Analysis
-
max time kernel
0s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
10-01-2024 19:35
Static task
static1
Behavioral task
behavioral1
Sample
371b336da91abd01bf0522c7cbf47934.exe
Resource
win7-20231215-en
General
-
Target
371b336da91abd01bf0522c7cbf47934.exe
-
Size
2.9MB
-
MD5
371b336da91abd01bf0522c7cbf47934
-
SHA1
dca225e7018a9b628f2ae0998e6a01e7576751e4
-
SHA256
28952976aeedba181c346d3180d389d540c7a341b69e23d92529825820c4d06e
-
SHA512
52105ae02bab6066011e9bc9e4b06a2e79f90c92164974bc6508214c9234b04b29aeddc5715e73fe2fd93bc7b03644baf301f5e06c12243063e0361a56e55446
-
SSDEEP
49152:x6PaI2dBi0xNC76XQX5a+8kE3Qf+d1MqVhd+qnpWu1oEcBONXobPTTZy78kx0y2A:GaRB9xN46XQX5a+WQ2v+qnp9QO+rYItI
Malware Config
Extracted
bitrat
1.38
firewall.publicvm.com:25874
-
communication_password
a20ba4fb329f7dc66c0dd3562e9f9984
-
tor_process
tor
Signatures
-
Detect ZGRat V1 34 IoCs
Processes:
resource yara_rule behavioral1/memory/2312-39-0x0000000007E90000-0x0000000007F10000-memory.dmp family_zgrat_v1 behavioral1/memory/2312-93-0x0000000007E90000-0x0000000007F0A000-memory.dmp family_zgrat_v1 behavioral1/memory/2312-103-0x0000000007E90000-0x0000000007F0A000-memory.dmp family_zgrat_v1 behavioral1/memory/2312-101-0x0000000007E90000-0x0000000007F0A000-memory.dmp family_zgrat_v1 behavioral1/memory/2312-99-0x0000000007E90000-0x0000000007F0A000-memory.dmp family_zgrat_v1 behavioral1/memory/2312-97-0x0000000007E90000-0x0000000007F0A000-memory.dmp family_zgrat_v1 behavioral1/memory/2312-95-0x0000000007E90000-0x0000000007F0A000-memory.dmp family_zgrat_v1 behavioral1/memory/2312-91-0x0000000007E90000-0x0000000007F0A000-memory.dmp family_zgrat_v1 behavioral1/memory/2312-89-0x0000000007E90000-0x0000000007F0A000-memory.dmp family_zgrat_v1 behavioral1/memory/2312-87-0x0000000007E90000-0x0000000007F0A000-memory.dmp family_zgrat_v1 behavioral1/memory/2312-85-0x0000000007E90000-0x0000000007F0A000-memory.dmp family_zgrat_v1 behavioral1/memory/2312-83-0x0000000007E90000-0x0000000007F0A000-memory.dmp family_zgrat_v1 behavioral1/memory/2312-81-0x0000000007E90000-0x0000000007F0A000-memory.dmp family_zgrat_v1 behavioral1/memory/2312-79-0x0000000007E90000-0x0000000007F0A000-memory.dmp family_zgrat_v1 behavioral1/memory/2312-77-0x0000000007E90000-0x0000000007F0A000-memory.dmp family_zgrat_v1 behavioral1/memory/2312-75-0x0000000007E90000-0x0000000007F0A000-memory.dmp family_zgrat_v1 behavioral1/memory/2312-73-0x0000000007E90000-0x0000000007F0A000-memory.dmp family_zgrat_v1 behavioral1/memory/2312-71-0x0000000007E90000-0x0000000007F0A000-memory.dmp family_zgrat_v1 behavioral1/memory/2312-69-0x0000000007E90000-0x0000000007F0A000-memory.dmp family_zgrat_v1 behavioral1/memory/2312-67-0x0000000007E90000-0x0000000007F0A000-memory.dmp family_zgrat_v1 behavioral1/memory/2312-65-0x0000000007E90000-0x0000000007F0A000-memory.dmp family_zgrat_v1 behavioral1/memory/2312-63-0x0000000007E90000-0x0000000007F0A000-memory.dmp family_zgrat_v1 behavioral1/memory/2312-61-0x0000000007E90000-0x0000000007F0A000-memory.dmp family_zgrat_v1 behavioral1/memory/2312-59-0x0000000007E90000-0x0000000007F0A000-memory.dmp family_zgrat_v1 behavioral1/memory/2312-57-0x0000000007E90000-0x0000000007F0A000-memory.dmp family_zgrat_v1 behavioral1/memory/2312-55-0x0000000007E90000-0x0000000007F0A000-memory.dmp family_zgrat_v1 behavioral1/memory/2312-53-0x0000000007E90000-0x0000000007F0A000-memory.dmp family_zgrat_v1 behavioral1/memory/2312-51-0x0000000007E90000-0x0000000007F0A000-memory.dmp family_zgrat_v1 behavioral1/memory/2312-49-0x0000000007E90000-0x0000000007F0A000-memory.dmp family_zgrat_v1 behavioral1/memory/2312-47-0x0000000007E90000-0x0000000007F0A000-memory.dmp family_zgrat_v1 behavioral1/memory/2312-45-0x0000000007E90000-0x0000000007F0A000-memory.dmp family_zgrat_v1 behavioral1/memory/2312-43-0x0000000007E90000-0x0000000007F0A000-memory.dmp family_zgrat_v1 behavioral1/memory/2312-41-0x0000000007E90000-0x0000000007F0A000-memory.dmp family_zgrat_v1 behavioral1/memory/2312-40-0x0000000007E90000-0x0000000007F0A000-memory.dmp family_zgrat_v1 -
Executes dropped EXE 1 IoCs
Processes:
Sys.pifpid process 2312 Sys.pif -
Loads dropped DLL 4 IoCs
Processes:
371b336da91abd01bf0522c7cbf47934.exepid process 2356 371b336da91abd01bf0522c7cbf47934.exe 2356 371b336da91abd01bf0522c7cbf47934.exe 2356 371b336da91abd01bf0522c7cbf47934.exe 2356 371b336da91abd01bf0522c7cbf47934.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
371b336da91abd01bf0522c7cbf47934.exedescription pid process target process PID 2356 wrote to memory of 2312 2356 371b336da91abd01bf0522c7cbf47934.exe Sys.pif PID 2356 wrote to memory of 2312 2356 371b336da91abd01bf0522c7cbf47934.exe Sys.pif PID 2356 wrote to memory of 2312 2356 371b336da91abd01bf0522c7cbf47934.exe Sys.pif PID 2356 wrote to memory of 2312 2356 371b336da91abd01bf0522c7cbf47934.exe Sys.pif
Processes
-
C:\Users\Admin\AppData\Local\Temp\371b336da91abd01bf0522c7cbf47934.exe"C:\Users\Admin\AppData\Local\Temp\371b336da91abd01bf0522c7cbf47934.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Origin\Install\Setup\Battlefield4\ErrorAssistant\BF4PureCracker0.exe"C:\Users\Admin\AppData\Local\Origin\Install\Setup\Battlefield4\ErrorAssistant\BF4PureCracker0.exe"2⤵
-
C:\Users\Admin\AppData\Local\Origin\Install\Setup\Battlefield4\ErrorAssistant\Sys.pif"C:\Users\Admin\AppData\Local\Origin\Install\Setup\Battlefield4\ErrorAssistant\Sys.pif"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Sys.pifC:\Users\Admin\AppData\Local\Temp\Sys.pif3⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Rwxjsmgul.vbs"3⤵
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NVIDIA\nvcontainer.exe'1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Origin\Install\Setup\Battlefield4\ErrorAssistant\Sys.pifMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Users\Admin\AppData\Local\Origin\Install\Setup\Battlefield4\ErrorAssistant\Sys.pifFilesize
92KB
MD50e6e088d5c265893fb96ae09dcc563dc
SHA1ace31919006e609076e49b9cf44b3c58be6ca0b2
SHA2562d48521dcf66ba1213ebcf4d53d698b408f2855fdd5b4f45c022bee91ee9f3dd
SHA512a213c691c145eab4e64c1cda36adb335c74299c20fb2406a484d961ca9ec05ac96c9af63b16ddab989b1e44858b102e4c0f43ed7a70cef5f659ae051cbdf88f4
-
memory/2288-36-0x0000000000A60000-0x0000000000AE0000-memory.dmpFilesize
512KB
-
memory/2288-26-0x0000000000890000-0x0000000000942000-memory.dmpFilesize
712KB
-
memory/2288-28-0x0000000000A60000-0x0000000000AE0000-memory.dmpFilesize
512KB
-
memory/2288-29-0x000007FEF5C70000-0x000007FEF665C000-memory.dmpFilesize
9.9MB
-
memory/2288-31-0x000000001B710000-0x000000001B7D2000-memory.dmpFilesize
776KB
-
memory/2288-33-0x0000000000A60000-0x0000000000AE0000-memory.dmpFilesize
512KB
-
memory/2288-32-0x0000000000A60000-0x0000000000AE0000-memory.dmpFilesize
512KB
-
memory/2288-2493-0x0000000000A60000-0x0000000000AE0000-memory.dmpFilesize
512KB
-
memory/2288-37-0x000007FEF5C70000-0x000007FEF665C000-memory.dmpFilesize
9.9MB
-
memory/2312-75-0x0000000007E90000-0x0000000007F0A000-memory.dmpFilesize
488KB
-
memory/2312-63-0x0000000007E90000-0x0000000007F0A000-memory.dmpFilesize
488KB
-
memory/2312-30-0x0000000004B40000-0x0000000004B80000-memory.dmpFilesize
256KB
-
memory/2312-38-0x0000000005E70000-0x0000000006086000-memory.dmpFilesize
2.1MB
-
memory/2312-39-0x0000000007E90000-0x0000000007F10000-memory.dmpFilesize
512KB
-
memory/2312-93-0x0000000007E90000-0x0000000007F0A000-memory.dmpFilesize
488KB
-
memory/2312-103-0x0000000007E90000-0x0000000007F0A000-memory.dmpFilesize
488KB
-
memory/2312-101-0x0000000007E90000-0x0000000007F0A000-memory.dmpFilesize
488KB
-
memory/2312-99-0x0000000007E90000-0x0000000007F0A000-memory.dmpFilesize
488KB
-
memory/2312-97-0x0000000007E90000-0x0000000007F0A000-memory.dmpFilesize
488KB
-
memory/2312-95-0x0000000007E90000-0x0000000007F0A000-memory.dmpFilesize
488KB
-
memory/2312-91-0x0000000007E90000-0x0000000007F0A000-memory.dmpFilesize
488KB
-
memory/2312-89-0x0000000007E90000-0x0000000007F0A000-memory.dmpFilesize
488KB
-
memory/2312-87-0x0000000007E90000-0x0000000007F0A000-memory.dmpFilesize
488KB
-
memory/2312-85-0x0000000007E90000-0x0000000007F0A000-memory.dmpFilesize
488KB
-
memory/2312-83-0x0000000007E90000-0x0000000007F0A000-memory.dmpFilesize
488KB
-
memory/2312-81-0x0000000007E90000-0x0000000007F0A000-memory.dmpFilesize
488KB
-
memory/2312-79-0x0000000007E90000-0x0000000007F0A000-memory.dmpFilesize
488KB
-
memory/2312-77-0x0000000007E90000-0x0000000007F0A000-memory.dmpFilesize
488KB
-
memory/2312-25-0x0000000000170000-0x00000000003A8000-memory.dmpFilesize
2.2MB
-
memory/2312-73-0x0000000007E90000-0x0000000007F0A000-memory.dmpFilesize
488KB
-
memory/2312-71-0x0000000007E90000-0x0000000007F0A000-memory.dmpFilesize
488KB
-
memory/2312-69-0x0000000007E90000-0x0000000007F0A000-memory.dmpFilesize
488KB
-
memory/2312-67-0x0000000007E90000-0x0000000007F0A000-memory.dmpFilesize
488KB
-
memory/2312-65-0x0000000007E90000-0x0000000007F0A000-memory.dmpFilesize
488KB
-
memory/2312-35-0x0000000073630000-0x0000000073D1E000-memory.dmpFilesize
6.9MB
-
memory/2312-61-0x0000000007E90000-0x0000000007F0A000-memory.dmpFilesize
488KB
-
memory/2312-59-0x0000000007E90000-0x0000000007F0A000-memory.dmpFilesize
488KB
-
memory/2312-57-0x0000000007E90000-0x0000000007F0A000-memory.dmpFilesize
488KB
-
memory/2312-55-0x0000000007E90000-0x0000000007F0A000-memory.dmpFilesize
488KB
-
memory/2312-53-0x0000000007E90000-0x0000000007F0A000-memory.dmpFilesize
488KB
-
memory/2312-51-0x0000000007E90000-0x0000000007F0A000-memory.dmpFilesize
488KB
-
memory/2312-49-0x0000000007E90000-0x0000000007F0A000-memory.dmpFilesize
488KB
-
memory/2312-1031-0x0000000004B40000-0x0000000004B80000-memory.dmpFilesize
256KB
-
memory/2312-47-0x0000000007E90000-0x0000000007F0A000-memory.dmpFilesize
488KB
-
memory/2312-45-0x0000000007E90000-0x0000000007F0A000-memory.dmpFilesize
488KB
-
memory/2312-43-0x0000000007E90000-0x0000000007F0A000-memory.dmpFilesize
488KB
-
memory/2312-41-0x0000000007E90000-0x0000000007F0A000-memory.dmpFilesize
488KB
-
memory/2312-40-0x0000000007E90000-0x0000000007F0A000-memory.dmpFilesize
488KB
-
memory/2312-2489-0x0000000073630000-0x0000000073D1E000-memory.dmpFilesize
6.9MB
-
memory/2312-27-0x0000000073630000-0x0000000073D1E000-memory.dmpFilesize
6.9MB
-
memory/2344-2492-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2344-2508-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2424-2494-0x0000000073770000-0x0000000073D1B000-memory.dmpFilesize
5.7MB
-
memory/2424-2498-0x0000000002740000-0x0000000002780000-memory.dmpFilesize
256KB
-
memory/2424-2497-0x0000000002740000-0x0000000002780000-memory.dmpFilesize
256KB
-
memory/2424-2496-0x0000000002740000-0x0000000002780000-memory.dmpFilesize
256KB
-
memory/2424-2495-0x0000000073770000-0x0000000073D1B000-memory.dmpFilesize
5.7MB
-
memory/2424-2499-0x0000000073770000-0x0000000073D1B000-memory.dmpFilesize
5.7MB