Analysis
-
max time kernel
151s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12/01/2024, 21:15
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20231215-en
General
-
Target
tmp.exe
-
Size
6.5MB
-
MD5
f18bb1edd3ae7b63144e96132ce9aefb
-
SHA1
c1e427cada1d7c0ffc7196d722ee6c0af82c2756
-
SHA256
897b63dc56623c54120c95340a7e8c416786dbc18bb03dae3300ab2fd57e928a
-
SHA512
d0036a1b6bab8786f45688a7d22a3dfd28a9ef21048b13aea72182b3599d1ebb22acd210e5c86883b0b3a81f755a1a1eebe9a7fac7eaf7b5235188cc3f5eab0b
-
SSDEEP
98304:ukWTppXqlbXXSKXiDvrfuh8AN8HJyeZaDN6h:ukWVtYbnSKXSvbSupyYaDNE
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
resource yara_rule behavioral2/memory/4332-1-0x0000000000C10000-0x000000000127E000-memory.dmp family_zgrat_v1 -
SectopRAT payload 1 IoCs
resource yara_rule behavioral2/memory/1572-21-0x0000000000400000-0x00000000004D4000-memory.dmp family_sectoprat -
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule behavioral2/memory/4332-1-0x0000000000C10000-0x000000000127E000-memory.dmp net_reactor -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Eye_friendly_mode_with_customization.lnk tmp.exe -
Loads dropped DLL 1 IoCs
pid Process 4332 tmp.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4332 set thread context of 1572 4332 tmp.exe 101 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
pid Process 5032 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1572 InstallUtil.exe 1572 InstallUtil.exe 1572 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1572 InstallUtil.exe Token: SeDebugPrivilege 4332 tmp.exe Token: SeDebugPrivilege 5032 taskkill.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4332 wrote to memory of 1572 4332 tmp.exe 101 PID 4332 wrote to memory of 1572 4332 tmp.exe 101 PID 4332 wrote to memory of 1572 4332 tmp.exe 101 PID 4332 wrote to memory of 1572 4332 tmp.exe 101 PID 4332 wrote to memory of 1572 4332 tmp.exe 101 PID 4332 wrote to memory of 1572 4332 tmp.exe 101 PID 4332 wrote to memory of 1572 4332 tmp.exe 101 PID 4332 wrote to memory of 1572 4332 tmp.exe 101 PID 1572 wrote to memory of 5032 1572 InstallUtil.exe 104 PID 1572 wrote to memory of 5032 1572 InstallUtil.exe 104 PID 1572 wrote to memory of 5032 1572 InstallUtil.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /im chrome.exe /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5032
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
742KB
MD5544cd51a596619b78e9b54b70088307d
SHA14769ddd2dbc1dc44b758964ed0bd231b85880b65
SHA256dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd
SHA512f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719
-
Filesize
20KB
MD5c9ff7748d8fcef4cf84a5501e996a641
SHA102867e5010f62f97ebb0cfb32cb3ede9449fe0c9
SHA2564d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988
SHA512d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73
-
Filesize
20KB
MD549693267e0adbcd119f9f5e02adf3a80
SHA13ba3d7f89b8ad195ca82c92737e960e1f2b349df
SHA256d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f
SHA512b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2