Analysis

  • max time kernel
    147s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    12-02-2024 03:49

General

  • Target

    78a0343b36930749e066ca0bf9a171b338fd00e9dbe3d6e364e06eb4e78cf0ce.exe

  • Size

    1.8MB

  • MD5

    afa014338532a8f730aa8e6b5ca09874

  • SHA1

    0a55224d9cf55e5ab12087a8af15612d75753d33

  • SHA256

    78a0343b36930749e066ca0bf9a171b338fd00e9dbe3d6e364e06eb4e78cf0ce

  • SHA512

    5c947b9342d83147633c0956d3af8453b7d6390c78836c810d13d60fe30528d2a74720430104503650ab1ba426cae8554ddd10e002f32d83855b220eb4ac881f

  • SSDEEP

    24576:XZkERkn0rQKC/L5ZQk/Pv6mD6JtkOW4l2f1yz+dGP4hSjdirHEbxn4uYRtqMSZ8I:XZbRk0wXPvp0kNxdCgkdi4tnYnJI

Malware Config

Signatures

  • Detect ZGRat V1 5 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Detects executables packed with unregistered version of .NET Reactor 5 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 5 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\78a0343b36930749e066ca0bf9a171b338fd00e9dbe3d6e364e06eb4e78cf0ce.exe
    "C:\Users\Admin\AppData\Local\Temp\78a0343b36930749e066ca0bf9a171b338fd00e9dbe3d6e364e06eb4e78cf0ce.exe"
    1⤵
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2572
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FmvCXXfTq7.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2780
      • C:\Program Files\Windows NT\TableTextService\lsm.exe
        "C:\Program Files\Windows NT\TableTextService\lsm.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        PID:2924
  • C:\Windows\system32\chcp.com
    chcp 65001
    1⤵
      PID:2372
    • C:\Windows\system32\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      1⤵
        PID:2740

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files\Windows NT\TableTextService\lsm.exe

        Filesize

        425KB

        MD5

        849de1041f2b5be2a3e1301685bfa1c0

        SHA1

        0df509df8c3b83672c611900b3d84a1811dfd5d5

        SHA256

        847404d00a36276c29757162b923b50929967acb16afca786a77278831cdc45c

        SHA512

        1b0735563fff36bd34bfec0934bc1e962f9d71e316deb2d81f7f8999207036181b971a572aa0935ba6463b6bdb22beb7dc3db612d16576c6ea23cec77ee1f06d

      • C:\Program Files\Windows NT\TableTextService\lsm.exe

        Filesize

        189KB

        MD5

        7cdc1932bfa3f9dac8ef4cb32a0c1d50

        SHA1

        3b45ab3c07d4553c631c48babccd64a287f4c685

        SHA256

        540701420d61626f432d8858362c5a1cae96edac72d4b4f46d38cdb752676dad

        SHA512

        f4395ae454cad21f0dedd188f1cc32dc8f56f39ccf3a5ec6ed968639ac91b70172aa923b299efb364c07f0e5779b69ae7105014f3c353b2b9d8916540abb778e

      • C:\Recovery\463aa442-9b96-11ee-b087-e6b52eba4e86\dllhost.exe

        Filesize

        1.8MB

        MD5

        afa014338532a8f730aa8e6b5ca09874

        SHA1

        0a55224d9cf55e5ab12087a8af15612d75753d33

        SHA256

        78a0343b36930749e066ca0bf9a171b338fd00e9dbe3d6e364e06eb4e78cf0ce

        SHA512

        5c947b9342d83147633c0956d3af8453b7d6390c78836c810d13d60fe30528d2a74720430104503650ab1ba426cae8554ddd10e002f32d83855b220eb4ac881f

      • C:\Users\Admin\AppData\Local\Temp\FmvCXXfTq7.bat

        Filesize

        228B

        MD5

        481e01dd529d268579c9c80e641c3d15

        SHA1

        95458edc8e841960194a203aadb36b26404b79d3

        SHA256

        d3fbfebd402cc22112ded5a933d957e51b8eaf63b5b630d491d7c1b184424452

        SHA512

        c9e99b2c263f873303bd0edacd68c90a9c2d5e38aad3fdda7e02d32db03f6efec63283941e058f3df3c71c50c0de7c844ce936a1392f33671d03d032bedeef43

      • memory/2572-33-0x000007FEF5380000-0x000007FEF5D6C000-memory.dmp

        Filesize

        9.9MB

      • memory/2572-8-0x000000001B0E0000-0x000000001B160000-memory.dmp

        Filesize

        512KB

      • memory/2572-9-0x0000000076DA0000-0x0000000076DA1000-memory.dmp

        Filesize

        4KB

      • memory/2572-7-0x0000000076DB0000-0x0000000076DB1000-memory.dmp

        Filesize

        4KB

      • memory/2572-6-0x0000000000560000-0x000000000056E000-memory.dmp

        Filesize

        56KB

      • memory/2572-11-0x0000000000720000-0x000000000073C000-memory.dmp

        Filesize

        112KB

      • memory/2572-13-0x00000000008E0000-0x00000000008F8000-memory.dmp

        Filesize

        96KB

      • memory/2572-14-0x0000000076D90000-0x0000000076D91000-memory.dmp

        Filesize

        4KB

      • memory/2572-17-0x00000000006F0000-0x00000000006FE000-memory.dmp

        Filesize

        56KB

      • memory/2572-15-0x0000000076D80000-0x0000000076D81000-memory.dmp

        Filesize

        4KB

      • memory/2572-4-0x000000001B0E0000-0x000000001B160000-memory.dmp

        Filesize

        512KB

      • memory/2572-3-0x0000000000230000-0x0000000000231000-memory.dmp

        Filesize

        4KB

      • memory/2572-0-0x0000000000240000-0x000000000041E000-memory.dmp

        Filesize

        1.9MB

      • memory/2572-2-0x000000001B0E0000-0x000000001B160000-memory.dmp

        Filesize

        512KB

      • memory/2572-1-0x000007FEF5380000-0x000007FEF5D6C000-memory.dmp

        Filesize

        9.9MB

      • memory/2924-36-0x00000000009B0000-0x0000000000B8E000-memory.dmp

        Filesize

        1.9MB

      • memory/2924-37-0x000007FEF4990000-0x000007FEF537C000-memory.dmp

        Filesize

        9.9MB

      • memory/2924-39-0x0000000000140000-0x0000000000141000-memory.dmp

        Filesize

        4KB

      • memory/2924-38-0x000000001B150000-0x000000001B1D0000-memory.dmp

        Filesize

        512KB

      • memory/2924-40-0x000000001B150000-0x000000001B1D0000-memory.dmp

        Filesize

        512KB

      • memory/2924-44-0x0000000076DA0000-0x0000000076DA1000-memory.dmp

        Filesize

        4KB

      • memory/2924-49-0x0000000076D80000-0x0000000076D81000-memory.dmp

        Filesize

        4KB

      • memory/2924-46-0x0000000076D90000-0x0000000076D91000-memory.dmp

        Filesize

        4KB

      • memory/2924-43-0x000000001B150000-0x000000001B1D0000-memory.dmp

        Filesize

        512KB

      • memory/2924-42-0x0000000076DB0000-0x0000000076DB1000-memory.dmp

        Filesize

        4KB

      • memory/2924-51-0x000000001B150000-0x000000001B1D0000-memory.dmp

        Filesize

        512KB

      • memory/2924-50-0x000007FEF4990000-0x000007FEF537C000-memory.dmp

        Filesize

        9.9MB

      • memory/2924-52-0x000000001B150000-0x000000001B1D0000-memory.dmp

        Filesize

        512KB

      • memory/2924-53-0x000000001B150000-0x000000001B1D0000-memory.dmp

        Filesize

        512KB

      • memory/2924-70-0x000000001B150000-0x000000001B1D0000-memory.dmp

        Filesize

        512KB

      • memory/2924-71-0x000000001B150000-0x000000001B1D0000-memory.dmp

        Filesize

        512KB