Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
13-03-2024 09:39
General
-
Target
c58af9384d71e33bae1d8a032d9e7b19.exe
-
Size
4.0MB
-
MD5
c58af9384d71e33bae1d8a032d9e7b19
-
SHA1
15bd308104a7b2d05ba9fd03b3a4c5410afabc56
-
SHA256
77189b22dfb8238a4837f95e3283150bca8105d618cc421cde8170644bcf878b
-
SHA512
ac80eb00dcf2aec8a56e071281030b9c3ec57460b2a2c59b8db43ce51a60465a419ed1e5f887d7e2d8b41c0aaca226244bb52e7c72cccf44f477fcdad03aa3e8
-
SSDEEP
49152:PSzzgkLJWvg/RdFy7/QhWwALywBDyVt4kWzzwskrk4NZXuMk6o9ufAXV4AK:
Malware Config
Signatures
-
Detect ZGRat V1 35 IoCs
-
Detects Echelon Stealer payload 2 IoCs
-
Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Delays execution with timeout.exe 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c58af9384d71e33bae1d8a032d9e7b19.exe"C:\Users\Admin\AppData\Local\Temp\c58af9384d71e33bae1d8a032d9e7b19.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WinNetcommon\WinNetcommon.exe"C:\Users\Admin\AppData\Roaming\WinNetcommon\WinNetcommon.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Decoder.exe"C:\ProgramData\Decoder.exe"3⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.cmd""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 44⤵
- Delays execution with timeout.exe
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
490KB
MD5c29c0d495ed13e703f433d53bdffdab8
SHA174ed36e6b6027b61abcfe2956670ffd9de7fd71a
SHA25620309707aa6fc678963aace7685a37839d439c850b1ba399bdbfbbeddc10ed4b
SHA512fea4c1066ee6df3ebb29a354678a3d0f1398cd216b92b261296fcff580b00e19cefe24d975beebcc41854cceef3df2702d569811358dae4203a924fb52cf5426
-
Filesize
105B
MD52e9d094dda5cdc3ce6519f75943a4ff4
SHA15d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
-
Filesize
432B
MD574e0ad8adc4896dd5c06570450adbc64
SHA195e70ac93a5671fea7efb07ac35557853cae1dbc
SHA256f04f36f2405143e4129f571fc65df6b1edcd155fdc19d2f50f04634156114b8c
SHA5122885098dc561f71077c41ee164e1d4ad0d721d248f0cb6de9669c7880a254444d08ab6655e3197713439f28bb2d6bcf19bec960de83c3159e0d6626fe872fc90
-
Filesize
766B
MD51802dc7f3c00fb07044632c5ab24802b
SHA127d0129817c4160c5e5493dc1d7ecd163728d7ed
SHA256327b5f94078d9f2e58ae0a49eff9131dc707b1e2c728d231119f1c44fd3a87a7
SHA5126034389bb593691fff9839118610b173af7388065031978bd93c5ea189cf26eda98e4455ac9cdb6b5be16f2b66a7216506af3a1c0790df156ea2395df075ebb5
-
Filesize
844B
MD5654b6bd8e21c1e3e359cb36950eab779
SHA156e40e8663af443f77fa285250ae07a47c5f5e30
SHA256216e044a62bf77c83121a306a24ddb6680446fa054defd71b318b7dac6f80d07
SHA512b8d3d06177c5ce65abed28617a68fee212cd0e20114928474625a9e7186c5a31648a131be31dee0fcaab50957be705141ab764dd82ef7fae189d138a9492fc2a
-
Filesize
85B
MD573712247036b6a24d16502c57a3e5679
SHA165ca9edadb0773fc34db7dfefe9e6416f1ac17fa
SHA2568bd49d7e7e6b2c2dc16a4cb0eebb8f28892775fad56c9e4aaa22d59f01883cd0
SHA512548eef10b0118f7d907fa19c12de68b47278afffb3eb9460621efb2b711ebcf6b90d0ea1c077fc480e032bf241fb3f8cc995ec1373e301446f89f1a74a6309de
-
Filesize
92KB
MD5d8258cfea30050e289acf9aa882159f2
SHA126acf382025e2880308c3cb82ee11b935f52d6fa
SHA25697f3a97af8aad5da47509b3b5639b85c82f5b67fb34193ef409c9bb84c2e334b
SHA512caa184c63653b9b8be5b76833be8caf40d8a6804cc26b329d955e5b59e5cf75c0e9e654f5e4fef9fdb76536f43fe3d9a4017a3446f0610d6df61f3737f44a74a
-
Filesize
46KB
MD502d2c46697e3714e49f46b680b9a6b83
SHA184f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA51260348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
-
Filesize
426B
MD542fa959509b3ed7c94c0cf3728b03f6d
SHA1661292176640beb0b38dc9e7a462518eb592d27d
SHA256870ef3d2370932a8938faa60abd47d75ea0af98bfa11c82ae8efe9e94fd8be00
SHA5127def291737d081c93d0cc38ac8d3062fd34d93b68d191eb0d54e9857e0c0afdbcd241471a2e10c28ce8db3b1d1ae0dba2ef6f609cfe8a1e8fe1dd103dba80007
-
Filesize
1.5MB
MD5ad2f6dd54f8a52708148b9fe50f7ede9
SHA120b3284ad569811a6f28a39a92b6da61d2713079
SHA25659c3fc7329bf3f09b892d86419da8d1872dc2262683ec45b348a1c27993133b0
SHA5127f2c297b294a20edf52e63eaf7311883295b6bd5c6cd14e839ba8174dabcb353df4536976ba680f647311cfc86f6952f82a0508a6b6dbfe03fbdac7a7e3b57af
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
472KB
-
Filesize
1.5MB
-
Filesize
10.8MB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
616KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
64KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
5.6MB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
624KB
-
Filesize
584KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
408KB
-
Filesize
472KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4.0MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB