Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
20/01/2024, 14:06
General
- Target 6aa0daa3d77002b7cc81ac90b4865707.exe
- Size 1.0MB
- Sample240120-rekp9abeb6
- SHA256 583dbd13e7e7f24599e11c5dc3039eda53acff81cf09a110b51b035cccf4ad09
Malware Config
Extracted
-
xloader
-
2.3
-
p6f2
-
redsnews.com
-
vr859.com
-
postmasterstudios.com
-
hampsteadorganizer.com
-
hangshop.net
-
maheshwaramlawcollege.com
-
5156087.com
-
gtaaddict.com
-
faj.xyz
-
drivechicagoillinois.com
-
neerutech.com
-
b2brahmas.com
-
freshlookks.com
-
propertyparallel.tech
-
tlwbyads.com
-
sellektorkids.com
-
dexs.fyi
-
kileybrock.com
-
nervstudio.com
-
tosg-ltd.com
Signatures
- Detect ZGRat V1 1 IoCs
- Xloader
Xloader is a rebranded version of Formbook malware.
- ZGRat
ZGRat is remote access trojan written in C#.
- Xloader payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6aa0daa3d77002b7cc81ac90b4865707.exe"C:\Users\Admin\AppData\Local\Temp\6aa0daa3d77002b7cc81ac90b4865707.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6aa0daa3d77002b7cc81ac90b4865707.exe"C:\Users\Admin\AppData\Local\Temp\6aa0daa3d77002b7cc81ac90b4865707.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2056-6-0x0000000005CF0000-0x0000000005D00000-memory.dmp
memory/2056-12-0x0000000074B80000-0x0000000075330000-memory.dmp
memory/2056-2-0x0000000005E50000-0x00000000063F4000-memory.dmp
memory/2056-3-0x0000000005940000-0x00000000059D2000-memory.dmp
memory/2056-4-0x0000000005A60000-0x0000000005AD6000-memory.dmp
memory/2056-5-0x0000000005B80000-0x0000000005C1C000-memory.dmp
memory/2056-8-0x0000000005C20000-0x0000000005CA0000-memory.dmp
memory/2056-0-0x0000000000E50000-0x0000000000F60000-memory.dmp
memory/2056-1-0x0000000074B80000-0x0000000075330000-memory.dmp
memory/2056-9-0x0000000005A10000-0x0000000005A26000-memory.dmp
memory/2056-7-0x00000000059E0000-0x00000000059FE000-memory.dmp
memory/4660-13-0x00000000015B0000-0x00000000018FA000-memory.dmp
memory/4660-10-0x0000000000400000-0x0000000000428000-memory.dmp
memory/4660-14-0x00000000015B0000-0x00000000018FA000-memory.dmp