Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
12/03/2024, 02:51
General
-
Target
81b6bfa7d970e0c7305eac8aeddbb465ec88b5c1546fa461a562cdfcc50dc878.exe
-
Size
3.6MB
-
MD5
0bf1924b9798aca8209bd09c8b9bfa91
-
SHA1
73822b5c501c392c71ab5433ac7a4aa0621705f9
-
SHA256
81b6bfa7d970e0c7305eac8aeddbb465ec88b5c1546fa461a562cdfcc50dc878
-
SHA512
cecdc8b1bf30d84a79ad85517e7007f8cb27e60524e295a58a862408d176ec0050dd7f6ed04b761208451c0f834c2f8644d542572c2268d4afd70f184d36d3a5
-
SSDEEP
49152:9vCcUyqT2muamcOcQFCLao+7oZO106h4YL6YmKl/DwiQx8kVBfsiZPJNtW9:9qaqTj5mcOcQF6aBl3nSyiy9
Malware Config
Signatures
-
Detect ZGRat V1 4 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Detects executables packed with unregistered version of .NET Reactor 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\81b6bfa7d970e0c7305eac8aeddbb465ec88b5c1546fa461a562cdfcc50dc878.exe"C:\Users\Admin\AppData\Local\Temp\81b6bfa7d970e0c7305eac8aeddbb465ec88b5c1546fa461a562cdfcc50dc878.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Jd68TKcwJQ.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost3⤵
- Runs ping.exe
-
-
C:\odt\81b6bfa7d970e0c7305eac8aeddbb465ec88b5c1546fa461a562cdfcc50dc878.exe"C:\odt\81b6bfa7d970e0c7305eac8aeddbb465ec88b5c1546fa461a562cdfcc50dc878.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD50bf1924b9798aca8209bd09c8b9bfa91
SHA173822b5c501c392c71ab5433ac7a4aa0621705f9
SHA25681b6bfa7d970e0c7305eac8aeddbb465ec88b5c1546fa461a562cdfcc50dc878
SHA512cecdc8b1bf30d84a79ad85517e7007f8cb27e60524e295a58a862408d176ec0050dd7f6ed04b761208451c0f834c2f8644d542572c2268d4afd70f184d36d3a5
-
Filesize
1KB
MD598d93f7a2239452aef29ed995c71b759
SHA1d1fc6bff08e49cb16a1e5d0b0348232282cf5677
SHA256399712789c6f2c7bd1b7afdf835eb2ac525632424daf08e751186195ebdbba52
SHA5121073e74c9f065aa02be1bfb172308c555c0ad0c5ff35315d76de23d2c6daf1d3fe0b32042a428431847d09b679f14cb129c058af3277e9ed16787d37ae276d96
-
Filesize
203B
MD5e0cf73c57d1c6ec55aac9fdf575bf09a
SHA19d4f475a2e48cb3040939ef10f38b526f98879f6
SHA256e75f867125a8825e818f4e2f645689c0cd26603093d828e26bc85bb3e67a7671
SHA512733830a9d78a7349daf0db828f54a7aeb08b2e7ec7eabb4c6831e48053bd92c9ccb626319faa9bcac28beb0b4558bbb6be81321b4e827031c1413ac9dc9b9b56
-
Filesize
2.0MB
MD5fc93634d05b9862f115d1da18ca134d9
SHA18273cb6de920bc7fe3093502535da55cec11476b
SHA256886b65db0393e56d8e57a411f3678e89eb58c39c10aa8d4e11d68effa65e1da4
SHA512e97229637cdc3df386ecd4248a1355a603619fe58dcfa7b27472dac3a1d5a14f20e6d4e23f7cf90838b14581a44b53498d555dcc190f074a61645e8c6d3508ce
-
Filesize
1.9MB
MD5cb380d494a553331a1648e12be216367
SHA19ff71371fb069de303bcdcd3dbc738aeb35f42d6
SHA2560f03724b2b228af934ff1d00c9e8e14fd227fcdfa99741d6c05125fbe2180d82
SHA5128ccfcbf7fdbf43eecd7d2ed6a8d7ccf509aa9fc4a6b15a843a18c8beb2764ff02195447ca0e4774ec3226754917c053dedc6727d8936bed998e911d5ed2b29f8
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
760KB
-
Filesize
4KB
-
Filesize
152KB
-
Filesize
64KB
-
Filesize
760KB
-
Filesize
4KB
-
Filesize
760KB
-
Filesize
56KB
-
Filesize
4KB
-
Filesize
112KB
-
Filesize
4KB
-
Filesize
320KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
96KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
3.6MB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
48KB
-
Filesize
88KB
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
5.2MB
-
Filesize
56KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
360KB
-
Filesize
56KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
96KB
-
Filesize
48KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
312KB
-
Filesize
676KB
-
Filesize
760KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
676KB