Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
12/01/2024, 17:52
General
- Target file.exe
- Size 6.5MB
- Sample240112-wfqecacgen
- SHA256 897b63dc56623c54120c95340a7e8c416786dbc18bb03dae3300ab2fd57e928a
Malware Config
Signatures
- Detect ZGRat V1 1 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Drops startup file 1 IoCs
- Loads dropped DLL 1 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Protect544cd51a.dll
tmpBCAB.tmp
tmpBCCD.tmp
memory/1412-29-0x0000000006960000-0x0000000006E8C000-memory.dmp
memory/1412-60-0x0000000074480000-0x0000000074C30000-memory.dmp
memory/1412-61-0x0000000005550000-0x0000000005562000-memory.dmp
memory/1412-31-0x0000000005DD0000-0x0000000005E36000-memory.dmp
memory/1412-30-0x0000000005CC0000-0x0000000005CDE000-memory.dmp
memory/1412-25-0x0000000005700000-0x00000000058C2000-memory.dmp
memory/1412-62-0x0000000005910000-0x000000000594C000-memory.dmp
memory/1412-28-0x00000000055B0000-0x0000000005626000-memory.dmp
memory/1412-22-0x0000000000400000-0x00000000004D4000-memory.dmp
memory/1412-26-0x0000000005E80000-0x0000000006424000-memory.dmp
memory/1412-24-0x0000000005360000-0x00000000053F2000-memory.dmp
memory/1412-23-0x0000000074480000-0x0000000074C30000-memory.dmp
memory/1412-27-0x0000000005490000-0x00000000054E0000-memory.dmp
memory/4112-19-0x00000000072A0000-0x00000000073A0000-memory.dmp
memory/4112-6-0x0000000006E60000-0x0000000006FF2000-memory.dmp
memory/4112-14-0x0000000005850000-0x0000000005860000-memory.dmp
memory/4112-17-0x0000000005850000-0x0000000005860000-memory.dmp
memory/4112-21-0x00000000072A0000-0x00000000073A0000-memory.dmp
memory/4112-13-0x0000000005850000-0x0000000005860000-memory.dmp
memory/4112-18-0x0000000005850000-0x0000000005860000-memory.dmp
memory/4112-12-0x0000000005850000-0x0000000005860000-memory.dmp
memory/4112-1-0x0000000000600000-0x0000000000C6E000-memory.dmp
memory/4112-20-0x00000000072A0000-0x00000000073A0000-memory.dmp
memory/4112-16-0x0000000005850000-0x0000000005860000-memory.dmp
memory/4112-15-0x0000000005650000-0x0000000005660000-memory.dmp
memory/4112-5-0x0000000005AD0000-0x0000000005D30000-memory.dmp
memory/4112-4-0x0000000005850000-0x0000000005860000-memory.dmp
memory/4112-51-0x0000000005850000-0x0000000005860000-memory.dmp
memory/4112-50-0x0000000005850000-0x0000000005860000-memory.dmp
memory/4112-52-0x0000000005850000-0x0000000005860000-memory.dmp
memory/4112-53-0x0000000005850000-0x0000000005860000-memory.dmp
memory/4112-59-0x0000000074480000-0x0000000074C30000-memory.dmp
memory/4112-3-0x0000000074480000-0x0000000074C30000-memory.dmp
memory/4112-0-0x0000000074480000-0x0000000074C30000-memory.dmp
memory/4112-2-0x0000000005670000-0x000000000570C000-memory.dmp