Analysis

  • max time kernel
    117s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    15/01/2024, 04:48

General

  • Target

    18438ba9ff004f421bef169685a080e71fb69f68680411102dbad5d987c01b92.exe

  • Size

    6.5MB

  • MD5

    03e9935cd95bb87c4e61500e794ca439

  • SHA1

    bdf2067f9c825036eefe92a6787787d827baa180

  • SHA256

    18438ba9ff004f421bef169685a080e71fb69f68680411102dbad5d987c01b92

  • SHA512

    f750da90d4ffe60de02296153de7f85668a6a54e1654e655215c69a548aeab40d9bec3614e7a52d020b6aaffc662723e60b65bc5dc163ebfc1cf864277ab0d37

  • SSDEEP

    98304:uCmZHHCneK+e7XIGRZERpAnAVjYnFv4a9o63d8vl:eZH1K+w9EUnAFYnFQaa6N

Malware Config

Signatures

  • Detect ZGRat V1 1 IoCs
  • Detects Arechclient2 RAT 3 IoCs

    Arechclient2.

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 3 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\18438ba9ff004f421bef169685a080e71fb69f68680411102dbad5d987c01b92.exe
    "C:\Users\Admin\AppData\Local\Temp\18438ba9ff004f421bef169685a080e71fb69f68680411102dbad5d987c01b92.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2884
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      2⤵
        PID:2608
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        2⤵
          PID:2104

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • \Users\Admin\AppData\Local\Temp\Protect544cd51a.dll

              Filesize

              183KB

              MD5

              2cd3fbdf05c11ebc7f9b83a73076c932

              SHA1

              6811bebe234804ace14ff997f6f6d2c60a6fa9af

              SHA256

              6cad1be4178e70091a3bb49050e8442d4dfa0b68e4843b2c3c50c8b53357c84e

              SHA512

              0740492fda533717806dbc1ab8d022eccdb661e0e5605f8d6533134be53af2087ba5c66913b3424e75513a2e7bf32e4d7215933f51c26bc6132f3e1d65a58a9b

            • memory/2104-23-0x0000000000400000-0x00000000004D4000-memory.dmp

              Filesize

              848KB

            • memory/2104-21-0x0000000000400000-0x00000000004D4000-memory.dmp

              Filesize

              848KB

            • memory/2104-25-0x0000000000400000-0x00000000004D4000-memory.dmp

              Filesize

              848KB

            • memory/2104-27-0x0000000000400000-0x00000000004D4000-memory.dmp

              Filesize

              848KB

            • memory/2104-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

              Filesize

              4KB

            • memory/2104-31-0x0000000000400000-0x00000000004D4000-memory.dmp

              Filesize

              848KB

            • memory/2884-14-0x0000000004B40000-0x0000000004B80000-memory.dmp

              Filesize

              256KB

            • memory/2884-20-0x0000000004B40000-0x0000000004B80000-memory.dmp

              Filesize

              256KB

            • memory/2884-19-0x0000000004B40000-0x0000000004B80000-memory.dmp

              Filesize

              256KB

            • memory/2884-13-0x0000000000430000-0x0000000000440000-memory.dmp

              Filesize

              64KB

            • memory/2884-1-0x0000000000990000-0x0000000001020000-memory.dmp

              Filesize

              6.6MB

            • memory/2884-5-0x0000000007F90000-0x0000000008122000-memory.dmp

              Filesize

              1.6MB

            • memory/2884-4-0x00000000069F0000-0x0000000006D3E000-memory.dmp

              Filesize

              3.3MB

            • memory/2884-3-0x0000000004B40000-0x0000000004B80000-memory.dmp

              Filesize

              256KB

            • memory/2884-2-0x0000000074B20000-0x000000007520E000-memory.dmp

              Filesize

              6.9MB

            • memory/2884-17-0x0000000004B40000-0x0000000004B80000-memory.dmp

              Filesize

              256KB

            • memory/2884-18-0x00000000082C0000-0x00000000083C0000-memory.dmp

              Filesize

              1024KB

            • memory/2884-16-0x0000000004B40000-0x0000000004B80000-memory.dmp

              Filesize

              256KB

            • memory/2884-15-0x0000000004B40000-0x0000000004B80000-memory.dmp

              Filesize

              256KB

            • memory/2884-12-0x0000000004B40000-0x0000000004B80000-memory.dmp

              Filesize

              256KB

            • memory/2884-11-0x0000000004B40000-0x0000000004B80000-memory.dmp

              Filesize

              256KB

            • memory/2884-10-0x0000000004B40000-0x0000000004B80000-memory.dmp

              Filesize

              256KB

            • memory/2884-0-0x0000000074B20000-0x000000007520E000-memory.dmp

              Filesize

              6.9MB

            • memory/2884-32-0x0000000074B20000-0x000000007520E000-memory.dmp

              Filesize

              6.9MB