Analysis
-
max time kernel
149s -
max time network
305s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
12-01-2024 19:06
General
-
Target
bd40a562a877def50e55dca26cde9317a5090fb4fc4294ca76558a5a2cbc8bc2.exe
-
Size
70KB
-
MD5
46b34cdcf8a79e1269f0266c16c1fc88
-
SHA1
9d5a90647e07a7c9582392e73ca59c63993efd81
-
SHA256
bd40a562a877def50e55dca26cde9317a5090fb4fc4294ca76558a5a2cbc8bc2
-
SHA512
c62e867dc7fb1f36fb60d28fa5388631fc10df18c2fdba7fb97ce47bce4afdde1ae033da71baa301533548c2ec1d0f53f40ccf082f0da5f043f0a63e789add42
-
SSDEEP
1536:qLMvBXvWuM0fO3pS57oLPjHuy2SNxQE3P6Mo6wmR:2MvBXe8i057ovOy6E3P6M64
Score
10/10
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Program crash 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd40a562a877def50e55dca26cde9317a5090fb4fc4294ca76558a5a2cbc8bc2.exe"C:\Users\Admin\AppData\Local\Temp\bd40a562a877def50e55dca26cde9317a5090fb4fc4294ca76558a5a2cbc8bc2.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 19802⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2164 -ip 21641⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.7MB
-
Filesize
96KB
-
Filesize
64KB
-
Filesize
7.7MB