Analysis
-
max time kernel
13s -
max time network
14s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
09-02-2024 16:10
Static task
static1
Behavioral task
behavioral1
Sample
crypted.exe
Resource
win10v2004-20231222-en
6 signatures
150 seconds
General
-
Target
crypted.exe
-
Size
412KB
-
MD5
3c9da20ad78d24df53b661b7129959e0
-
SHA1
e7956e819cc1d2abafb2228a10cf22b9391fb611
-
SHA256
2fd37ed834b6cd3747f1017ee09b3f97170245f59f9f2ed37c15b62580623319
-
SHA512
1a02da1652a2c00df33eceda0706adebb5a5f1c3c05e30a09857c94d2fbb93e570f768af5d6648d3a5d11eea3b5c4b1ceb9393fc05248f1eefd96e17f3bbe1b4
-
SSDEEP
12288:eDmrLy4dMMrASo/n7zUvOTdlzAarl6LmH6RPz5N:um9MMo7zUKdlzlJ62qPP
Score
10/10
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
resource yara_rule behavioral1/memory/2972-5-0x0000000000400000-0x000000000045A000-memory.dmp family_zgrat_v1 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral1/memory/2972-5-0x0000000000400000-0x000000000045A000-memory.dmp family_redline -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4284 set thread context of 2972 4284 crypted.exe 85 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4284 wrote to memory of 3584 4284 crypted.exe 84 PID 4284 wrote to memory of 3584 4284 crypted.exe 84 PID 4284 wrote to memory of 3584 4284 crypted.exe 84 PID 4284 wrote to memory of 2972 4284 crypted.exe 85 PID 4284 wrote to memory of 2972 4284 crypted.exe 85 PID 4284 wrote to memory of 2972 4284 crypted.exe 85 PID 4284 wrote to memory of 2972 4284 crypted.exe 85 PID 4284 wrote to memory of 2972 4284 crypted.exe 85 PID 4284 wrote to memory of 2972 4284 crypted.exe 85 PID 4284 wrote to memory of 2972 4284 crypted.exe 85 PID 4284 wrote to memory of 2972 4284 crypted.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\crypted.exe"C:\Users\Admin\AppData\Local\Temp\crypted.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:3584
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:2972
-