Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-01-2024 17:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20231215-en
6 signatures
150 seconds
General
-
Target
tmp.exe
-
Size
1.7MB
-
MD5
721fb763958ddcf207551558ff06b1a0
-
SHA1
64bd92b0a8cd71d8a795f481be30763f2139ea76
-
SHA256
8afcc55b59e124b3840bbee5afb30e70354590eee693480a43fe7d586e909a9e
-
SHA512
b61c972b232cf6d8e9929396d9970c7718dbcc295a3cd200eb1e1dae005acaffd79c4975f7d0655fafa92db8706fcc2b81a92d274c4220d588110bf18d2c3b93
-
SSDEEP
24576:SYD1kEJen92P7pK43qcF0SymoaZSftjohWPoJNXzk0Ck5sdfw9X1Xq82isbtGabx:SYDCEJ82PE4a1F40qxzk9k5hXXqjv2w
Malware Config
Signatures
-
Detect ZGRat V1 35 IoCs
Processes:
resource yara_rule behavioral1/memory/2644-3-0x000000001B0D0000-0x000000001B204000-memory.dmp family_zgrat_v1 behavioral1/memory/2644-5-0x000000001B0D0000-0x000000001B1FD000-memory.dmp family_zgrat_v1 behavioral1/memory/2644-4-0x000000001B0D0000-0x000000001B1FD000-memory.dmp family_zgrat_v1 behavioral1/memory/2644-7-0x000000001B0D0000-0x000000001B1FD000-memory.dmp family_zgrat_v1 behavioral1/memory/2644-9-0x000000001B0D0000-0x000000001B1FD000-memory.dmp family_zgrat_v1 behavioral1/memory/2644-11-0x000000001B0D0000-0x000000001B1FD000-memory.dmp family_zgrat_v1 behavioral1/memory/2644-15-0x000000001B0D0000-0x000000001B1FD000-memory.dmp family_zgrat_v1 behavioral1/memory/2644-13-0x000000001B0D0000-0x000000001B1FD000-memory.dmp family_zgrat_v1 behavioral1/memory/2644-17-0x000000001B0D0000-0x000000001B1FD000-memory.dmp family_zgrat_v1 behavioral1/memory/2644-19-0x000000001B0D0000-0x000000001B1FD000-memory.dmp family_zgrat_v1 behavioral1/memory/2644-23-0x000000001B0D0000-0x000000001B1FD000-memory.dmp family_zgrat_v1 behavioral1/memory/2644-21-0x000000001B0D0000-0x000000001B1FD000-memory.dmp family_zgrat_v1 behavioral1/memory/2644-27-0x000000001B0D0000-0x000000001B1FD000-memory.dmp family_zgrat_v1 behavioral1/memory/2644-25-0x000000001B0D0000-0x000000001B1FD000-memory.dmp family_zgrat_v1 behavioral1/memory/2644-29-0x000000001B0D0000-0x000000001B1FD000-memory.dmp family_zgrat_v1 behavioral1/memory/2644-31-0x000000001B0D0000-0x000000001B1FD000-memory.dmp family_zgrat_v1 behavioral1/memory/2644-35-0x000000001B0D0000-0x000000001B1FD000-memory.dmp family_zgrat_v1 behavioral1/memory/2644-33-0x000000001B0D0000-0x000000001B1FD000-memory.dmp family_zgrat_v1 behavioral1/memory/2644-39-0x000000001B0D0000-0x000000001B1FD000-memory.dmp family_zgrat_v1 behavioral1/memory/2644-37-0x000000001B0D0000-0x000000001B1FD000-memory.dmp family_zgrat_v1 behavioral1/memory/2644-41-0x000000001B0D0000-0x000000001B1FD000-memory.dmp family_zgrat_v1 behavioral1/memory/2644-45-0x000000001B0D0000-0x000000001B1FD000-memory.dmp family_zgrat_v1 behavioral1/memory/2644-43-0x000000001B0D0000-0x000000001B1FD000-memory.dmp family_zgrat_v1 behavioral1/memory/2644-47-0x000000001B0D0000-0x000000001B1FD000-memory.dmp family_zgrat_v1 behavioral1/memory/2644-51-0x000000001B0D0000-0x000000001B1FD000-memory.dmp family_zgrat_v1 behavioral1/memory/2644-49-0x000000001B0D0000-0x000000001B1FD000-memory.dmp family_zgrat_v1 behavioral1/memory/2644-53-0x000000001B0D0000-0x000000001B1FD000-memory.dmp family_zgrat_v1 behavioral1/memory/2644-55-0x000000001B0D0000-0x000000001B1FD000-memory.dmp family_zgrat_v1 behavioral1/memory/2644-57-0x000000001B0D0000-0x000000001B1FD000-memory.dmp family_zgrat_v1 behavioral1/memory/2644-59-0x000000001B0D0000-0x000000001B1FD000-memory.dmp family_zgrat_v1 behavioral1/memory/2644-63-0x000000001B0D0000-0x000000001B1FD000-memory.dmp family_zgrat_v1 behavioral1/memory/2644-61-0x000000001B0D0000-0x000000001B1FD000-memory.dmp family_zgrat_v1 behavioral1/memory/2644-67-0x000000001B0D0000-0x000000001B1FD000-memory.dmp family_zgrat_v1 behavioral1/memory/2644-65-0x000000001B0D0000-0x000000001B1FD000-memory.dmp family_zgrat_v1 behavioral1/memory/2200-954-0x0000000000A30000-0x0000000000B16000-memory.dmp family_zgrat_v1 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
tmp.exedescription pid process target process PID 2644 set thread context of 2200 2644 tmp.exe tmp.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
tmp.exepid process 2200 tmp.exe 2200 tmp.exe 2200 tmp.exe 2200 tmp.exe 2200 tmp.exe 2200 tmp.exe 2200 tmp.exe 2200 tmp.exe 2200 tmp.exe 2200 tmp.exe 2200 tmp.exe 2200 tmp.exe 2200 tmp.exe 2200 tmp.exe 2200 tmp.exe 2200 tmp.exe 2200 tmp.exe 2200 tmp.exe 2200 tmp.exe 2200 tmp.exe 2200 tmp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
tmp.exetmp.exedescription pid process Token: SeDebugPrivilege 2644 tmp.exe Token: SeDebugPrivilege 2200 tmp.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
tmp.exetmp.exedescription pid process target process PID 2644 wrote to memory of 2200 2644 tmp.exe tmp.exe PID 2644 wrote to memory of 2200 2644 tmp.exe tmp.exe PID 2644 wrote to memory of 2200 2644 tmp.exe tmp.exe PID 2644 wrote to memory of 2200 2644 tmp.exe tmp.exe PID 2644 wrote to memory of 2200 2644 tmp.exe tmp.exe PID 2644 wrote to memory of 2200 2644 tmp.exe tmp.exe PID 2644 wrote to memory of 2200 2644 tmp.exe tmp.exe PID 2200 wrote to memory of 2032 2200 tmp.exe InstallUtil.exe PID 2200 wrote to memory of 2032 2200 tmp.exe InstallUtil.exe PID 2200 wrote to memory of 2032 2200 tmp.exe InstallUtil.exe PID 2200 wrote to memory of 1764 2200 tmp.exe InstallUtil.exe PID 2200 wrote to memory of 1764 2200 tmp.exe InstallUtil.exe PID 2200 wrote to memory of 1764 2200 tmp.exe InstallUtil.exe PID 2200 wrote to memory of 2984 2200 tmp.exe InstallUtil.exe PID 2200 wrote to memory of 2984 2200 tmp.exe InstallUtil.exe PID 2200 wrote to memory of 2984 2200 tmp.exe InstallUtil.exe PID 2200 wrote to memory of 2752 2200 tmp.exe InstallUtil.exe PID 2200 wrote to memory of 2752 2200 tmp.exe InstallUtil.exe PID 2200 wrote to memory of 2752 2200 tmp.exe InstallUtil.exe PID 2200 wrote to memory of 2420 2200 tmp.exe InstallUtil.exe PID 2200 wrote to memory of 2420 2200 tmp.exe InstallUtil.exe PID 2200 wrote to memory of 2420 2200 tmp.exe InstallUtil.exe PID 2200 wrote to memory of 1520 2200 tmp.exe InstallUtil.exe PID 2200 wrote to memory of 1520 2200 tmp.exe InstallUtil.exe PID 2200 wrote to memory of 1520 2200 tmp.exe InstallUtil.exe PID 2200 wrote to memory of 2756 2200 tmp.exe InstallUtil.exe PID 2200 wrote to memory of 2756 2200 tmp.exe InstallUtil.exe PID 2200 wrote to memory of 2756 2200 tmp.exe InstallUtil.exe PID 2200 wrote to memory of 2772 2200 tmp.exe InstallUtil.exe PID 2200 wrote to memory of 2772 2200 tmp.exe InstallUtil.exe PID 2200 wrote to memory of 2772 2200 tmp.exe InstallUtil.exe PID 2200 wrote to memory of 2824 2200 tmp.exe InstallUtil.exe PID 2200 wrote to memory of 2824 2200 tmp.exe InstallUtil.exe PID 2200 wrote to memory of 2824 2200 tmp.exe InstallUtil.exe PID 2200 wrote to memory of 2788 2200 tmp.exe InstallUtil.exe PID 2200 wrote to memory of 2788 2200 tmp.exe InstallUtil.exe PID 2200 wrote to memory of 2788 2200 tmp.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\tmp.exeC:\Users\Admin\AppData\Local\Temp\tmp.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe3⤵PID:2032
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe3⤵PID:2984
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe3⤵PID:1764
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe3⤵PID:2752
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe3⤵PID:2420
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe3⤵PID:1520
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe3⤵PID:2756
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe3⤵PID:2772
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe3⤵PID:2824
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe3⤵PID:2788