Overview
overview
10Static
static
3magic.pois...lk.dat
windows10-2004-x64
3magic.pois...ed.exe
windows10-2004-x64
10magic.pois...pt.exe
windows10-2004-x64
10magic.pois...cs.hta
windows10-2004-x64
10magic.pois...nt.pdf
windows10-2004-x64
1magic.pois...zg.wav
windows10-2004-x64
6magic.pois...pt.exe
windows10-2004-x64
10magic.pois...pt.exe
windows10-2004-x64
10magic.pois...es.hta
windows10-2004-x64
10magic.pois...im.vdf
windows10-2004-x64
3magic.pois...ck.wav
windows10-2004-x64
1magic.pois...ff.dat
windows10-2004-x64
3magic.pois...IB.pdf
windows10-2004-x64
1magic.pois...pt.exe
windows10-2004-x64
10magic.pois...ty.wav
windows10-2004-x64
1magic.pois...ye.wav
windows10-2004-x64
6magic.pois...er.exe
windows10-2004-x64
10magic.pois...vw.mp4
windows10-2004-x64
6magic.pois...op.mp4
windows10-2004-x64
6magic.pois...ed.hta
windows10-2004-x64
10magic.pois...ng.exe
windows10-2004-x64
10magic.pois...wn.png
windows10-2004-x64
3magic.pois...ox.hta
windows10-2004-x64
10magic.pois...xw.exe
windows10-2004-x64
10magic.pois...xw.hta
windows10-2004-x64
10magic.pois...pt.exe
windows10-2004-x64
10Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19-01-2024 20:19
Static task
static1
Behavioral task
behavioral1
Sample
magic.poisontoolz.com/Avjteuhlk.dat
Resource
win10v2004-20231215-en
Behavioral task
behavioral2
Sample
magic.poisontoolz.com/Binded.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
magic.poisontoolz.com/Buildcrypt.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral4
Sample
magic.poisontoolz.com/Docs.hta
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
magic.poisontoolz.com/Document.pdf
Resource
win10v2004-20231215-en
Behavioral task
behavioral6
Sample
magic.poisontoolz.com/Evllmzg.wav
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
magic.poisontoolz.com/File1crypt.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral8
Sample
magic.poisontoolz.com/File2crypt.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
magic.poisontoolz.com/Files.hta
Resource
win10v2004-20231215-en
Behavioral task
behavioral10
Sample
magic.poisontoolz.com/Jafxaspdhim.vdf
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
magic.poisontoolz.com/Otcck.wav
Resource
win10v2004-20231222-en
Behavioral task
behavioral12
Sample
magic.poisontoolz.com/Pphucxdmff.dat
Resource
win10v2004-20231222-en
Behavioral task
behavioral13
Sample
magic.poisontoolz.com/RIB.pdf
Resource
win10v2004-20231215-en
Behavioral task
behavioral14
Sample
magic.poisontoolz.com/RagCrypt.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral15
Sample
magic.poisontoolz.com/Spaufgty.wav
Resource
win10v2004-20231222-en
Behavioral task
behavioral16
Sample
magic.poisontoolz.com/Utsxokye.wav
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
magic.poisontoolz.com/Walter.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral18
Sample
magic.poisontoolz.com/Wjwxkhbvw.mp4
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
magic.poisontoolz.com/Wlkubkwdmop.mp4
Resource
win10v2004-20231215-en
Behavioral task
behavioral20
Sample
magic.poisontoolz.com/binded.hta
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
magic.poisontoolz.com/building.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral22
Sample
magic.poisontoolz.com/down.png
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
magic.poisontoolz.com/fox.hta
Resource
win10v2004-20231215-en
Behavioral task
behavioral24
Sample
magic.poisontoolz.com/xw.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
magic.poisontoolz.com/xw.hta
Resource
win10v2004-20231215-en
General
-
Target
magic.poisontoolz.com/Walter.exe
-
Size
1.4MB
-
MD5
00db76730c41df5c707cdbc485c243a0
-
SHA1
564fbec2ac1e4b3c4375c677b21c978236f84832
-
SHA256
fee0b2009c3f04988ffee2ee8fe3874397b3458c41996a1c5658c719150c6a34
-
SHA512
af04c39a6fa56b50c21d89d9bacece75251e94cc76e401afda266029f906905b9193e5be5b914766e0e5873ecf2ab13da3129b4e6cb8692e3b14ca48ed59027d
-
SSDEEP
24576:1v432itln1e4uYvh+ZlvO9kvL4mucXw9FeV8WAAWrormkyZiCO0Pqo6Dw2P15tjx:Ml1e4zJAc4Tg9FeiAWUqkXaR6Dd5tj7X
Malware Config
Signatures
-
Detect ZGRat V1 34 IoCs
Processes:
resource yara_rule behavioral17/memory/3580-3-0x0000020FD5C80000-0x0000020FD5DDB000-memory.dmp family_zgrat_v1 behavioral17/memory/3580-4-0x0000020FD5C80000-0x0000020FD5DDB000-memory.dmp family_zgrat_v1 behavioral17/memory/3580-8-0x0000020FD5C80000-0x0000020FD5DDB000-memory.dmp family_zgrat_v1 behavioral17/memory/3580-14-0x0000020FD5C80000-0x0000020FD5DDB000-memory.dmp family_zgrat_v1 behavioral17/memory/3580-24-0x0000020FD5C80000-0x0000020FD5DDB000-memory.dmp family_zgrat_v1 behavioral17/memory/3580-32-0x0000020FD5C80000-0x0000020FD5DDB000-memory.dmp family_zgrat_v1 behavioral17/memory/3580-38-0x0000020FD5C80000-0x0000020FD5DDB000-memory.dmp family_zgrat_v1 behavioral17/memory/3580-40-0x0000020FD5C80000-0x0000020FD5DDB000-memory.dmp family_zgrat_v1 behavioral17/memory/3580-46-0x0000020FD5C80000-0x0000020FD5DDB000-memory.dmp family_zgrat_v1 behavioral17/memory/3580-52-0x0000020FD5C80000-0x0000020FD5DDB000-memory.dmp family_zgrat_v1 behavioral17/memory/3580-56-0x0000020FD5C80000-0x0000020FD5DDB000-memory.dmp family_zgrat_v1 behavioral17/memory/3580-64-0x0000020FD5C80000-0x0000020FD5DDB000-memory.dmp family_zgrat_v1 behavioral17/memory/3580-66-0x0000020FD5C80000-0x0000020FD5DDB000-memory.dmp family_zgrat_v1 behavioral17/memory/3580-62-0x0000020FD5C80000-0x0000020FD5DDB000-memory.dmp family_zgrat_v1 behavioral17/memory/3580-60-0x0000020FD5C80000-0x0000020FD5DDB000-memory.dmp family_zgrat_v1 behavioral17/memory/3580-58-0x0000020FD5C80000-0x0000020FD5DDB000-memory.dmp family_zgrat_v1 behavioral17/memory/3580-54-0x0000020FD5C80000-0x0000020FD5DDB000-memory.dmp family_zgrat_v1 behavioral17/memory/3580-50-0x0000020FD5C80000-0x0000020FD5DDB000-memory.dmp family_zgrat_v1 behavioral17/memory/3580-48-0x0000020FD5C80000-0x0000020FD5DDB000-memory.dmp family_zgrat_v1 behavioral17/memory/3580-44-0x0000020FD5C80000-0x0000020FD5DDB000-memory.dmp family_zgrat_v1 behavioral17/memory/3580-42-0x0000020FD5C80000-0x0000020FD5DDB000-memory.dmp family_zgrat_v1 behavioral17/memory/3580-36-0x0000020FD5C80000-0x0000020FD5DDB000-memory.dmp family_zgrat_v1 behavioral17/memory/3580-34-0x0000020FD5C80000-0x0000020FD5DDB000-memory.dmp family_zgrat_v1 behavioral17/memory/3580-30-0x0000020FD5C80000-0x0000020FD5DDB000-memory.dmp family_zgrat_v1 behavioral17/memory/3580-28-0x0000020FD5C80000-0x0000020FD5DDB000-memory.dmp family_zgrat_v1 behavioral17/memory/3580-26-0x0000020FD5C80000-0x0000020FD5DDB000-memory.dmp family_zgrat_v1 behavioral17/memory/3580-22-0x0000020FD5C80000-0x0000020FD5DDB000-memory.dmp family_zgrat_v1 behavioral17/memory/3580-20-0x0000020FD5C80000-0x0000020FD5DDB000-memory.dmp family_zgrat_v1 behavioral17/memory/3580-18-0x0000020FD5C80000-0x0000020FD5DDB000-memory.dmp family_zgrat_v1 behavioral17/memory/3580-16-0x0000020FD5C80000-0x0000020FD5DDB000-memory.dmp family_zgrat_v1 behavioral17/memory/3580-12-0x0000020FD5C80000-0x0000020FD5DDB000-memory.dmp family_zgrat_v1 behavioral17/memory/3580-10-0x0000020FD5C80000-0x0000020FD5DDB000-memory.dmp family_zgrat_v1 behavioral17/memory/3580-6-0x0000020FD5C80000-0x0000020FD5DDB000-memory.dmp family_zgrat_v1 behavioral17/memory/3580-1-0x0000020FD5C80000-0x0000020FD5DE2000-memory.dmp family_zgrat_v1 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Walter.exedescription pid process target process PID 3580 set thread context of 1596 3580 Walter.exe Walter.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Walter.exedescription pid process Token: SeDebugPrivilege 3580 Walter.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
Walter.exedescription pid process target process PID 3580 wrote to memory of 1596 3580 Walter.exe Walter.exe PID 3580 wrote to memory of 1596 3580 Walter.exe Walter.exe PID 3580 wrote to memory of 1596 3580 Walter.exe Walter.exe PID 3580 wrote to memory of 1596 3580 Walter.exe Walter.exe PID 3580 wrote to memory of 1596 3580 Walter.exe Walter.exe PID 3580 wrote to memory of 1596 3580 Walter.exe Walter.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\magic.poisontoolz.com\Walter.exe"C:\Users\Admin\AppData\Local\Temp\magic.poisontoolz.com\Walter.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\magic.poisontoolz.com\Walter.exeC:\Users\Admin\AppData\Local\Temp\magic.poisontoolz.com\Walter.exe2⤵PID:1596
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD59f5d0107d96d176b1ffcd5c7e7a42dc9
SHA1de83788e2f18629555c42a3e6fada12f70457141
SHA256d0630b8466cebaaf92533826f6547b6f36a3c480848dc38d650acd52b522a097
SHA51286cfaa3327b59a976ddd4a5915f3fe8c938481344fcbd10e7533b4c5003673d078756e62435940471658a03504c3bc30603204d6a133727a3f36c96d08714c61