Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
13/02/2024, 02:28
General
-
Target
983ffa6d57f86647306da729613df330.exe
-
Size
984KB
-
MD5
983ffa6d57f86647306da729613df330
-
SHA1
9cbc4aa1b4f5566a7d8a9c508edc7cc96772c1c0
-
SHA256
4c9a06f79b7bab68122b2d164b63523dceb0205d044c8d230bb758d7fc4729e8
-
SHA512
90d5b58598e2e8a904363058441956df840cf75389bc8f89b28fe70fd8ef2c7c98c70928ac208002550a127affe57668692d18bc0dd5bdab6f5f2095ebdd6313
-
SSDEEP
12288:vz+MO8FsF87bhQxUKKKVxe8QuWtajt6iLq17BKGUEsLDw:b+MOQW87bhQxtVUwWa6iLe76Ei
Malware Config
Signatures
-
Detect ZGRat V1 35 IoCs
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 31 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\983ffa6d57f86647306da729613df330.exe"C:\Users\Admin\AppData\Local\Temp\983ffa6d57f86647306da729613df330.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Wstvstiulknlrmkszuhfp.vbs"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome.exe'3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\983ffa6d57f86647306da729613df330.exeC:\Users\Admin\AppData\Local\Temp\983ffa6d57f86647306da729613df330.exe2⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\983ffa6d57f86647306da729613df330.exe" "983ffa6d57f86647306da729613df330.exe" ENABLE3⤵
- Modifies Windows Firewall
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b5291f3dcf2c13784e09a057f2e43d13
SHA1fbb72f4b04269e0d35b1d9c29d02d63dbc7ad07e
SHA256ad995b51344d71019f96fc3a424de00256065daad8595ff599f6849c87ae75ce
SHA51211c89caac425bccaa24e2bb24c6f2b4e6d6863278bf8a5304a42bb44475b08ca586e09143e7d5b14db7f1cd9adacd5358769e0d999dc348073431031067bd4d4
-
Filesize
174B
MD59ddcc4f0461d539fcb94a37a1eb1e0ba
SHA1930e0dd65c6ed6e710809940f9ac4d0747d3ab43
SHA2567b4862f9628d5d53ea11f559eb7dbc5c53068cf4b7c3c499334f2537c91131cc
SHA5127585d527b8bacc8c500816001e271eb70015f8782fb97264c7e35642d88ba6aa51a952f602275334763ab9fcb3b045780fe76dcf094c5cade865e8bb8efdb913
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
304KB
-
Filesize
64KB
-
Filesize
56KB
-
Filesize
68KB
-
Filesize
600KB
-
Filesize
40KB
-
Filesize
6.5MB
-
Filesize
104KB
-
Filesize
652KB
-
Filesize
120KB
-
Filesize
64KB
-
Filesize
104KB
-
Filesize
200KB
-
Filesize
80KB
-
Filesize
304KB
-
Filesize
120KB
-
Filesize
3.3MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
32KB
-
Filesize
136KB
-
Filesize
6.2MB
-
Filesize
64KB
-
Filesize
216KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
64KB
-
Filesize
120KB
-
Filesize
32KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
1008KB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
584KB
-
Filesize
64KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
7.7MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
536KB
-
Filesize
472KB
-
Filesize
376KB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
624KB
-
Filesize
168KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
64KB