Analysis
- max time kernel
295s - max time network
297s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
27/02/2024, 01:36
General
- Target ac.exe
- Size 396KB
- Sample240227-b1mtqsdg2v
- SHA256 023fb24e4591fcbbff6096a61e7cbfb79bc1bade9236dd0db6ede7ab1e00bf9f
Malware Config
Extracted
-
raccoon
-
ee3b370277b98939f8098234def6cb188c03591f
-
url4cnc
https://telete.in/brikitiki
Signatures
- Detect ZGRat V1 1 IoCs
- Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
- Raccoon Stealer V1 payload 4 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac.exe"C:\Users\Admin\AppData\Local\Temp\ac.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe"Powershell" Add-MpPreference -ExclusionPath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\ddvlc.exe"'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\ac.exe"C:\Users\Admin\AppData\Local\Temp\ac.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_2l4t5jod.3ly.ps1
memory/2572-11-0x00000000747A0000-0x0000000074F50000-memory.dmp
memory/2572-1-0x00000000747A0000-0x0000000074F50000-memory.dmp
memory/2572-2-0x00000000056F0000-0x0000000005700000-memory.dmp
memory/2572-3-0x0000000005510000-0x0000000005576000-memory.dmp
memory/2572-5-0x0000000005580000-0x0000000005592000-memory.dmp
memory/2572-0-0x0000000000BC0000-0x0000000000C2A000-memory.dmp
memory/2872-46-0x0000000007550000-0x00000000075F3000-memory.dmp
memory/2872-32-0x0000000006950000-0x0000000006982000-memory.dmp
memory/2872-57-0x00000000747A0000-0x0000000074F50000-memory.dmp
memory/2872-55-0x00000000079A0000-0x00000000079A8000-memory.dmp
memory/2872-13-0x0000000004D90000-0x0000000004DA0000-memory.dmp
memory/2872-14-0x00000000053D0000-0x00000000059F8000-memory.dmp
memory/2872-15-0x0000000005320000-0x0000000005342000-memory.dmp
memory/2872-54-0x00000000079C0000-0x00000000079DA000-memory.dmp
memory/2872-17-0x0000000005BF0000-0x0000000005C56000-memory.dmp
memory/2872-7-0x0000000004D00000-0x0000000004D36000-memory.dmp
memory/2872-20-0x0000000005CD0000-0x0000000005D36000-memory.dmp
memory/2872-28-0x0000000005D80000-0x00000000060D4000-memory.dmp
memory/2872-29-0x0000000006350000-0x000000000636E000-memory.dmp
memory/2872-30-0x00000000063A0000-0x00000000063EC000-memory.dmp
memory/2872-31-0x000000007FC20000-0x000000007FC30000-memory.dmp
memory/2872-10-0x00000000747A0000-0x0000000074F50000-memory.dmp
memory/2872-33-0x000000006FFB0000-0x000000006FFFC000-memory.dmp
memory/2872-44-0x0000000006930000-0x000000000694E000-memory.dmp
memory/2872-43-0x0000000004D90000-0x0000000004DA0000-memory.dmp
memory/2872-45-0x0000000004D90000-0x0000000004DA0000-memory.dmp
memory/2872-53-0x00000000078C0000-0x00000000078D4000-memory.dmp
memory/2872-47-0x0000000007CC0000-0x000000000833A000-memory.dmp
memory/2872-48-0x0000000007680000-0x000000000769A000-memory.dmp
memory/2872-49-0x00000000076F0000-0x00000000076FA000-memory.dmp
memory/2872-50-0x0000000007900000-0x0000000007996000-memory.dmp
memory/2872-51-0x0000000007880000-0x0000000007891000-memory.dmp
memory/2872-52-0x00000000078B0000-0x00000000078BE000-memory.dmp
memory/4024-6-0x0000000000400000-0x0000000000493000-memory.dmp
memory/4024-16-0x0000000000400000-0x0000000000493000-memory.dmp
memory/4024-12-0x0000000000400000-0x0000000000493000-memory.dmp
memory/4024-9-0x0000000000400000-0x0000000000493000-memory.dmp