Analysis
- max time kernel
92s - max time network
114s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
01/03/2024, 09:48
General
- Target file.exe
- Size 7.1MB
- Sample240301-lsr4lafd24
- SHA256 893e2c4953d6feef18b3eacb533a5366e19ba274addfbca534a2fb02fd180504
Malware Config
Signatures
- Detect ZGRat V1 34 IoCs
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 2 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 4203⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 4483⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 736 -ip 7361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 736 -ip 7361⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/736-1128-0x0000000000400000-0x000000000046D000-memory.dmp
memory/736-1130-0x0000000003FD0000-0x00000000043D0000-memory.dmp
memory/736-1133-0x0000000003FD0000-0x00000000043D0000-memory.dmp
memory/736-1144-0x0000000003FD0000-0x00000000043D0000-memory.dmp
memory/1700-1-0x0000000074ED0000-0x0000000075680000-memory.dmp
memory/1700-0-0x0000000000D70000-0x0000000000EAA000-memory.dmp
memory/1700-2-0x0000000005760000-0x0000000005770000-memory.dmp
memory/1700-3-0x0000000005770000-0x000000000584E000-memory.dmp
memory/1700-4-0x0000000005950000-0x0000000005A2E000-memory.dmp
memory/1700-5-0x0000000005950000-0x0000000005A28000-memory.dmp
memory/1700-6-0x0000000005950000-0x0000000005A28000-memory.dmp
memory/1700-8-0x0000000005950000-0x0000000005A28000-memory.dmp
memory/1700-10-0x0000000005950000-0x0000000005A28000-memory.dmp
memory/1700-12-0x0000000005950000-0x0000000005A28000-memory.dmp
memory/1700-14-0x0000000005950000-0x0000000005A28000-memory.dmp
memory/1700-16-0x0000000005950000-0x0000000005A28000-memory.dmp
memory/1700-18-0x0000000005950000-0x0000000005A28000-memory.dmp
memory/1700-20-0x0000000005950000-0x0000000005A28000-memory.dmp
memory/1700-22-0x0000000005950000-0x0000000005A28000-memory.dmp
memory/1700-24-0x0000000005950000-0x0000000005A28000-memory.dmp
memory/1700-26-0x0000000005950000-0x0000000005A28000-memory.dmp
memory/1700-28-0x0000000005950000-0x0000000005A28000-memory.dmp
memory/1700-30-0x0000000005950000-0x0000000005A28000-memory.dmp
memory/1700-32-0x0000000005950000-0x0000000005A28000-memory.dmp
memory/1700-34-0x0000000005950000-0x0000000005A28000-memory.dmp
memory/1700-36-0x0000000005950000-0x0000000005A28000-memory.dmp
memory/1700-38-0x0000000005950000-0x0000000005A28000-memory.dmp
memory/1700-40-0x0000000005950000-0x0000000005A28000-memory.dmp
memory/1700-42-0x0000000005950000-0x0000000005A28000-memory.dmp
memory/1700-44-0x0000000005950000-0x0000000005A28000-memory.dmp
memory/1700-46-0x0000000005950000-0x0000000005A28000-memory.dmp
memory/1700-48-0x0000000005950000-0x0000000005A28000-memory.dmp
memory/1700-50-0x0000000005950000-0x0000000005A28000-memory.dmp
memory/1700-52-0x0000000005950000-0x0000000005A28000-memory.dmp
memory/1700-54-0x0000000005950000-0x0000000005A28000-memory.dmp
memory/1700-56-0x0000000005950000-0x0000000005A28000-memory.dmp
memory/1700-58-0x0000000005950000-0x0000000005A28000-memory.dmp
memory/1700-60-0x0000000005950000-0x0000000005A28000-memory.dmp
memory/1700-62-0x0000000005950000-0x0000000005A28000-memory.dmp
memory/1700-66-0x0000000005950000-0x0000000005A28000-memory.dmp
memory/1700-64-0x0000000005950000-0x0000000005A28000-memory.dmp
memory/1700-68-0x0000000005950000-0x0000000005A28000-memory.dmp
memory/1700-1119-0x0000000005A30000-0x0000000005A31000-memory.dmp
memory/1700-1120-0x0000000005A70000-0x0000000005AD8000-memory.dmp
memory/1700-1121-0x0000000005AF0000-0x0000000005B3C000-memory.dmp
memory/1700-1122-0x0000000006490000-0x0000000006A34000-memory.dmp
memory/1700-1127-0x0000000074ED0000-0x0000000075680000-memory.dmp
memory/5084-1139-0x00000000022D0000-0x00000000026D0000-memory.dmp
memory/5084-1141-0x00000000022D0000-0x00000000026D0000-memory.dmp
memory/5084-1145-0x00000000022D0000-0x00000000026D0000-memory.dmp