Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
10/03/2024, 20:48
General
-
Target
907e21e5c122b5a3126a86d7d02df4f6.exe
-
Size
54KB
-
MD5
907e21e5c122b5a3126a86d7d02df4f6
-
SHA1
031db700719b48c691116f5027d5609efc7c210f
-
SHA256
6fb2bda81d9edf6955e7d6bd5d9dfb5a0f3d7695eacd2a0e4f3988812ebf41cd
-
SHA512
d19076ef75e2c8ce85acf0b2a22b0aadbcdb945e56153a58dea52f068c23caf76e8673dc4012b23a511b32404193cd88cfaa4523509e5340d0f46d01322c05fc
-
SSDEEP
768:+pMsRVqvTtICYY5xbjVz6GPt5ToMHTuGeeU/OgUO90THf8CyTHf8C0mbt:GRVqv16eXTpHTuGj0Jx90T8HT8lmp
Score
10/10
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Drops startup file 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\907e21e5c122b5a3126a86d7d02df4f6.exe"C:\Users\Admin\AppData\Local\Temp\907e21e5c122b5a3126a86d7d02df4f6.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe"Powershell.exe" -exec bypass -c Copy-Item 'C:\Users\Admin\AppData\Local\Temp\907e21e5c122b5a3126a86d7d02df4f6.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\907e21e5c122b5a3126a86d7d02df4f6.exe' -Force2⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
1.1MB
-
Filesize
856KB
-
Filesize
6.9MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
5.7MB