Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
20-01-2024 06:45
General
-
Target
69c10e8fa7d800c4a24b36dffec2cea7.exe
-
Size
2.4MB
-
MD5
69c10e8fa7d800c4a24b36dffec2cea7
-
SHA1
07bea76542382f9613d4de5da9b36abb3276988d
-
SHA256
562720cf37245f6bdf71692343b7d7ccc2187e45979e957b86407a21aa83854c
-
SHA512
4cd0dbb29192a8ebc31abd673aa7983a6e2f24e89cc684fb720777aaf5a692010c6f800e1f50b9ffbc9dea397d97a91118a0325cfc4337d83cb2296a6b68bd6f
-
SSDEEP
49152:IzecMn91vjBteouiARLrW8oj12yoYBGfUjAIgX2z2r:gu9dNtb4nWpjIYBCv9
Malware Config
Signatures
-
Detect ZGRat V1 35 IoCs
-
Detects Echelon Stealer payload 2 IoCs
-
Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\69c10e8fa7d800c4a24b36dffec2cea7.exe"C:\Users\Admin\AppData\Local\Temp\69c10e8fa7d800c4a24b36dffec2cea7.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Decoder.exe"C:\ProgramData\Decoder.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\.cmd""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 43⤵
- Delays execution with timeout.exe
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD55460a85ab22b67a0995b1f7710eb07c9
SHA16840935177c9373438016d6fd69b9bfe8dcf8110
SHA2565b34d38f765004981f0c8f7695b7992e3d81f3161d3a796c173aadb4522014b8
SHA512e36bb4ed10d15a53aac9a8ead5429bb0a9e4b91e362804fa2aaf50d39921c39adea598caf6d0ba7b1a16bc1474d09e925dcc67bbb09743e7cab8e93d731ce745
-
Filesize
28B
MD5217407484aac2673214337def8886072
SHA10f8c4c94064ce1f7538c43987feb5bb2d7fec0c6
SHA256467c28ed423f513128575b1c8c6674ee5671096ff1b14bc4c32deebd89fc1797
SHA5128466383a1cb71ea8b049548fd5a41aaf01c0423743b886cd3cb5007f66bff87d8d5cfa67344451f4490c8f26e4ebf9e306075d5cfc655dc62f0813a456cf1330
-
Filesize
490KB
MD5c29c0d495ed13e703f433d53bdffdab8
SHA174ed36e6b6027b61abcfe2956670ffd9de7fd71a
SHA25620309707aa6fc678963aace7685a37839d439c850b1ba399bdbfbbeddc10ed4b
SHA512fea4c1066ee6df3ebb29a354678a3d0f1398cd216b92b261296fcff580b00e19cefe24d975beebcc41854cceef3df2702d569811358dae4203a924fb52cf5426
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
256KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
624KB
-
Filesize
256KB
-
Filesize
592KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
616KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
6.9MB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
472KB
-
Filesize
5.7MB
-
Filesize
6.9MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
6.9MB
-
Filesize
256KB