zgrat | eb1807ea8cd84c6a86406728505e9cef81fcf78de2e2d1af4e5d1ed67a726ed5

General

Target

eb1807ea8cd84c6a86406728505e9cef81fcf78de2e2d1af4e5d1ed67a726ed5.exe
Size

2.2MB
MD5

84c895e5e9d2e8a4a33bcc6ec7657b20
SHA1

f7efe5f005597309a25ad8eeaba6c77dff827caf
SHA256

eb1807ea8cd84c6a86406728505e9cef81fcf78de2e2d1af4e5d1ed67a726ed5
SHA512

423841c1d334029bcfc4265b9599d219d42e8938504d9e9af0691111cbdb24c1d0a3712176b96faf0596732fa65129ee8e49a0a38efdfcfd3b212be82208ddff
SSDEEP

24576:2TbBv5rUyXVgEtP/SRdxjxY8eCpDbZXvSBNOjABV+m/dynu46+I9KTVQpeeKghOL:IBJLj8ZbkNF0m/0vV1eKghUYFtML/sJU

Score

10^/10

zgrat rat spyware stealer

Malware Config

Signatures

Detect ZGRat V1 2 IoCs

Processes:

resource	yara_rule
C:\PortproviderwinMonitorSvc\ContainerserverFontSavessession.exe	family_zgrat_v1
behavioral2/memory/4232-12-0x00000000008E0000-0x0000000000AD2000-memory.dmp	family_zgrat_v1

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3348	660	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4944	660	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3736	660	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	660	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4628	660	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2416	660	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1552	660	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3764	660	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4404	660	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	436	660	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3020	660	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1768	660	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	216	660	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4592	660	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5092	660	schtasks.exe

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

eb1807ea8cd84c6a86406728505e9cef81fcf78de2e2d1af4e5d1ed67a726ed5.exeWScript.exeContainerserverFontSavessession.exedllhost.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	eb1807ea8cd84c6a86406728505e9cef81fcf78de2e2d1af4e5d1ed67a726ed5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	ContainerserverFontSavessession.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	dllhost.exe

Executes dropped EXE 3 IoCs

Processes:

ContainerserverFontSavessession.exedllhost.exedllhost.exe

pid process

4232 ContainerserverFontSavessession.exe
3444 dllhost.exe
4308 dllhost.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in Program Files directory 4 IoCs

Processes:

ContainerserverFontSavessession.exe

description	ioc	process
File created	C:\Program Files (x86)\Windows Defender\fr-FR\Registry.exe	ContainerserverFontSavessession.exe
File created	C:\Program Files (x86)\Windows Defender\fr-FR\ee2ad38f3d4382	ContainerserverFontSavessession.exe
File created	C:\Program Files\Java\jdk-1.8\taskhostw.exe	ContainerserverFontSavessession.exe
File created	C:\Program Files\Java\jdk-1.8\ea9f0e6c9e2dcd	ContainerserverFontSavessession.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
3736	schtasks.exe
2280	schtasks.exe
4628	schtasks.exe
4944	schtasks.exe
436	schtasks.exe
216	schtasks.exe
3764	schtasks.exe
4404	schtasks.exe
4592	schtasks.exe
5092	schtasks.exe
2416	schtasks.exe
1552	schtasks.exe
3020	schtasks.exe
1768	schtasks.exe
3348	schtasks.exe

Modifies registry class 3 IoCs

Processes:

eb1807ea8cd84c6a86406728505e9cef81fcf78de2e2d1af4e5d1ed67a726ed5.exeContainerserverFontSavessession.exedllhost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings	eb1807ea8cd84c6a86406728505e9cef81fcf78de2e2d1af4e5d1ed67a726ed5.exe
Key created	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings	ContainerserverFontSavessession.exe
Key created	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings	dllhost.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3856 PING.EXE

pid	process
3856	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

ContainerserverFontSavessession.exe

pid	process
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe
4232	ContainerserverFontSavessession.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

ContainerserverFontSavessession.exedllhost.exedllhost.exe

description	pid	process
Token: SeDebugPrivilege	4232	ContainerserverFontSavessession.exe
Token: SeDebugPrivilege	3444	dllhost.exe
Token: SeDebugPrivilege	4308	dllhost.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

eb1807ea8cd84c6a86406728505e9cef81fcf78de2e2d1af4e5d1ed67a726ed5.exeWScript.execmd.exeContainerserverFontSavessession.execmd.exedllhost.execmd.exe

description	pid	process	target process
PID 4400 wrote to memory of 448	4400	eb1807ea8cd84c6a86406728505e9cef81fcf78de2e2d1af4e5d1ed67a726ed5.exe	WScript.exe
PID 4400 wrote to memory of 448	4400	eb1807ea8cd84c6a86406728505e9cef81fcf78de2e2d1af4e5d1ed67a726ed5.exe	WScript.exe
PID 4400 wrote to memory of 448	4400	eb1807ea8cd84c6a86406728505e9cef81fcf78de2e2d1af4e5d1ed67a726ed5.exe	WScript.exe
PID 448 wrote to memory of 2020	448	WScript.exe	cmd.exe
PID 448 wrote to memory of 2020	448	WScript.exe	cmd.exe
PID 448 wrote to memory of 2020	448	WScript.exe	cmd.exe
PID 2020 wrote to memory of 4232	2020	cmd.exe	ContainerserverFontSavessession.exe
PID 2020 wrote to memory of 4232	2020	cmd.exe	ContainerserverFontSavessession.exe
PID 4232 wrote to memory of 5080	4232	ContainerserverFontSavessession.exe	cmd.exe
PID 4232 wrote to memory of 5080	4232	ContainerserverFontSavessession.exe	cmd.exe
PID 5080 wrote to memory of 4444	5080	cmd.exe	chcp.com
PID 5080 wrote to memory of 4444	5080	cmd.exe	chcp.com
PID 5080 wrote to memory of 3856	5080	cmd.exe	PING.EXE
PID 5080 wrote to memory of 3856	5080	cmd.exe	PING.EXE
PID 5080 wrote to memory of 3444	5080	cmd.exe	dllhost.exe
PID 5080 wrote to memory of 3444	5080	cmd.exe	dllhost.exe
PID 3444 wrote to memory of 2292	3444	dllhost.exe	cmd.exe
PID 3444 wrote to memory of 2292	3444	dllhost.exe	cmd.exe
PID 2292 wrote to memory of 2040	2292	cmd.exe	chcp.com
PID 2292 wrote to memory of 2040	2292	cmd.exe	chcp.com
PID 2292 wrote to memory of 2920	2292	cmd.exe	w32tm.exe
PID 2292 wrote to memory of 2920	2292	cmd.exe	w32tm.exe
PID 2292 wrote to memory of 4308	2292	cmd.exe	dllhost.exe
PID 2292 wrote to memory of 4308	2292	cmd.exe	dllhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\eb1807ea8cd84c6a86406728505e9cef81fcf78de2e2d1af4e5d1ed67a726ed5.exe
"C:\Users\Admin\AppData\Local\Temp\eb1807ea8cd84c6a86406728505e9cef81fcf78de2e2d1af4e5d1ed67a726ed5.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4400

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\PortproviderwinMonitorSvc\mfKYow52WThs6WxYPgYy8SvlAX398RVKTuVkRNatbU.vbe"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:448

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\PortproviderwinMonitorSvc\vcwCtM23VtO7vZcBlCg44jyJmSVgI43HgFP0J6KvnQO3IbLY.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:2020

C:\PortproviderwinMonitorSvc\ContainerserverFontSavessession.exe
"C:\PortproviderwinMonitorSvc/ContainerserverFontSavessession.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4232

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3OCCoXM78I.bat"
5⤵
- Suspicious use of WriteProcessMemory
PID:5080

C:\Windows\system32\chcp.com
chcp 65001
6⤵
PID:4444

C:\Windows\system32\PING.EXE
ping -n 10 localhost
6⤵
- Runs ping.exe
PID:3856

C:\PortproviderwinMonitorSvc\dllhost.exe
"C:\PortproviderwinMonitorSvc\dllhost.exe"
6⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3444

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BangdtZtLJ.bat"
7⤵
- Suspicious use of WriteProcessMemory
PID:2292

C:\Windows\system32\chcp.com
chcp 65001
8⤵
PID:2040

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
8⤵
PID:2920

C:\PortproviderwinMonitorSvc\dllhost.exe
"C:\PortproviderwinMonitorSvc\dllhost.exe"
8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\odt\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\odt\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\odt\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\PortproviderwinMonitorSvc\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\PortproviderwinMonitorSvc\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\PortproviderwinMonitorSvc\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\odt\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\odt\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\odt\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 10 /tr "'C:\Program Files\Java\jdk-1.8\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\Java\jdk-1.8\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Program Files\Java\jdk-1.8\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5092

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PortproviderwinMonitorSvc\ContainerserverFontSavessession.exe
Filesize
1.9MB

MD5
d67f722b73a3cbef568a2e3124a4bc04

SHA1
27e0a75a646fb2869b31eab2f34f1de4db7e35e6

SHA256
b83aed8214e0f95cb74b9b2bbc49b16bd46cc46a9ec620a4ab1a3ddbde34c303

SHA512
c050652f2b11f4ad3ff9832f894ae6ada16400c41576b64e9bcfa2b785f15987b7d846f9bb597c4495edad91b4c67a8d601d5757afee39ed890148461f6de9bb

Download Submit
C:\PortproviderwinMonitorSvc\mfKYow52WThs6WxYPgYy8SvlAX398RVKTuVkRNatbU.vbe
Filesize
251B

MD5
288ece3d2e1006c5fa8a526d2d0fab12

SHA1
b466938792d856b963788f55037be3893024169f

SHA256
47a7ef36b24fc4250a41e93d7e132fee06b972b98317e6226814e676092b1fb1

SHA512
f818e2293f7128d1d12eeb577bbb1f9d16f0208a2b2c68d30f4b12e7ebececdc93c6b272810efb22d9b4778105e0ffc5da095feeda50ccfe9efecd52644a69b7

Download Submit
C:\PortproviderwinMonitorSvc\vcwCtM23VtO7vZcBlCg44jyJmSVgI43HgFP0J6KvnQO3IbLY.bat
Filesize
101B

MD5
a1e10402205eb4379b696c320914eea5

SHA1
048575ccf93cf9d1e039b1b1bce5eb97d61e1048

SHA256
0861e3de74e15568d8ed44ff86fea6f446ba8eb1561ec374202b4ebba7e279b5

SHA512
fde6ddd99da5609f138badeb28f448a2b673374a1c19eee36f9215c11efe96d7d9d64a396dcbfccc911ed26915c14ace092f10b821707162cd634d08663ad427

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dllhost.exe.log
Filesize
1KB

MD5
935ecb30a8e13f625a9a89e3b0fcbf8f

SHA1
41cb046b7b5f89955fd53949efad8e9f3971d731

SHA256
2a7b829afe6a140bb37d24cc7711749c20cdaaf9cc7c4a182ff081180b4d99e9

SHA512
1210281612b0101ce63555a1a7855589ff68e1eac5b8a2461e10808c5b92c5dd111be72406c2923a94e10b687ceda43dc24d8c22a49dab40a4af793ee6b740aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\3OCCoXM78I.bat
Filesize
168B

MD5
26a038435ad5e23b95a54f9a8691dce1

SHA1
cbf013d324a203f0bf71698a762ffe6a441ee9f6

SHA256
c6eec864ff4385f16519e85b1169b34d6e655a0835e0bc88e7c69568ebbc8f21

SHA512
5da99dc044919c59f53609266ee33eedb97eb11be9346d40c67d8511e4ee3311e4a3a57604257c1a752669f87606da7232ac92266173fc2fbc55b734acdf8fdd

Download Submit
C:\Users\Admin\AppData\Local\Temp\BangdtZtLJ.bat
Filesize
216B

MD5
27bddc4b2c65c27cc6d2e833dc157f5e

SHA1
b8082672413745ea7d02cca1330f92b2b6403f4e

SHA256
9970888c1c2ccd04f3f5ff113cafe1d9db65a8f5a1cfc99ca6e59e6f12cb49d9

SHA512
5d3b72c0c3306dbae9166ba62b374d71c174e6355ca43d5810a5fda37aa68c718154dccba61194de1526ece077c25ef275ba1ecf36de0057119ec246621e99f8

Download Submit
memory/3444-86-0x00007FFEF9FE0000-0x00007FFEFA09E000-memory.dmp

Filesize
760KB

Download
memory/3444-68-0x00007FFEF9FE0000-0x00007FFEFA09E000-memory.dmp

Filesize
760KB

Download
memory/3444-78-0x00007FFEDBD30000-0x00007FFEDC7F1000-memory.dmp

Filesize
10.8MB

Download
memory/3444-75-0x00007FFEF9F30000-0x00007FFEF9F31000-memory.dmp

Filesize
4KB

Download
memory/3444-74-0x00007FFEF9F40000-0x00007FFEF9F41000-memory.dmp

Filesize
4KB

Download
memory/3444-72-0x00007FFEF9F50000-0x00007FFEF9F51000-memory.dmp

Filesize
4KB

Download
memory/3444-69-0x00007FFEF9F60000-0x00007FFEF9F61000-memory.dmp

Filesize
4KB

Download
memory/3444-79-0x00007FFEF9F20000-0x00007FFEF9F21000-memory.dmp

Filesize
4KB

Download
memory/3444-66-0x00007FFEF9F70000-0x00007FFEF9F71000-memory.dmp

Filesize
4KB

Download
memory/3444-85-0x00007FFEDBD30000-0x00007FFEDC7F1000-memory.dmp

Filesize
10.8MB

Download
memory/3444-65-0x00007FFEF9FE0000-0x00007FFEFA09E000-memory.dmp

Filesize
760KB

Download
memory/3444-64-0x00000000030B0000-0x00000000030C0000-memory.dmp

Filesize
64KB

Download
memory/3444-63-0x00000000030B0000-0x00000000030C0000-memory.dmp

Filesize
64KB

Download
memory/3444-62-0x0000000001600000-0x0000000001601000-memory.dmp

Filesize
4KB

Download
memory/3444-61-0x00007FFEDBD30000-0x00007FFEDC7F1000-memory.dmp

Filesize
10.8MB

Download
memory/4232-26-0x000000001B7C0000-0x000000001B810000-memory.dmp

Filesize
320KB

Download
memory/4232-13-0x00007FFEDC080000-0x00007FFEDCB41000-memory.dmp

Filesize
10.8MB

Download
memory/4232-38-0x00007FFEF9F20000-0x00007FFEF9F21000-memory.dmp

Filesize
4KB

Download
memory/4232-35-0x0000000002D00000-0x0000000002D0E000-memory.dmp

Filesize
56KB

Download
memory/4232-56-0x00007FFEF9FE0000-0x00007FFEFA09E000-memory.dmp

Filesize
760KB

Download
memory/4232-55-0x00007FFEDC080000-0x00007FFEDCB41000-memory.dmp

Filesize
10.8MB

Download
memory/4232-33-0x00007FFEF9F30000-0x00007FFEF9F31000-memory.dmp

Filesize
4KB

Download
memory/4232-32-0x00007FFEF9F40000-0x00007FFEF9F41000-memory.dmp

Filesize
4KB

Download
memory/4232-31-0x0000000002CF0000-0x0000000002CFE000-memory.dmp

Filesize
56KB

Download
memory/4232-29-0x00007FFEF9F50000-0x00007FFEF9F51000-memory.dmp

Filesize
4KB

Download
memory/4232-28-0x0000000002D30000-0x0000000002D48000-memory.dmp

Filesize
96KB

Download
memory/4232-23-0x0000000002D10000-0x0000000002D2C000-memory.dmp

Filesize
112KB

Download
memory/4232-24-0x000000001B840000-0x000000001B850000-memory.dmp

Filesize
64KB

Download
memory/4232-25-0x00007FFEF9F60000-0x00007FFEF9F61000-memory.dmp

Filesize
4KB

Download
memory/4232-21-0x00007FFEF9F70000-0x00007FFEF9F71000-memory.dmp

Filesize
4KB

Download
memory/4232-20-0x00007FFEF9FE0000-0x00007FFEFA09E000-memory.dmp

Filesize
760KB

Download
memory/4232-18-0x0000000002CA0000-0x0000000002CAE000-memory.dmp

Filesize
56KB

Download
memory/4232-19-0x00007FFEF9FE0000-0x00007FFEFA09E000-memory.dmp

Filesize
760KB

Download
memory/4232-16-0x000000001B840000-0x000000001B850000-memory.dmp

Filesize
64KB

Download
memory/4232-15-0x000000001B840000-0x000000001B850000-memory.dmp

Filesize
64KB

Download
memory/4232-14-0x0000000001270000-0x0000000001271000-memory.dmp

Filesize
4KB

Download
memory/4232-37-0x0000000002D50000-0x0000000002D5E000-memory.dmp

Filesize
56KB

Download
memory/4232-12-0x00000000008E0000-0x0000000000AD2000-memory.dmp

Filesize
1.9MB

Download
memory/4308-101-0x00007FFEF9FE0000-0x00007FFEFA09E000-memory.dmp

Filesize
760KB

Download
memory/4308-140-0x000000001BC20000-0x000000001BC30000-memory.dmp

Filesize
64KB

Download
memory/4308-90-0x00007FFEDBC80000-0x00007FFEDC741000-memory.dmp

Filesize
10.8MB

Download
memory/4308-93-0x000000001BC20000-0x000000001BC30000-memory.dmp

Filesize
64KB

Download
memory/4308-95-0x00007FFEF9FE0000-0x00007FFEFA09E000-memory.dmp

Filesize
760KB

Download
memory/4308-96-0x00007FFEF9FE0000-0x00007FFEFA09E000-memory.dmp

Filesize
760KB

Download
memory/4308-98-0x00007FFEF9F70000-0x00007FFEF9F71000-memory.dmp

Filesize
4KB

Download
memory/4308-99-0x000000001BC20000-0x000000001BC30000-memory.dmp

Filesize
64KB

Download
memory/4308-92-0x000000001BC20000-0x000000001BC30000-memory.dmp

Filesize
64KB

Download
memory/4308-91-0x0000000001820000-0x0000000001821000-memory.dmp

Filesize
4KB

Download
memory/4308-105-0x00007FFEF9F40000-0x00007FFEF9F41000-memory.dmp

Filesize
4KB

Download
memory/4308-103-0x00007FFEF9F50000-0x00007FFEF9F51000-memory.dmp

Filesize
4KB

Download
memory/4308-107-0x00007FFEF9F30000-0x00007FFEF9F31000-memory.dmp

Filesize
4KB

Download
memory/4308-109-0x00007FFEF9F20000-0x00007FFEF9F21000-memory.dmp

Filesize
4KB

Download
memory/4308-110-0x00007FFEDBC80000-0x00007FFEDC741000-memory.dmp

Filesize
10.8MB

Download
memory/4308-111-0x000000001BC20000-0x000000001BC30000-memory.dmp

Filesize
64KB

Download
memory/4308-112-0x000000001BC20000-0x000000001BC30000-memory.dmp

Filesize
64KB

Download
memory/4308-139-0x000000001BC20000-0x000000001BC30000-memory.dmp

Filesize
64KB

Download
memory/4308-102-0x00007FFEF9F60000-0x00007FFEF9F61000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads