x0000000004440000-0x00000000044BA000-memory.dmpFilesize
488KB
-
memory/1984-101-0x0000000004440000-0x00000000044BA000-memory.dmpFilesize
488KB
-
memory/1984-2495-0x0000000072C90000-0x000000007337E000-memory.dmpFilesize
6.9MB
-
memory/1984-103-0x0000000004440000-0x00000000044BA000-memory.dmpFilesize
488KB
-
memory/1984-83-0x0000000004440000-0x00000000044BA000-memory.dmpFilesize
488KB
-
memory/1984-57-0x0000000004440000-0x00000000044BA000-memory.dmpFilesize
488KB
-
memory/1984-39-0x0000000004440000-0x00000000044C0000-memory.dmpFilesize
512KB
-
memory/1984-38-0x0000000008040000-0x0000000008256000-memory.dmpFilesize
2.1MB
-
memory/1984-35-0x0000000072C90000-0x000000007337E000-memory.dmpFilesize
6.9MB
-
memory/1984-30-0x0000000004400000-0x0000000004440000-memory.dmpFilesize
256KB
-
memory/1984-27-0x0000000072C90000-0x000000007337E000-memory.dmpFilesize
6.9MB
-
memory/1984-25-0x00000000000D0000-0x0000000000308000-memory.dmpFilesize
2.2MB