Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
13-03-2024 05:15
Behavioral task
behavioral1
Sample
40dd510795e82f9a51301896809c2d95.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
40dd510795e82f9a51301896809c2d95.exe
-
Size
468KB
-
MD5
40dd510795e82f9a51301896809c2d95
-
SHA1
5bc4f3a04dae16cd6c69dd442551a795c9caa9ef
-
SHA256
18f17375402cffe877271fdeedb0e78ebf492ba954da3bfcbc742fd5fd567492
-
SHA512
c2fa10356790136e1bacbf0bc26eb015d6ceae49d2fb953fc80cb3085375d050000b2672cf15bc97fd633a31e6012e0fe47e282f31a614192840f85624b693c8
-
SSDEEP
6144:sR0tQjTAMFGf1nAB9/huXDttKkDklFuktsferJ/f7UF3HfuXeZWquoQ:sRK1y5IDnKkDxkme5f6HfuurHQ
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1632-0-0x00000000003D0000-0x0000000000446000-memory.dmp family_zgrat_v1 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
40dd510795e82f9a51301896809c2d95.exedescription pid process target process PID 1632 set thread context of 2748 1632 40dd510795e82f9a51301896809c2d95.exe RegAsm.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2164 2748 WerFault.exe RegAsm.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
40dd510795e82f9a51301896809c2d95.exeRegAsm.exedescription pid process target process PID 1632 wrote to memory of 1696 1632 40dd510795e82f9a51301896809c2d95.exe RegAsm.exe PID 1632 wrote to memory of 1696 1632 40dd510795e82f9a51301896809c2d95.exe RegAsm.exe PID 1632 wrote to memory of 1696 1632 40dd510795e82f9a51301896809c2d95.exe RegAsm.exe PID 1632 wrote to memory of 1696 1632 40dd510795e82f9a51301896809c2d95.exe RegAsm.exe PID 1632 wrote to memory of 1696 1632 40dd510795e82f9a51301896809c2d95.exe RegAsm.exe PID 1632 wrote to memory of 1696 1632 40dd510795e82f9a51301896809c2d95.exe RegAsm.exe PID 1632 wrote to memory of 1696 1632 40dd510795e82f9a51301896809c2d95.exe RegAsm.exe PID 1632 wrote to memory of 2748 1632 40dd510795e82f9a51301896809c2d95.exe RegAsm.exe PID 1632 wrote to memory of 2748 1632 40dd510795e82f9a51301896809c2d95.exe RegAsm.exe PID 1632 wrote to memory of 2748 1632 40dd510795e82f9a51301896809c2d95.exe RegAsm.exe PID 1632 wrote to memory of 2748 1632 40dd510795e82f9a51301896809c2d95.exe RegAsm.exe PID 1632 wrote to memory of 2748 1632 40dd510795e82f9a51301896809c2d95.exe RegAsm.exe PID 1632 wrote to memory of 2748 1632 40dd510795e82f9a51301896809c2d95.exe RegAsm.exe PID 1632 wrote to memory of 2748 1632 40dd510795e82f9a51301896809c2d95.exe RegAsm.exe PID 1632 wrote to memory of 2748 1632 40dd510795e82f9a51301896809c2d95.exe RegAsm.exe PID 1632 wrote to memory of 2748 1632 40dd510795e82f9a51301896809c2d95.exe RegAsm.exe PID 1632 wrote to memory of 2748 1632 40dd510795e82f9a51301896809c2d95.exe RegAsm.exe PID 1632 wrote to memory of 2748 1632 40dd510795e82f9a51301896809c2d95.exe RegAsm.exe PID 1632 wrote to memory of 2748 1632 40dd510795e82f9a51301896809c2d95.exe RegAsm.exe PID 1632 wrote to memory of 2748 1632 40dd510795e82f9a51301896809c2d95.exe RegAsm.exe PID 2748 wrote to memory of 2164 2748 RegAsm.exe WerFault.exe PID 2748 wrote to memory of 2164 2748 RegAsm.exe WerFault.exe PID 2748 wrote to memory of 2164 2748 RegAsm.exe WerFault.exe PID 2748 wrote to memory of 2164 2748 RegAsm.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\40dd510795e82f9a51301896809c2d95.exe"C:\Users\Admin\AppData\Local\Temp\40dd510795e82f9a51301896809c2d95.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 2563⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1632-1-0x0000000074980000-0x000000007506E000-memory.dmpFilesize
6.9MB
-
memory/1632-0-0x00000000003D0000-0x0000000000446000-memory.dmpFilesize
472KB
-
memory/1632-2-0x0000000000580000-0x00000000005C0000-memory.dmpFilesize
256KB
-
memory/1632-21-0x0000000074980000-0x000000007506E000-memory.dmpFilesize
6.9MB
-
memory/1632-8-0x0000000002300000-0x0000000004300000-memory.dmpFilesize
32.0MB
-
memory/2748-10-0x0000000000400000-0x0000000000448000-memory.dmpFilesize
288KB
-
memory/2748-7-0x0000000000400000-0x0000000000448000-memory.dmpFilesize
288KB
-
memory/2748-12-0x0000000000400000-0x0000000000448000-memory.dmpFilesize
288KB
-
memory/2748-14-0x0000000000400000-0x0000000000448000-memory.dmpFilesize
288KB
-
memory/2748-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2748-17-0x0000000000400000-0x0000000000448000-memory.dmpFilesize
288KB
-
memory/2748-5-0x0000000000400000-0x0000000000448000-memory.dmpFilesize
288KB
-
memory/2748-20-0x0000000000400000-0x0000000000448000-memory.dmpFilesize
288KB
-
memory/2748-22-0x0000000000400000-0x0000000000448000-memory.dmpFilesize
288KB