Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
03-02-2024 22:34
Static task
static1
Behavioral task
behavioral1
Sample
8d8676c68f72dbc38fb5e6aea9bface2.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8d8676c68f72dbc38fb5e6aea9bface2.exe
Resource
win10v2004-20231222-en
General
-
Target
8d8676c68f72dbc38fb5e6aea9bface2.exe
-
Size
2.5MB
-
MD5
8d8676c68f72dbc38fb5e6aea9bface2
-
SHA1
6d1161bb446902b7810191460534bcfc16d60a93
-
SHA256
2dfe2bfefe91c1209836e4017cb2a3bb001a6de6314545f8a8eb6794a2adc204
-
SHA512
89bbaf8ade5fb327146df1daa403f98618bfa61cb0fe3b77fd9cde655ba11025105e50a15b198844c33180d6ca928dca032431009201969805199e719c11f316
-
SSDEEP
49152:g05hmzZS+dwD9Z6ysSSsEa1xox6Qn6ZDun:YzZBWsSSsEYxot6Zin
Malware Config
Extracted
bitrat
1.38
37.0.11.183:4444
-
communication_password
5f4dcc3b5aa765d61d8327deb882cf99
-
tor_process
tor
Signatures
-
Detect ZGRat V1 34 IoCs
Processes:
resource yara_rule behavioral1/memory/2672-6-0x0000000005430000-0x000000000548A000-memory.dmp family_zgrat_v1 behavioral1/memory/2672-7-0x0000000005430000-0x0000000005485000-memory.dmp family_zgrat_v1 behavioral1/memory/2672-8-0x0000000005430000-0x0000000005485000-memory.dmp family_zgrat_v1 behavioral1/memory/2672-10-0x0000000005430000-0x0000000005485000-memory.dmp family_zgrat_v1 behavioral1/memory/2672-12-0x0000000005430000-0x0000000005485000-memory.dmp family_zgrat_v1 behavioral1/memory/2672-14-0x0000000005430000-0x0000000005485000-memory.dmp family_zgrat_v1 behavioral1/memory/2672-22-0x0000000005430000-0x0000000005485000-memory.dmp family_zgrat_v1 behavioral1/memory/2672-30-0x0000000005430000-0x0000000005485000-memory.dmp family_zgrat_v1 behavioral1/memory/2672-34-0x0000000005430000-0x0000000005485000-memory.dmp family_zgrat_v1 behavioral1/memory/2672-36-0x0000000005430000-0x0000000005485000-memory.dmp family_zgrat_v1 behavioral1/memory/2672-38-0x0000000005430000-0x0000000005485000-memory.dmp family_zgrat_v1 behavioral1/memory/2672-32-0x0000000005430000-0x0000000005485000-memory.dmp family_zgrat_v1 behavioral1/memory/2672-42-0x0000000005430000-0x0000000005485000-memory.dmp family_zgrat_v1 behavioral1/memory/2672-46-0x0000000005430000-0x0000000005485000-memory.dmp family_zgrat_v1 behavioral1/memory/2672-48-0x0000000005430000-0x0000000005485000-memory.dmp family_zgrat_v1 behavioral1/memory/2672-50-0x0000000005430000-0x0000000005485000-memory.dmp family_zgrat_v1 behavioral1/memory/2672-60-0x0000000005430000-0x0000000005485000-memory.dmp family_zgrat_v1 behavioral1/memory/2672-68-0x0000000005430000-0x0000000005485000-memory.dmp family_zgrat_v1 behavioral1/memory/2672-70-0x0000000005430000-0x0000000005485000-memory.dmp family_zgrat_v1 behavioral1/memory/2672-66-0x0000000005430000-0x0000000005485000-memory.dmp family_zgrat_v1 behavioral1/memory/2672-64-0x0000000005430000-0x0000000005485000-memory.dmp family_zgrat_v1 behavioral1/memory/2672-62-0x0000000005430000-0x0000000005485000-memory.dmp family_zgrat_v1 behavioral1/memory/2672-58-0x0000000005430000-0x0000000005485000-memory.dmp family_zgrat_v1 behavioral1/memory/2672-56-0x0000000005430000-0x0000000005485000-memory.dmp family_zgrat_v1 behavioral1/memory/2672-54-0x0000000005430000-0x0000000005485000-memory.dmp family_zgrat_v1 behavioral1/memory/2672-52-0x0000000005430000-0x0000000005485000-memory.dmp family_zgrat_v1 behavioral1/memory/2672-44-0x0000000005430000-0x0000000005485000-memory.dmp family_zgrat_v1 behavioral1/memory/2672-40-0x0000000005430000-0x0000000005485000-memory.dmp family_zgrat_v1 behavioral1/memory/2672-28-0x0000000005430000-0x0000000005485000-memory.dmp family_zgrat_v1 behavioral1/memory/2672-26-0x0000000005430000-0x0000000005485000-memory.dmp family_zgrat_v1 behavioral1/memory/2672-24-0x0000000005430000-0x0000000005485000-memory.dmp family_zgrat_v1 behavioral1/memory/2672-20-0x0000000005430000-0x0000000005485000-memory.dmp family_zgrat_v1 behavioral1/memory/2672-18-0x0000000005430000-0x0000000005485000-memory.dmp family_zgrat_v1 behavioral1/memory/2672-16-0x0000000005430000-0x0000000005485000-memory.dmp family_zgrat_v1 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
8d8676c68f72dbc38fb5e6aea9bface2.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\NvidiaShare = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\NVIDIA\\NvidiaShare.exe\"" 8d8676c68f72dbc38fb5e6aea9bface2.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
8d8676c68f72dbc38fb5e6aea9bface2.exepid process 1016 8d8676c68f72dbc38fb5e6aea9bface2.exe 1016 8d8676c68f72dbc38fb5e6aea9bface2.exe 1016 8d8676c68f72dbc38fb5e6aea9bface2.exe 1016 8d8676c68f72dbc38fb5e6aea9bface2.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
8d8676c68f72dbc38fb5e6aea9bface2.exedescription pid process target process PID 2672 set thread context of 1016 2672 8d8676c68f72dbc38fb5e6aea9bface2.exe 8d8676c68f72dbc38fb5e6aea9bface2.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
8d8676c68f72dbc38fb5e6aea9bface2.exepid process 2672 8d8676c68f72dbc38fb5e6aea9bface2.exe 2672 8d8676c68f72dbc38fb5e6aea9bface2.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
8d8676c68f72dbc38fb5e6aea9bface2.exe8d8676c68f72dbc38fb5e6aea9bface2.exedescription pid process Token: SeDebugPrivilege 2672 8d8676c68f72dbc38fb5e6aea9bface2.exe Token: SeDebugPrivilege 1016 8d8676c68f72dbc38fb5e6aea9bface2.exe Token: SeShutdownPrivilege 1016 8d8676c68f72dbc38fb5e6aea9bface2.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
8d8676c68f72dbc38fb5e6aea9bface2.exepid process 1016 8d8676c68f72dbc38fb5e6aea9bface2.exe 1016 8d8676c68f72dbc38fb5e6aea9bface2.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
8d8676c68f72dbc38fb5e6aea9bface2.exedescription pid process target process PID 2672 wrote to memory of 1016 2672 8d8676c68f72dbc38fb5e6aea9bface2.exe 8d8676c68f72dbc38fb5e6aea9bface2.exe PID 2672 wrote to memory of 1016 2672 8d8676c68f72dbc38fb5e6aea9bface2.exe 8d8676c68f72dbc38fb5e6aea9bface2.exe PID 2672 wrote to memory of 1016 2672 8d8676c68f72dbc38fb5e6aea9bface2.exe 8d8676c68f72dbc38fb5e6aea9bface2.exe PID 2672 wrote to memory of 1016 2672 8d8676c68f72dbc38fb5e6aea9bface2.exe 8d8676c68f72dbc38fb5e6aea9bface2.exe PID 2672 wrote to memory of 1016 2672 8d8676c68f72dbc38fb5e6aea9bface2.exe 8d8676c68f72dbc38fb5e6aea9bface2.exe PID 2672 wrote to memory of 1016 2672 8d8676c68f72dbc38fb5e6aea9bface2.exe 8d8676c68f72dbc38fb5e6aea9bface2.exe PID 2672 wrote to memory of 1016 2672 8d8676c68f72dbc38fb5e6aea9bface2.exe 8d8676c68f72dbc38fb5e6aea9bface2.exe PID 2672 wrote to memory of 1016 2672 8d8676c68f72dbc38fb5e6aea9bface2.exe 8d8676c68f72dbc38fb5e6aea9bface2.exe PID 2672 wrote to memory of 1016 2672 8d8676c68f72dbc38fb5e6aea9bface2.exe 8d8676c68f72dbc38fb5e6aea9bface2.exe PID 2672 wrote to memory of 1016 2672 8d8676c68f72dbc38fb5e6aea9bface2.exe 8d8676c68f72dbc38fb5e6aea9bface2.exe PID 2672 wrote to memory of 1016 2672 8d8676c68f72dbc38fb5e6aea9bface2.exe 8d8676c68f72dbc38fb5e6aea9bface2.exe PID 2672 wrote to memory of 1016 2672 8d8676c68f72dbc38fb5e6aea9bface2.exe 8d8676c68f72dbc38fb5e6aea9bface2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d8676c68f72dbc38fb5e6aea9bface2.exe"C:\Users\Admin\AppData\Local\Temp\8d8676c68f72dbc38fb5e6aea9bface2.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8d8676c68f72dbc38fb5e6aea9bface2.exeC:\Users\Admin\AppData\Local\Temp\8d8676c68f72dbc38fb5e6aea9bface2.exe2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1016-1791-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1016-1800-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2672-60-0x0000000005430000-0x0000000005485000-memory.dmpFilesize
340KB
-
memory/2672-2-0x0000000000710000-0x0000000000750000-memory.dmpFilesize
256KB
-
memory/2672-4-0x0000000000710000-0x0000000000750000-memory.dmpFilesize
256KB
-
memory/2672-70-0x0000000005430000-0x0000000005485000-memory.dmpFilesize
340KB
-
memory/2672-6-0x0000000005430000-0x000000000548A000-memory.dmpFilesize
360KB
-
memory/2672-7-0x0000000005430000-0x0000000005485000-memory.dmpFilesize
340KB
-
memory/2672-8-0x0000000005430000-0x0000000005485000-memory.dmpFilesize
340KB
-
memory/2672-10-0x0000000005430000-0x0000000005485000-memory.dmpFilesize
340KB
-
memory/2672-12-0x0000000005430000-0x0000000005485000-memory.dmpFilesize
340KB
-
memory/2672-14-0x0000000005430000-0x0000000005485000-memory.dmpFilesize
340KB
-
memory/2672-22-0x0000000005430000-0x0000000005485000-memory.dmpFilesize
340KB
-
memory/2672-30-0x0000000005430000-0x0000000005485000-memory.dmpFilesize
340KB
-
memory/2672-34-0x0000000005430000-0x0000000005485000-memory.dmpFilesize
340KB
-
memory/2672-36-0x0000000005430000-0x0000000005485000-memory.dmpFilesize
340KB
-
memory/2672-38-0x0000000005430000-0x0000000005485000-memory.dmpFilesize
340KB
-
memory/2672-32-0x0000000005430000-0x0000000005485000-memory.dmpFilesize
340KB
-
memory/2672-42-0x0000000005430000-0x0000000005485000-memory.dmpFilesize
340KB
-
memory/2672-64-0x0000000005430000-0x0000000005485000-memory.dmpFilesize
340KB
-
memory/2672-48-0x0000000005430000-0x0000000005485000-memory.dmpFilesize
340KB
-
memory/2672-50-0x0000000005430000-0x0000000005485000-memory.dmpFilesize
340KB
-
memory/2672-0-0x0000000000820000-0x0000000000A9A000-memory.dmpFilesize
2.5MB
-
memory/2672-68-0x0000000005430000-0x0000000005485000-memory.dmpFilesize
340KB
-
memory/2672-5-0x0000000008E70000-0x0000000009074000-memory.dmpFilesize
2.0MB
-
memory/2672-3-0x0000000000710000-0x0000000000750000-memory.dmpFilesize
256KB
-
memory/2672-46-0x0000000005430000-0x0000000005485000-memory.dmpFilesize
340KB
-
memory/2672-62-0x0000000005430000-0x0000000005485000-memory.dmpFilesize
340KB
-
memory/2672-58-0x0000000005430000-0x0000000005485000-memory.dmpFilesize
340KB
-
memory/2672-56-0x0000000005430000-0x0000000005485000-memory.dmpFilesize
340KB
-
memory/2672-54-0x0000000005430000-0x0000000005485000-memory.dmpFilesize
340KB
-
memory/2672-52-0x0000000005430000-0x0000000005485000-memory.dmpFilesize
340KB
-
memory/2672-44-0x0000000005430000-0x0000000005485000-memory.dmpFilesize
340KB
-
memory/2672-40-0x0000000005430000-0x0000000005485000-memory.dmpFilesize
340KB
-
memory/2672-28-0x0000000005430000-0x0000000005485000-memory.dmpFilesize
340KB
-
memory/2672-26-0x0000000005430000-0x0000000005485000-memory.dmpFilesize
340KB
-
memory/2672-24-0x0000000005430000-0x0000000005485000-memory.dmpFilesize
340KB
-
memory/2672-20-0x0000000005430000-0x0000000005485000-memory.dmpFilesize
340KB
-
memory/2672-18-0x0000000005430000-0x0000000005485000-memory.dmpFilesize
340KB
-
memory/2672-16-0x0000000005430000-0x0000000005485000-memory.dmpFilesize
340KB
-
memory/2672-1773-0x0000000074C90000-0x000000007537E000-memory.dmpFilesize
6.9MB
-
memory/2672-1774-0x0000000000710000-0x0000000000750000-memory.dmpFilesize
256KB
-
memory/2672-1775-0x0000000000710000-0x0000000000750000-memory.dmpFilesize
256KB
-
memory/2672-1776-0x0000000000710000-0x0000000000750000-memory.dmpFilesize
256KB
-
memory/2672-1790-0x0000000074C90000-0x000000007537E000-memory.dmpFilesize
6.9MB
-
memory/2672-66-0x0000000005430000-0x0000000005485000-memory.dmpFilesize
340KB
-
memory/2672-1-0x0000000074C90000-0x000000007537E000-memory.dmpFilesize
6.9MB