Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
15-03-2024 02:30
Behavioral task
behavioral1
Sample
9dcd2325222229aee939e07986dfd5eac660a3ad129979597707569af979ffea.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
9dcd2325222229aee939e07986dfd5eac660a3ad129979597707569af979ffea.exe
-
Size
470KB
-
MD5
9e203e42aad4a23d95bddec9509f4d72
-
SHA1
14726a881fc956c8d3450c580da6c9b921c38bd6
-
SHA256
9dcd2325222229aee939e07986dfd5eac660a3ad129979597707569af979ffea
-
SHA512
a1add22c1fd88653a1ecfc78d708e425f9dd7e1be4b286c5d2a69994c6f46d45e16b4ceb95fd6524cfcf72742145b2588b0f90344339827d2e4e83135d7e700a
-
SSDEEP
6144:yuwf0+RecrdM5x4z+TLonB3MRQ0+sCOMysnHLs7kSRqebpXbq4Hy6m51py:nUyLCBckT8sHLsBqebpJH5mc
Malware Config
Signatures
-
Detect ZGRat V1 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3028-0-0x00000000008B0000-0x0000000000926000-memory.dmp family_zgrat_v1 behavioral1/memory/3028-2-0x0000000002260000-0x00000000022A0000-memory.dmp family_zgrat_v1 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
9dcd2325222229aee939e07986dfd5eac660a3ad129979597707569af979ffea.exedescription pid process target process PID 3028 set thread context of 2316 3028 9dcd2325222229aee939e07986dfd5eac660a3ad129979597707569af979ffea.exe RegAsm.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2668 2316 WerFault.exe RegAsm.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
9dcd2325222229aee939e07986dfd5eac660a3ad129979597707569af979ffea.exeRegAsm.exedescription pid process target process PID 3028 wrote to memory of 2032 3028 9dcd2325222229aee939e07986dfd5eac660a3ad129979597707569af979ffea.exe RegAsm.exe PID 3028 wrote to memory of 2032 3028 9dcd2325222229aee939e07986dfd5eac660a3ad129979597707569af979ffea.exe RegAsm.exe PID 3028 wrote to memory of 2032 3028 9dcd2325222229aee939e07986dfd5eac660a3ad129979597707569af979ffea.exe RegAsm.exe PID 3028 wrote to memory of 2032 3028 9dcd2325222229aee939e07986dfd5eac660a3ad129979597707569af979ffea.exe RegAsm.exe PID 3028 wrote to memory of 2032 3028 9dcd2325222229aee939e07986dfd5eac660a3ad129979597707569af979ffea.exe RegAsm.exe PID 3028 wrote to memory of 2032 3028 9dcd2325222229aee939e07986dfd5eac660a3ad129979597707569af979ffea.exe RegAsm.exe PID 3028 wrote to memory of 2032 3028 9dcd2325222229aee939e07986dfd5eac660a3ad129979597707569af979ffea.exe RegAsm.exe PID 3028 wrote to memory of 2316 3028 9dcd2325222229aee939e07986dfd5eac660a3ad129979597707569af979ffea.exe RegAsm.exe PID 3028 wrote to memory of 2316 3028 9dcd2325222229aee939e07986dfd5eac660a3ad129979597707569af979ffea.exe RegAsm.exe PID 3028 wrote to memory of 2316 3028 9dcd2325222229aee939e07986dfd5eac660a3ad129979597707569af979ffea.exe RegAsm.exe PID 3028 wrote to memory of 2316 3028 9dcd2325222229aee939e07986dfd5eac660a3ad129979597707569af979ffea.exe RegAsm.exe PID 3028 wrote to memory of 2316 3028 9dcd2325222229aee939e07986dfd5eac660a3ad129979597707569af979ffea.exe RegAsm.exe PID 3028 wrote to memory of 2316 3028 9dcd2325222229aee939e07986dfd5eac660a3ad129979597707569af979ffea.exe RegAsm.exe PID 3028 wrote to memory of 2316 3028 9dcd2325222229aee939e07986dfd5eac660a3ad129979597707569af979ffea.exe RegAsm.exe PID 3028 wrote to memory of 2316 3028 9dcd2325222229aee939e07986dfd5eac660a3ad129979597707569af979ffea.exe RegAsm.exe PID 3028 wrote to memory of 2316 3028 9dcd2325222229aee939e07986dfd5eac660a3ad129979597707569af979ffea.exe RegAsm.exe PID 3028 wrote to memory of 2316 3028 9dcd2325222229aee939e07986dfd5eac660a3ad129979597707569af979ffea.exe RegAsm.exe PID 3028 wrote to memory of 2316 3028 9dcd2325222229aee939e07986dfd5eac660a3ad129979597707569af979ffea.exe RegAsm.exe PID 3028 wrote to memory of 2316 3028 9dcd2325222229aee939e07986dfd5eac660a3ad129979597707569af979ffea.exe RegAsm.exe PID 3028 wrote to memory of 2316 3028 9dcd2325222229aee939e07986dfd5eac660a3ad129979597707569af979ffea.exe RegAsm.exe PID 2316 wrote to memory of 2668 2316 RegAsm.exe WerFault.exe PID 2316 wrote to memory of 2668 2316 RegAsm.exe WerFault.exe PID 2316 wrote to memory of 2668 2316 RegAsm.exe WerFault.exe PID 2316 wrote to memory of 2668 2316 RegAsm.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9dcd2325222229aee939e07986dfd5eac660a3ad129979597707569af979ffea.exe"C:\Users\Admin\AppData\Local\Temp\9dcd2325222229aee939e07986dfd5eac660a3ad129979597707569af979ffea.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 2563⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2316-9-0x0000000000400000-0x0000000000448000-memory.dmpFilesize
288KB
-
memory/2316-13-0x0000000000400000-0x0000000000448000-memory.dmpFilesize
288KB
-
memory/2316-18-0x0000000000400000-0x0000000000448000-memory.dmpFilesize
288KB
-
memory/2316-5-0x0000000000400000-0x0000000000448000-memory.dmpFilesize
288KB
-
memory/2316-6-0x0000000000400000-0x0000000000448000-memory.dmpFilesize
288KB
-
memory/2316-16-0x0000000000400000-0x0000000000448000-memory.dmpFilesize
288KB
-
memory/2316-7-0x0000000000400000-0x0000000000448000-memory.dmpFilesize
288KB
-
memory/2316-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2316-10-0x0000000000400000-0x0000000000448000-memory.dmpFilesize
288KB
-
memory/3028-0-0x00000000008B0000-0x0000000000926000-memory.dmpFilesize
472KB
-
memory/3028-1-0x00000000747A0000-0x0000000074E8E000-memory.dmpFilesize
6.9MB
-
memory/3028-17-0x00000000747A0000-0x0000000074E8E000-memory.dmpFilesize
6.9MB
-
memory/3028-8-0x00000000023D0000-0x00000000043D0000-memory.dmpFilesize
32.0MB
-
memory/3028-2-0x0000000002260000-0x00000000022A0000-memory.dmpFilesize
256KB