Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
12/01/2024, 21:15
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20231215-en
General
-
Target
tmp.exe
-
Size
6.5MB
-
MD5
f18bb1edd3ae7b63144e96132ce9aefb
-
SHA1
c1e427cada1d7c0ffc7196d722ee6c0af82c2756
-
SHA256
897b63dc56623c54120c95340a7e8c416786dbc18bb03dae3300ab2fd57e928a
-
SHA512
d0036a1b6bab8786f45688a7d22a3dfd28a9ef21048b13aea72182b3599d1ebb22acd210e5c86883b0b3a81f755a1a1eebe9a7fac7eaf7b5235188cc3f5eab0b
-
SSDEEP
98304:ukWTppXqlbXXSKXiDvrfuh8AN8HJyeZaDN6h:ukWVtYbnSKXSvbSupyYaDNE
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
resource yara_rule behavioral1/memory/2184-1-0x0000000000A00000-0x000000000106E000-memory.dmp family_zgrat_v1 -
SectopRAT payload 5 IoCs
resource yara_rule behavioral1/memory/2588-25-0x0000000000400000-0x00000000004D4000-memory.dmp family_sectoprat behavioral1/memory/2588-26-0x0000000000400000-0x00000000004D4000-memory.dmp family_sectoprat behavioral1/memory/2588-33-0x0000000000400000-0x00000000004D4000-memory.dmp family_sectoprat behavioral1/memory/2588-31-0x0000000000400000-0x00000000004D4000-memory.dmp family_sectoprat behavioral1/memory/2588-29-0x0000000000400000-0x00000000004D4000-memory.dmp family_sectoprat -
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule behavioral1/memory/2184-1-0x0000000000A00000-0x000000000106E000-memory.dmp net_reactor -
Loads dropped DLL 1 IoCs
pid Process 2184 tmp.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2184 set thread context of 2588 2184 tmp.exe 30 -
Program crash 1 IoCs
pid pid_target Process procid_target 2528 2184 WerFault.exe 27 -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2588 InstallUtil.exe Token: SeDebugPrivilege 2184 tmp.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2184 wrote to memory of 2588 2184 tmp.exe 30 PID 2184 wrote to memory of 2588 2184 tmp.exe 30 PID 2184 wrote to memory of 2588 2184 tmp.exe 30 PID 2184 wrote to memory of 2588 2184 tmp.exe 30 PID 2184 wrote to memory of 2588 2184 tmp.exe 30 PID 2184 wrote to memory of 2588 2184 tmp.exe 30 PID 2184 wrote to memory of 2588 2184 tmp.exe 30 PID 2184 wrote to memory of 2588 2184 tmp.exe 30 PID 2184 wrote to memory of 2588 2184 tmp.exe 30 PID 2184 wrote to memory of 2588 2184 tmp.exe 30 PID 2184 wrote to memory of 2588 2184 tmp.exe 30 PID 2184 wrote to memory of 2588 2184 tmp.exe 30 PID 2184 wrote to memory of 2528 2184 tmp.exe 32 PID 2184 wrote to memory of 2528 2184 tmp.exe 32 PID 2184 wrote to memory of 2528 2184 tmp.exe 32 PID 2184 wrote to memory of 2528 2184 tmp.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2588
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 7162⤵
- Program crash
PID:2528
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD5c9ff7748d8fcef4cf84a5501e996a641
SHA102867e5010f62f97ebb0cfb32cb3ede9449fe0c9
SHA2564d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988
SHA512d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73
-
Filesize
742KB
MD5544cd51a596619b78e9b54b70088307d
SHA14769ddd2dbc1dc44b758964ed0bd231b85880b65
SHA256dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd
SHA512f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719