Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
28-01-2024 01:03
Static task
static1
Behavioral task
behavioral1
Sample
7bc04988ce8e7d3b9738ae0db7af487f.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7bc04988ce8e7d3b9738ae0db7af487f.exe
Resource
win10v2004-20231222-en
General
-
Target
7bc04988ce8e7d3b9738ae0db7af487f.exe
-
Size
2.2MB
-
MD5
7bc04988ce8e7d3b9738ae0db7af487f
-
SHA1
0f2e73947facf7deae5baf93808122609b961cab
-
SHA256
40ab356507ff2f9e22acd6a4360e8f42cf47fb1f352161d90a15bdad4a9f2e5f
-
SHA512
22413f157eed0b616dc2bc200353a2a76bc607369232a7dc345784b4d46648dc85de1f3eca4e4a2bc5d949861dcd8d3c83f25d432624a031cfa52254d2bbc73c
-
SSDEEP
49152:4UFVUFmXOoIlDP9jWHxh9x7xQWgofbCbDbBJpKXc1jGQj:4IN+nl79jgtnhzC/9JpKX0KQ
Malware Config
Signatures
-
Detect ZGRat V1 34 IoCs
Processes:
resource yara_rule behavioral1/memory/2480-4-0x0000000005060000-0x00000000050DE000-memory.dmp family_zgrat_v1 behavioral1/memory/2480-5-0x0000000005060000-0x00000000050D8000-memory.dmp family_zgrat_v1 behavioral1/memory/2480-6-0x0000000005060000-0x00000000050D8000-memory.dmp family_zgrat_v1 behavioral1/memory/2480-8-0x0000000005060000-0x00000000050D8000-memory.dmp family_zgrat_v1 behavioral1/memory/2480-10-0x0000000005060000-0x00000000050D8000-memory.dmp family_zgrat_v1 behavioral1/memory/2480-12-0x0000000005060000-0x00000000050D8000-memory.dmp family_zgrat_v1 behavioral1/memory/2480-14-0x0000000005060000-0x00000000050D8000-memory.dmp family_zgrat_v1 behavioral1/memory/2480-16-0x0000000005060000-0x00000000050D8000-memory.dmp family_zgrat_v1 behavioral1/memory/2480-18-0x0000000005060000-0x00000000050D8000-memory.dmp family_zgrat_v1 behavioral1/memory/2480-20-0x0000000005060000-0x00000000050D8000-memory.dmp family_zgrat_v1 behavioral1/memory/2480-22-0x0000000005060000-0x00000000050D8000-memory.dmp family_zgrat_v1 behavioral1/memory/2480-24-0x0000000005060000-0x00000000050D8000-memory.dmp family_zgrat_v1 behavioral1/memory/2480-26-0x0000000005060000-0x00000000050D8000-memory.dmp family_zgrat_v1 behavioral1/memory/2480-28-0x0000000005060000-0x00000000050D8000-memory.dmp family_zgrat_v1 behavioral1/memory/2480-30-0x0000000005060000-0x00000000050D8000-memory.dmp family_zgrat_v1 behavioral1/memory/2480-32-0x0000000005060000-0x00000000050D8000-memory.dmp family_zgrat_v1 behavioral1/memory/2480-34-0x0000000005060000-0x00000000050D8000-memory.dmp family_zgrat_v1 behavioral1/memory/2480-36-0x0000000005060000-0x00000000050D8000-memory.dmp family_zgrat_v1 behavioral1/memory/2480-38-0x0000000005060000-0x00000000050D8000-memory.dmp family_zgrat_v1 behavioral1/memory/2480-40-0x0000000005060000-0x00000000050D8000-memory.dmp family_zgrat_v1 behavioral1/memory/2480-42-0x0000000005060000-0x00000000050D8000-memory.dmp family_zgrat_v1 behavioral1/memory/2480-46-0x0000000005060000-0x00000000050D8000-memory.dmp family_zgrat_v1 behavioral1/memory/2480-48-0x0000000005060000-0x00000000050D8000-memory.dmp family_zgrat_v1 behavioral1/memory/2480-66-0x0000000005060000-0x00000000050D8000-memory.dmp family_zgrat_v1 behavioral1/memory/2480-68-0x0000000005060000-0x00000000050D8000-memory.dmp family_zgrat_v1 behavioral1/memory/2480-64-0x0000000005060000-0x00000000050D8000-memory.dmp family_zgrat_v1 behavioral1/memory/2480-62-0x0000000005060000-0x00000000050D8000-memory.dmp family_zgrat_v1 behavioral1/memory/2480-60-0x0000000005060000-0x00000000050D8000-memory.dmp family_zgrat_v1 behavioral1/memory/2480-58-0x0000000005060000-0x00000000050D8000-memory.dmp family_zgrat_v1 behavioral1/memory/2480-56-0x0000000005060000-0x00000000050D8000-memory.dmp family_zgrat_v1 behavioral1/memory/2480-54-0x0000000005060000-0x00000000050D8000-memory.dmp family_zgrat_v1 behavioral1/memory/2480-52-0x0000000005060000-0x00000000050D8000-memory.dmp family_zgrat_v1 behavioral1/memory/2480-50-0x0000000005060000-0x00000000050D8000-memory.dmp family_zgrat_v1 behavioral1/memory/2480-44-0x0000000005060000-0x00000000050D8000-memory.dmp family_zgrat_v1 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
7bc04988ce8e7d3b9738ae0db7af487f.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\msdtc = "\"C:\\Users\\Admin\\AppData\\Local\\msdtc.exe\"" 7bc04988ce8e7d3b9738ae0db7af487f.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
7bc04988ce8e7d3b9738ae0db7af487f.exepid process 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
7bc04988ce8e7d3b9738ae0db7af487f.exedescription pid process Token: SeDebugPrivilege 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
7bc04988ce8e7d3b9738ae0db7af487f.exedescription pid process target process PID 2480 wrote to memory of 1760 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 7bc04988ce8e7d3b9738ae0db7af487f.exe PID 2480 wrote to memory of 1760 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 7bc04988ce8e7d3b9738ae0db7af487f.exe PID 2480 wrote to memory of 1760 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 7bc04988ce8e7d3b9738ae0db7af487f.exe PID 2480 wrote to memory of 1760 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 7bc04988ce8e7d3b9738ae0db7af487f.exe PID 2480 wrote to memory of 2368 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 7bc04988ce8e7d3b9738ae0db7af487f.exe PID 2480 wrote to memory of 2368 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 7bc04988ce8e7d3b9738ae0db7af487f.exe PID 2480 wrote to memory of 2368 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 7bc04988ce8e7d3b9738ae0db7af487f.exe PID 2480 wrote to memory of 2368 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 7bc04988ce8e7d3b9738ae0db7af487f.exe PID 2480 wrote to memory of 2272 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 7bc04988ce8e7d3b9738ae0db7af487f.exe PID 2480 wrote to memory of 2272 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 7bc04988ce8e7d3b9738ae0db7af487f.exe PID 2480 wrote to memory of 2272 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 7bc04988ce8e7d3b9738ae0db7af487f.exe PID 2480 wrote to memory of 2272 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 7bc04988ce8e7d3b9738ae0db7af487f.exe PID 2480 wrote to memory of 2116 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 7bc04988ce8e7d3b9738ae0db7af487f.exe PID 2480 wrote to memory of 2116 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 7bc04988ce8e7d3b9738ae0db7af487f.exe PID 2480 wrote to memory of 2116 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 7bc04988ce8e7d3b9738ae0db7af487f.exe PID 2480 wrote to memory of 2116 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 7bc04988ce8e7d3b9738ae0db7af487f.exe PID 2480 wrote to memory of 2180 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 7bc04988ce8e7d3b9738ae0db7af487f.exe PID 2480 wrote to memory of 2180 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 7bc04988ce8e7d3b9738ae0db7af487f.exe PID 2480 wrote to memory of 2180 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 7bc04988ce8e7d3b9738ae0db7af487f.exe PID 2480 wrote to memory of 2180 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 7bc04988ce8e7d3b9738ae0db7af487f.exe PID 2480 wrote to memory of 1592 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 7bc04988ce8e7d3b9738ae0db7af487f.exe PID 2480 wrote to memory of 1592 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 7bc04988ce8e7d3b9738ae0db7af487f.exe PID 2480 wrote to memory of 1592 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 7bc04988ce8e7d3b9738ae0db7af487f.exe PID 2480 wrote to memory of 1592 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 7bc04988ce8e7d3b9738ae0db7af487f.exe PID 2480 wrote to memory of 312 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 7bc04988ce8e7d3b9738ae0db7af487f.exe PID 2480 wrote to memory of 312 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 7bc04988ce8e7d3b9738ae0db7af487f.exe PID 2480 wrote to memory of 312 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 7bc04988ce8e7d3b9738ae0db7af487f.exe PID 2480 wrote to memory of 312 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 7bc04988ce8e7d3b9738ae0db7af487f.exe PID 2480 wrote to memory of 1588 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 7bc04988ce8e7d3b9738ae0db7af487f.exe PID 2480 wrote to memory of 1588 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 7bc04988ce8e7d3b9738ae0db7af487f.exe PID 2480 wrote to memory of 1588 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 7bc04988ce8e7d3b9738ae0db7af487f.exe PID 2480 wrote to memory of 1588 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 7bc04988ce8e7d3b9738ae0db7af487f.exe PID 2480 wrote to memory of 304 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 7bc04988ce8e7d3b9738ae0db7af487f.exe PID 2480 wrote to memory of 304 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 7bc04988ce8e7d3b9738ae0db7af487f.exe PID 2480 wrote to memory of 304 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 7bc04988ce8e7d3b9738ae0db7af487f.exe PID 2480 wrote to memory of 304 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 7bc04988ce8e7d3b9738ae0db7af487f.exe PID 2480 wrote to memory of 1764 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 7bc04988ce8e7d3b9738ae0db7af487f.exe PID 2480 wrote to memory of 1764 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 7bc04988ce8e7d3b9738ae0db7af487f.exe PID 2480 wrote to memory of 1764 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 7bc04988ce8e7d3b9738ae0db7af487f.exe PID 2480 wrote to memory of 1764 2480 7bc04988ce8e7d3b9738ae0db7af487f.exe 7bc04988ce8e7d3b9738ae0db7af487f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7bc04988ce8e7d3b9738ae0db7af487f.exe"C:\Users\Admin\AppData\Local\Temp\7bc04988ce8e7d3b9738ae0db7af487f.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7bc04988ce8e7d3b9738ae0db7af487f.exeC:\Users\Admin\AppData\Local\Temp\7bc04988ce8e7d3b9738ae0db7af487f.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\7bc04988ce8e7d3b9738ae0db7af487f.exeC:\Users\Admin\AppData\Local\Temp\7bc04988ce8e7d3b9738ae0db7af487f.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\7bc04988ce8e7d3b9738ae0db7af487f.exeC:\Users\Admin\AppData\Local\Temp\7bc04988ce8e7d3b9738ae0db7af487f.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\7bc04988ce8e7d3b9738ae0db7af487f.exeC:\Users\Admin\AppData\Local\Temp\7bc04988ce8e7d3b9738ae0db7af487f.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\7bc04988ce8e7d3b9738ae0db7af487f.exeC:\Users\Admin\AppData\Local\Temp\7bc04988ce8e7d3b9738ae0db7af487f.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\7bc04988ce8e7d3b9738ae0db7af487f.exeC:\Users\Admin\AppData\Local\Temp\7bc04988ce8e7d3b9738ae0db7af487f.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\7bc04988ce8e7d3b9738ae0db7af487f.exeC:\Users\Admin\AppData\Local\Temp\7bc04988ce8e7d3b9738ae0db7af487f.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\7bc04988ce8e7d3b9738ae0db7af487f.exeC:\Users\Admin\AppData\Local\Temp\7bc04988ce8e7d3b9738ae0db7af487f.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\7bc04988ce8e7d3b9738ae0db7af487f.exeC:\Users\Admin\AppData\Local\Temp\7bc04988ce8e7d3b9738ae0db7af487f.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\7bc04988ce8e7d3b9738ae0db7af487f.exeC:\Users\Admin\AppData\Local\Temp\7bc04988ce8e7d3b9738ae0db7af487f.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2480-1-0x00000000745D0000-0x0000000074CBE000-memory.dmpFilesize
6.9MB
-
memory/2480-0-0x0000000000010000-0x000000000024A000-memory.dmpFilesize
2.2MB
-
memory/2480-2-0x0000000000790000-0x00000000007D0000-memory.dmpFilesize
256KB
-
memory/2480-3-0x0000000008050000-0x0000000008266000-memory.dmpFilesize
2.1MB
-
memory/2480-4-0x0000000005060000-0x00000000050DE000-memory.dmpFilesize
504KB
-
memory/2480-5-0x0000000005060000-0x00000000050D8000-memory.dmpFilesize
480KB
-
memory/2480-6-0x0000000005060000-0x00000000050D8000-memory.dmpFilesize
480KB
-
memory/2480-8-0x0000000005060000-0x00000000050D8000-memory.dmpFilesize
480KB
-
memory/2480-10-0x0000000005060000-0x00000000050D8000-memory.dmpFilesize
480KB
-
memory/2480-12-0x0000000005060000-0x00000000050D8000-memory.dmpFilesize
480KB
-
memory/2480-14-0x0000000005060000-0x00000000050D8000-memory.dmpFilesize
480KB
-
memory/2480-16-0x0000000005060000-0x00000000050D8000-memory.dmpFilesize
480KB
-
memory/2480-18-0x0000000005060000-0x00000000050D8000-memory.dmpFilesize
480KB
-
memory/2480-20-0x0000000005060000-0x00000000050D8000-memory.dmpFilesize
480KB
-
memory/2480-22-0x0000000005060000-0x00000000050D8000-memory.dmpFilesize
480KB
-
memory/2480-24-0x0000000005060000-0x00000000050D8000-memory.dmpFilesize
480KB
-
memory/2480-26-0x0000000005060000-0x00000000050D8000-memory.dmpFilesize
480KB
-
memory/2480-28-0x0000000005060000-0x00000000050D8000-memory.dmpFilesize
480KB
-
memory/2480-30-0x0000000005060000-0x00000000050D8000-memory.dmpFilesize
480KB
-
memory/2480-32-0x0000000005060000-0x00000000050D8000-memory.dmpFilesize
480KB
-
memory/2480-34-0x0000000005060000-0x00000000050D8000-memory.dmpFilesize
480KB
-
memory/2480-36-0x0000000005060000-0x00000000050D8000-memory.dmpFilesize
480KB
-
memory/2480-38-0x0000000005060000-0x00000000050D8000-memory.dmpFilesize
480KB
-
memory/2480-40-0x0000000005060000-0x00000000050D8000-memory.dmpFilesize
480KB
-
memory/2480-42-0x0000000005060000-0x00000000050D8000-memory.dmpFilesize
480KB
-
memory/2480-46-0x0000000005060000-0x00000000050D8000-memory.dmpFilesize
480KB
-
memory/2480-48-0x0000000005060000-0x00000000050D8000-memory.dmpFilesize
480KB
-
memory/2480-66-0x0000000005060000-0x00000000050D8000-memory.dmpFilesize
480KB
-
memory/2480-68-0x0000000005060000-0x00000000050D8000-memory.dmpFilesize
480KB
-
memory/2480-64-0x0000000005060000-0x00000000050D8000-memory.dmpFilesize
480KB
-
memory/2480-62-0x0000000005060000-0x00000000050D8000-memory.dmpFilesize
480KB
-
memory/2480-60-0x0000000005060000-0x00000000050D8000-memory.dmpFilesize
480KB
-
memory/2480-58-0x0000000005060000-0x00000000050D8000-memory.dmpFilesize
480KB
-
memory/2480-56-0x0000000005060000-0x00000000050D8000-memory.dmpFilesize
480KB
-
memory/2480-54-0x0000000005060000-0x00000000050D8000-memory.dmpFilesize
480KB
-
memory/2480-52-0x0000000005060000-0x00000000050D8000-memory.dmpFilesize
480KB
-
memory/2480-50-0x0000000005060000-0x00000000050D8000-memory.dmpFilesize
480KB
-
memory/2480-140-0x00000000745D0000-0x0000000074CBE000-memory.dmpFilesize
6.9MB
-
memory/2480-44-0x0000000005060000-0x00000000050D8000-memory.dmpFilesize
480KB
-
memory/2480-2394-0x0000000000790000-0x00000000007D0000-memory.dmpFilesize
256KB
-
memory/2480-2396-0x00000000745D0000-0x0000000074CBE000-memory.dmpFilesize
6.9MB