Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
12/01/2024, 17:52
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20231215-en
General
-
Target
file.exe
-
Size
6.5MB
-
MD5
f18bb1edd3ae7b63144e96132ce9aefb
-
SHA1
c1e427cada1d7c0ffc7196d722ee6c0af82c2756
-
SHA256
897b63dc56623c54120c95340a7e8c416786dbc18bb03dae3300ab2fd57e928a
-
SHA512
d0036a1b6bab8786f45688a7d22a3dfd28a9ef21048b13aea72182b3599d1ebb22acd210e5c86883b0b3a81f755a1a1eebe9a7fac7eaf7b5235188cc3f5eab0b
-
SSDEEP
98304:ukWTppXqlbXXSKXiDvrfuh8AN8HJyeZaDN6h:ukWVtYbnSKXSvbSupyYaDNE
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
resource yara_rule behavioral2/memory/4112-1-0x0000000000600000-0x0000000000C6E000-memory.dmp family_zgrat_v1 -
SectopRAT payload 1 IoCs
resource yara_rule behavioral2/memory/1412-22-0x0000000000400000-0x00000000004D4000-memory.dmp family_sectoprat -
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule behavioral2/memory/4112-1-0x0000000000600000-0x0000000000C6E000-memory.dmp net_reactor -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Eye_friendly_mode_with_customization.lnk file.exe -
Loads dropped DLL 1 IoCs
pid Process 4112 file.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4112 set thread context of 1412 4112 file.exe 100 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1412 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1412 InstallUtil.exe Token: SeDebugPrivilege 4112 file.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4112 wrote to memory of 1412 4112 file.exe 100 PID 4112 wrote to memory of 1412 4112 file.exe 100 PID 4112 wrote to memory of 1412 4112 file.exe 100 PID 4112 wrote to memory of 1412 4112 file.exe 100 PID 4112 wrote to memory of 1412 4112 file.exe 100 PID 4112 wrote to memory of 1412 4112 file.exe 100 PID 4112 wrote to memory of 1412 4112 file.exe 100 PID 4112 wrote to memory of 1412 4112 file.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1412
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
742KB
MD5544cd51a596619b78e9b54b70088307d
SHA14769ddd2dbc1dc44b758964ed0bd231b85880b65
SHA256dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd
SHA512f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719
-
Filesize
20KB
MD5c9ff7748d8fcef4cf84a5501e996a641
SHA102867e5010f62f97ebb0cfb32cb3ede9449fe0c9
SHA2564d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988
SHA512d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73
-
Filesize
20KB
MD549693267e0adbcd119f9f5e02adf3a80
SHA13ba3d7f89b8ad195ca82c92737e960e1f2b349df
SHA256d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f
SHA512b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2