Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12/01/2024, 17:55
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20231215-en
General
-
Target
file.exe
-
Size
6.5MB
-
MD5
f18bb1edd3ae7b63144e96132ce9aefb
-
SHA1
c1e427cada1d7c0ffc7196d722ee6c0af82c2756
-
SHA256
897b63dc56623c54120c95340a7e8c416786dbc18bb03dae3300ab2fd57e928a
-
SHA512
d0036a1b6bab8786f45688a7d22a3dfd28a9ef21048b13aea72182b3599d1ebb22acd210e5c86883b0b3a81f755a1a1eebe9a7fac7eaf7b5235188cc3f5eab0b
-
SSDEEP
98304:ukWTppXqlbXXSKXiDvrfuh8AN8HJyeZaDN6h:ukWVtYbnSKXSvbSupyYaDNE
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
resource yara_rule behavioral2/memory/624-1-0x0000000000700000-0x0000000000D6E000-memory.dmp family_zgrat_v1 -
SectopRAT payload 2 IoCs
resource yara_rule behavioral2/memory/2300-21-0x0000000000400000-0x00000000004D4000-memory.dmp family_sectoprat behavioral2/memory/2300-24-0x0000000005530000-0x0000000005540000-memory.dmp family_sectoprat -
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule behavioral2/memory/624-1-0x0000000000700000-0x0000000000D6E000-memory.dmp net_reactor -
Loads dropped DLL 1 IoCs
pid Process 624 file.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 624 set thread context of 2300 624 file.exe 99 -
Program crash 1 IoCs
pid pid_target Process procid_target 2520 624 WerFault.exe 87 -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2300 InstallUtil.exe Token: SeDebugPrivilege 624 file.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 624 wrote to memory of 2300 624 file.exe 99 PID 624 wrote to memory of 2300 624 file.exe 99 PID 624 wrote to memory of 2300 624 file.exe 99 PID 624 wrote to memory of 2300 624 file.exe 99 PID 624 wrote to memory of 2300 624 file.exe 99 PID 624 wrote to memory of 2300 624 file.exe 99 PID 624 wrote to memory of 2300 624 file.exe 99 PID 624 wrote to memory of 2300 624 file.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2300
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 11562⤵
- Program crash
PID:2520
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 624 -ip 6241⤵PID:1828
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
564KB
MD5a59e577e36230deefcc495a74cebf221
SHA13558bc21d5a8eb3960ab3d55db730de832c8262f
SHA25658de1f27a0d7547491bad82185834af1a170e758abf14a422201e91ff26517f0
SHA5120717d526eab9c08397b8520d56cb430a7d65fa59d93b77efd674287e5b0b3ae6953d68694d236d8b143374b6a631af55df03f02e5a449ec539e57494002d47a2
-
Filesize
20KB
MD5c9ff7748d8fcef4cf84a5501e996a641
SHA102867e5010f62f97ebb0cfb32cb3ede9449fe0c9
SHA2564d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988
SHA512d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73
-
Filesize
20KB
MD549693267e0adbcd119f9f5e02adf3a80
SHA13ba3d7f89b8ad195ca82c92737e960e1f2b349df
SHA256d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f
SHA512b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2