Analysis

  • max time kernel
    142s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    12/01/2024, 23:33

General

  • Target

    493807123c2e449d0dcfdbd3443d083aef30a6aaea42381290572bab06090c0b.exe

  • Size

    5.1MB

  • MD5

    cae49b754cd4f40f428eaa78ceeef195

  • SHA1

    c83006a616cef6e50254598ba869f8c1fef03d28

  • SHA256

    493807123c2e449d0dcfdbd3443d083aef30a6aaea42381290572bab06090c0b

  • SHA512

    40465396da861b69140139a493c21e8be32a7b5b03631381bbb3a04ea681c4d374a0046a82feda160a3414930af8f8bf460ce43d1a8559be93e6aec2bc315f52

  • SSDEEP

    98304:Ab+ge5mSVzQzRNWDs4vCS7W5IeouyUKylP1uniL8OspPYB:AbG5dV0dNWI6CS7xnuyUCiL5spPk

Malware Config

Signatures

  • Detect ZGRat V1 1 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 5 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • .NET Reactor proctector 1 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\493807123c2e449d0dcfdbd3443d083aef30a6aaea42381290572bab06090c0b.exe
    "C:\Users\Admin\AppData\Local\Temp\493807123c2e449d0dcfdbd3443d083aef30a6aaea42381290572bab06090c0b.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2508
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2588
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 712
      2⤵
      • Program crash
      PID:1460

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\tmp8F95.tmp

          Filesize

          20KB

          MD5

          c9ff7748d8fcef4cf84a5501e996a641

          SHA1

          02867e5010f62f97ebb0cfb32cb3ede9449fe0c9

          SHA256

          4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988

          SHA512

          d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

        • \Users\Admin\AppData\Local\Temp\Protect544cd51a.dll

          Filesize

          5KB

          MD5

          3be59169f86046fe4c71f05b17ff7b89

          SHA1

          aa6a40c2a6e4a7ce80598df79a6b98c54bf9c2ca

          SHA256

          357062ec96e54faf287c7fc6c2be3c840aa3ee0d57ded4addbb026bdef2171eb

          SHA512

          2afbcf3ec8ccdf8066532dd8510c4c48475d95410aa2266aba1d9448a418b8e631c31e94ceb2d354eede6c521efd5b7b611c863084e252220754cfebee32f690

        • memory/2508-45-0x0000000005180000-0x00000000051C0000-memory.dmp

          Filesize

          256KB

        • memory/2508-0-0x0000000074C70000-0x000000007535E000-memory.dmp

          Filesize

          6.9MB

        • memory/2508-4-0x0000000006A20000-0x0000000006DC6000-memory.dmp

          Filesize

          3.6MB

        • memory/2508-2-0x0000000074C70000-0x000000007535E000-memory.dmp

          Filesize

          6.9MB

        • memory/2508-14-0x0000000005180000-0x00000000051C0000-memory.dmp

          Filesize

          256KB

        • memory/2508-17-0x0000000005180000-0x00000000051C0000-memory.dmp

          Filesize

          256KB

        • memory/2508-50-0x00000000082E0000-0x00000000083E0000-memory.dmp

          Filesize

          1024KB

        • memory/2508-51-0x0000000005180000-0x00000000051C0000-memory.dmp

          Filesize

          256KB

        • memory/2508-52-0x0000000005180000-0x00000000051C0000-memory.dmp

          Filesize

          256KB

        • memory/2508-13-0x0000000000340000-0x0000000000350000-memory.dmp

          Filesize

          64KB

        • memory/2508-47-0x0000000005180000-0x00000000051C0000-memory.dmp

          Filesize

          256KB

        • memory/2508-48-0x0000000005180000-0x00000000051C0000-memory.dmp

          Filesize

          256KB

        • memory/2508-49-0x0000000005180000-0x00000000051C0000-memory.dmp

          Filesize

          256KB

        • memory/2508-46-0x0000000005180000-0x00000000051C0000-memory.dmp

          Filesize

          256KB

        • memory/2508-44-0x0000000005180000-0x00000000051C0000-memory.dmp

          Filesize

          256KB

        • memory/2508-20-0x0000000005180000-0x00000000051C0000-memory.dmp

          Filesize

          256KB

        • memory/2508-19-0x0000000005180000-0x00000000051C0000-memory.dmp

          Filesize

          256KB

        • memory/2508-18-0x00000000082E0000-0x00000000083E0000-memory.dmp

          Filesize

          1024KB

        • memory/2508-3-0x0000000005180000-0x00000000051C0000-memory.dmp

          Filesize

          256KB

        • memory/2508-15-0x0000000005180000-0x00000000051C0000-memory.dmp

          Filesize

          256KB

        • memory/2508-16-0x0000000005180000-0x00000000051C0000-memory.dmp

          Filesize

          256KB

        • memory/2508-12-0x0000000005180000-0x00000000051C0000-memory.dmp

          Filesize

          256KB

        • memory/2508-11-0x0000000005180000-0x00000000051C0000-memory.dmp

          Filesize

          256KB

        • memory/2508-10-0x0000000005180000-0x00000000051C0000-memory.dmp

          Filesize

          256KB

        • memory/2508-5-0x0000000008040000-0x00000000081D2000-memory.dmp

          Filesize

          1.6MB

        • memory/2508-1-0x0000000000A70000-0x0000000000F7C000-memory.dmp

          Filesize

          5.0MB

        • memory/2508-43-0x0000000005180000-0x00000000051C0000-memory.dmp

          Filesize

          256KB

        • memory/2508-42-0x0000000005180000-0x00000000051C0000-memory.dmp

          Filesize

          256KB

        • memory/2588-29-0x0000000000400000-0x00000000004D2000-memory.dmp

          Filesize

          840KB

        • memory/2588-22-0x0000000000400000-0x00000000004D2000-memory.dmp

          Filesize

          840KB

        • memory/2588-23-0x0000000000400000-0x00000000004D2000-memory.dmp

          Filesize

          840KB

        • memory/2588-24-0x0000000000400000-0x00000000004D2000-memory.dmp

          Filesize

          840KB

        • memory/2588-25-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/2588-27-0x0000000000400000-0x00000000004D2000-memory.dmp

          Filesize

          840KB

        • memory/2588-32-0x0000000074C70000-0x000000007535E000-memory.dmp

          Filesize

          6.9MB

        • memory/2588-31-0x0000000000400000-0x00000000004D2000-memory.dmp

          Filesize

          840KB

        • memory/2588-21-0x0000000000400000-0x00000000004D2000-memory.dmp

          Filesize

          840KB

        • memory/2588-53-0x0000000074C70000-0x000000007535E000-memory.dmp

          Filesize

          6.9MB