Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
15/01/2024, 04:48
Behavioral task
behavioral1
Sample
18438ba9ff004f421bef169685a080e71fb69f68680411102dbad5d987c01b92.exe
Resource
win7-20231129-en
General
-
Target
18438ba9ff004f421bef169685a080e71fb69f68680411102dbad5d987c01b92.exe
-
Size
6.5MB
-
MD5
03e9935cd95bb87c4e61500e794ca439
-
SHA1
bdf2067f9c825036eefe92a6787787d827baa180
-
SHA256
18438ba9ff004f421bef169685a080e71fb69f68680411102dbad5d987c01b92
-
SHA512
f750da90d4ffe60de02296153de7f85668a6a54e1654e655215c69a548aeab40d9bec3614e7a52d020b6aaffc662723e60b65bc5dc163ebfc1cf864277ab0d37
-
SSDEEP
98304:uCmZHHCneK+e7XIGRZERpAnAVjYnFv4a9o63d8vl:eZH1K+w9EUnAFYnFQaa6N
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
resource yara_rule behavioral1/memory/2884-1-0x0000000000990000-0x0000000001020000-memory.dmp family_zgrat_v1 -
Detects Arechclient2 RAT 3 IoCs
Arechclient2.
resource yara_rule behavioral1/memory/2104-31-0x0000000000400000-0x00000000004D4000-memory.dmp MALWARE_Win_Arechclient behavioral1/memory/2104-27-0x0000000000400000-0x00000000004D4000-memory.dmp MALWARE_Win_Arechclient behavioral1/memory/2104-25-0x0000000000400000-0x00000000004D4000-memory.dmp MALWARE_Win_Arechclient -
SectopRAT payload 3 IoCs
resource yara_rule behavioral1/memory/2104-31-0x0000000000400000-0x00000000004D4000-memory.dmp family_sectoprat behavioral1/memory/2104-27-0x0000000000400000-0x00000000004D4000-memory.dmp family_sectoprat behavioral1/memory/2104-25-0x0000000000400000-0x00000000004D4000-memory.dmp family_sectoprat -
Loads dropped DLL 1 IoCs
pid Process 2884 18438ba9ff004f421bef169685a080e71fb69f68680411102dbad5d987c01b92.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2884 set thread context of 2104 2884 18438ba9ff004f421bef169685a080e71fb69f68680411102dbad5d987c01b92.exe 29 -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 2884 wrote to memory of 2608 2884 18438ba9ff004f421bef169685a080e71fb69f68680411102dbad5d987c01b92.exe 28 PID 2884 wrote to memory of 2608 2884 18438ba9ff004f421bef169685a080e71fb69f68680411102dbad5d987c01b92.exe 28 PID 2884 wrote to memory of 2608 2884 18438ba9ff004f421bef169685a080e71fb69f68680411102dbad5d987c01b92.exe 28 PID 2884 wrote to memory of 2608 2884 18438ba9ff004f421bef169685a080e71fb69f68680411102dbad5d987c01b92.exe 28 PID 2884 wrote to memory of 2608 2884 18438ba9ff004f421bef169685a080e71fb69f68680411102dbad5d987c01b92.exe 28 PID 2884 wrote to memory of 2608 2884 18438ba9ff004f421bef169685a080e71fb69f68680411102dbad5d987c01b92.exe 28 PID 2884 wrote to memory of 2608 2884 18438ba9ff004f421bef169685a080e71fb69f68680411102dbad5d987c01b92.exe 28 PID 2884 wrote to memory of 2104 2884 18438ba9ff004f421bef169685a080e71fb69f68680411102dbad5d987c01b92.exe 29 PID 2884 wrote to memory of 2104 2884 18438ba9ff004f421bef169685a080e71fb69f68680411102dbad5d987c01b92.exe 29 PID 2884 wrote to memory of 2104 2884 18438ba9ff004f421bef169685a080e71fb69f68680411102dbad5d987c01b92.exe 29 PID 2884 wrote to memory of 2104 2884 18438ba9ff004f421bef169685a080e71fb69f68680411102dbad5d987c01b92.exe 29 PID 2884 wrote to memory of 2104 2884 18438ba9ff004f421bef169685a080e71fb69f68680411102dbad5d987c01b92.exe 29 PID 2884 wrote to memory of 2104 2884 18438ba9ff004f421bef169685a080e71fb69f68680411102dbad5d987c01b92.exe 29 PID 2884 wrote to memory of 2104 2884 18438ba9ff004f421bef169685a080e71fb69f68680411102dbad5d987c01b92.exe 29 PID 2884 wrote to memory of 2104 2884 18438ba9ff004f421bef169685a080e71fb69f68680411102dbad5d987c01b92.exe 29 PID 2884 wrote to memory of 2104 2884 18438ba9ff004f421bef169685a080e71fb69f68680411102dbad5d987c01b92.exe 29 PID 2884 wrote to memory of 2104 2884 18438ba9ff004f421bef169685a080e71fb69f68680411102dbad5d987c01b92.exe 29 PID 2884 wrote to memory of 2104 2884 18438ba9ff004f421bef169685a080e71fb69f68680411102dbad5d987c01b92.exe 29 PID 2884 wrote to memory of 2104 2884 18438ba9ff004f421bef169685a080e71fb69f68680411102dbad5d987c01b92.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\18438ba9ff004f421bef169685a080e71fb69f68680411102dbad5d987c01b92.exe"C:\Users\Admin\AppData\Local\Temp\18438ba9ff004f421bef169685a080e71fb69f68680411102dbad5d987c01b92.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵PID:2608
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵PID:2104
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
183KB
MD52cd3fbdf05c11ebc7f9b83a73076c932
SHA16811bebe234804ace14ff997f6f6d2c60a6fa9af
SHA2566cad1be4178e70091a3bb49050e8442d4dfa0b68e4843b2c3c50c8b53357c84e
SHA5120740492fda533717806dbc1ab8d022eccdb661e0e5605f8d6533134be53af2087ba5c66913b3424e75513a2e7bf32e4d7215933f51c26bc6132f3e1d65a58a9b