Analysis
-
max time kernel
140s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
12/01/2024, 17:52
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20231215-en
General
-
Target
file.exe
-
Size
6.5MB
-
MD5
f18bb1edd3ae7b63144e96132ce9aefb
-
SHA1
c1e427cada1d7c0ffc7196d722ee6c0af82c2756
-
SHA256
897b63dc56623c54120c95340a7e8c416786dbc18bb03dae3300ab2fd57e928a
-
SHA512
d0036a1b6bab8786f45688a7d22a3dfd28a9ef21048b13aea72182b3599d1ebb22acd210e5c86883b0b3a81f755a1a1eebe9a7fac7eaf7b5235188cc3f5eab0b
-
SSDEEP
98304:ukWTppXqlbXXSKXiDvrfuh8AN8HJyeZaDN6h:ukWVtYbnSKXSvbSupyYaDNE
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
resource yara_rule behavioral1/memory/2236-1-0x0000000000BB0000-0x000000000121E000-memory.dmp family_zgrat_v1 -
SectopRAT payload 6 IoCs
resource yara_rule behavioral1/memory/2684-20-0x0000000000400000-0x00000000004D4000-memory.dmp family_sectoprat behavioral1/memory/2684-21-0x0000000000400000-0x00000000004D4000-memory.dmp family_sectoprat behavioral1/memory/2684-24-0x0000000000400000-0x00000000004D4000-memory.dmp family_sectoprat behavioral1/memory/2684-26-0x0000000000400000-0x00000000004D4000-memory.dmp family_sectoprat behavioral1/memory/2684-28-0x0000000000400000-0x00000000004D4000-memory.dmp family_sectoprat behavioral1/memory/2684-30-0x0000000004450000-0x0000000004490000-memory.dmp family_sectoprat -
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule behavioral1/memory/2236-1-0x0000000000BB0000-0x000000000121E000-memory.dmp net_reactor -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Eye_friendly_mode_with_customization.lnk file.exe -
Loads dropped DLL 1 IoCs
pid Process 2236 file.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2236 set thread context of 2684 2236 file.exe 28 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2684 InstallUtil.exe Token: SeDebugPrivilege 2236 file.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2684 2236 file.exe 28 PID 2236 wrote to memory of 2684 2236 file.exe 28 PID 2236 wrote to memory of 2684 2236 file.exe 28 PID 2236 wrote to memory of 2684 2236 file.exe 28 PID 2236 wrote to memory of 2684 2236 file.exe 28 PID 2236 wrote to memory of 2684 2236 file.exe 28 PID 2236 wrote to memory of 2684 2236 file.exe 28 PID 2236 wrote to memory of 2684 2236 file.exe 28 PID 2236 wrote to memory of 2684 2236 file.exe 28 PID 2236 wrote to memory of 2684 2236 file.exe 28 PID 2236 wrote to memory of 2684 2236 file.exe 28 PID 2236 wrote to memory of 2684 2236 file.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2684
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD5c9ff7748d8fcef4cf84a5501e996a641
SHA102867e5010f62f97ebb0cfb32cb3ede9449fe0c9
SHA2564d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988
SHA512d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73
-
Filesize
742KB
MD5544cd51a596619b78e9b54b70088307d
SHA14769ddd2dbc1dc44b758964ed0bd231b85880b65
SHA256dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd
SHA512f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719