Analysis
-
max time kernel
146s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
25-02-2024 12:29
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240221-en
General
-
Target
file.exe
-
Size
7.0MB
-
MD5
f91e26ad117d187f3fc7bc2aeadb9c4d
-
SHA1
6cb277d592ee18700a0386e183a96535c9fa7c5a
-
SHA256
fb649af245b195baa02a4790f237b4c7dad4d9a116ab10ec5fdb9be45dbd628a
-
SHA512
30173320a736f385ed4c28cf33383487abd70d8c369dfd39863331b40b02c6f8b71eec6096ab77b61f0df9819e834900c73409f7bc03981f4bb86ffb1cb74814
-
SSDEEP
49152:EbV/PT3YubG0iYsV5TK7n46OeBIl0WS2q0GMQRZn1JUOKInVh+fg63+NSQbUFkDg:EbV/PT3luw5OeBAS2q0O1TubOSQbNjI
Malware Config
Extracted
lumma
https://fieldtrollyeowskwe.shop/api
https://technologyenterdo.shop/api
https://detectordiscusser.shop/api
https://turkeyunlikelyofw.shop/api
https://associationokeo.shop/api
Signatures
-
Detect ZGRat V1 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4612-1-0x0000000000790000-0x0000000000E90000-memory.dmp family_zgrat_v1 -
Loads dropped DLL 1 IoCs
Processes:
file.exepid process 4612 file.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
file.exedescription pid process target process PID 4612 set thread context of 2032 4612 file.exe MsBuild.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
file.exedescription pid process target process PID 4612 wrote to memory of 2032 4612 file.exe MsBuild.exe PID 4612 wrote to memory of 2032 4612 file.exe MsBuild.exe PID 4612 wrote to memory of 2032 4612 file.exe MsBuild.exe PID 4612 wrote to memory of 2032 4612 file.exe MsBuild.exe PID 4612 wrote to memory of 2032 4612 file.exe MsBuild.exe PID 4612 wrote to memory of 2032 4612 file.exe MsBuild.exe PID 4612 wrote to memory of 2032 4612 file.exe MsBuild.exe PID 4612 wrote to memory of 2032 4612 file.exe MsBuild.exe PID 4612 wrote to memory of 2032 4612 file.exe MsBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe2⤵PID:2032
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
742KB
MD5544cd51a596619b78e9b54b70088307d
SHA14769ddd2dbc1dc44b758964ed0bd231b85880b65
SHA256dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd
SHA512f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719