Analysis
-
max time kernel
24s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
04-01-2024 03:23
General
-
Target
3fc4f59e7aa2ac0a1bffbc8d2e4d29dc.exe
-
Size
1.9MB
-
MD5
3fc4f59e7aa2ac0a1bffbc8d2e4d29dc
-
SHA1
b4ec80627dea1ce0cf48180ead2647c1e59a11f4
-
SHA256
e10ea81c37adf8e2d4d37fd1a7220318c7a83233b6abf4a79a12c756d3a3dc44
-
SHA512
c6f6dc178c563aa794f437ae72b2999695a98e97605dee9de4f053bf5b4e4838b1029377c35b6eb4b161f29834b78578c08a27f0455e4dc8bc1bfa24bb91fb97
-
SSDEEP
49152:3zjhkfO9FWUoQeoUwpicHo3vqAoPyoZxKIBBh7rN:3Xyf/YBYcI3vqThOAl
Malware Config
Signatures
-
Detect ZGRat V1 31 IoCs
-
RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
-
WebMonitor payload 1 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unexpected DNS network traffic destination 5 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3fc4f59e7aa2ac0a1bffbc8d2e4d29dc.exe"C:\Users\Admin\AppData\Local\Temp\3fc4f59e7aa2ac0a1bffbc8d2e4d29dc.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\MSBuild.exeC:\Users\Admin\AppData\Local\Temp\MSBuild.exe3⤵
-
-
-
C:\ProgramData\Anyname.exe"C:\ProgramData\Anyname.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
-
Filesize
16.0MB
-
Filesize
2.0MB
-
Filesize
16.0MB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
1.9MB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1.9MB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1.9MB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1.9MB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1.9MB
-
Filesize
1.3MB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
32KB
-
Filesize
1024KB
-
Filesize
1.3MB
-
Filesize
1.9MB
-
Filesize
1024KB
-
Filesize
1.9MB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1.9MB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1.5MB
-
Filesize
496KB
-
Filesize
1.5MB
-
Filesize
496KB
-
Filesize
1.5MB
-
Filesize
992KB
-
Filesize
520KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
1.5MB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
204KB
-
Filesize
6.9MB
-
Filesize
256KB