Analysis
- max time kernel
117s - max time network
119s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
18/03/2024, 15:12
General
- Target Narsil.exe
- Size 146.9MB
- Sample240318-slmnvscc5w
- SHA256 33e28ac931d8477eb8d20603b7b8d8cd55a4356ef106d24b02fa3a36be0ee087
Malware Config
Extracted
-
risepro
-
95.217.5.29:50500
Signatures
- Detect ZGRat V1 34 IoCs
- RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- ZGRat
ZGRat is remote access trojan written in C#.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Narsil.exe"C:\Users\Admin\AppData\Local\Temp\Narsil.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Narsil.exeC:\Users\Admin\AppData\Local\Temp\Narsil.exe2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1728-4801-0x0000000000400000-0x0000000000544000-memory.dmp
memory/1728-4802-0x0000000000400000-0x0000000000544000-memory.dmp
memory/2056-36-0x0000000004BF0000-0x0000000004E6F000-memory.dmp
memory/2056-42-0x0000000004BF0000-0x0000000004E6F000-memory.dmp
memory/2056-8-0x0000000004BF0000-0x0000000004E6F000-memory.dmp
memory/2056-12-0x0000000004BF0000-0x0000000004E6F000-memory.dmp
memory/2056-14-0x0000000004BF0000-0x0000000004E6F000-memory.dmp
memory/2056-10-0x0000000004BF0000-0x0000000004E6F000-memory.dmp
memory/2056-6-0x0000000004BF0000-0x0000000004E6F000-memory.dmp
memory/2056-16-0x0000000004BF0000-0x0000000004E6F000-memory.dmp
memory/2056-4-0x0000000004BF0000-0x0000000004E6F000-memory.dmp
memory/2056-18-0x0000000004BF0000-0x0000000004E6F000-memory.dmp
memory/2056-20-0x0000000004BF0000-0x0000000004E6F000-memory.dmp
memory/2056-22-0x0000000004BF0000-0x0000000004E6F000-memory.dmp
memory/2056-24-0x0000000004BF0000-0x0000000004E6F000-memory.dmp
memory/2056-26-0x0000000004BF0000-0x0000000004E6F000-memory.dmp
memory/2056-30-0x0000000004BF0000-0x0000000004E6F000-memory.dmp
memory/2056-32-0x0000000004BF0000-0x0000000004E6F000-memory.dmp
memory/2056-28-0x0000000004BF0000-0x0000000004E6F000-memory.dmp
memory/2056-34-0x0000000004BF0000-0x0000000004E6F000-memory.dmp
memory/2056-1-0x00000000745A0000-0x0000000074C8E000-memory.dmp
memory/2056-38-0x0000000004BF0000-0x0000000004E6F000-memory.dmp
memory/2056-3-0x0000000004BF0000-0x0000000004E6F000-memory.dmp
memory/2056-44-0x0000000004BF0000-0x0000000004E6F000-memory.dmp
memory/2056-40-0x0000000004BF0000-0x0000000004E6F000-memory.dmp
memory/2056-46-0x0000000004BF0000-0x0000000004E6F000-memory.dmp
memory/2056-48-0x0000000004BF0000-0x0000000004E6F000-memory.dmp
memory/2056-50-0x0000000004BF0000-0x0000000004E6F000-memory.dmp
memory/2056-52-0x0000000004BF0000-0x0000000004E6F000-memory.dmp
memory/2056-56-0x0000000004BF0000-0x0000000004E6F000-memory.dmp
memory/2056-58-0x0000000004BF0000-0x0000000004E6F000-memory.dmp
memory/2056-54-0x0000000004BF0000-0x0000000004E6F000-memory.dmp
memory/2056-60-0x0000000004BF0000-0x0000000004E6F000-memory.dmp
memory/2056-62-0x0000000004BF0000-0x0000000004E6F000-memory.dmp
memory/2056-64-0x0000000004BF0000-0x0000000004E6F000-memory.dmp
memory/2056-66-0x0000000004BF0000-0x0000000004E6F000-memory.dmp
memory/2056-4780-0x0000000000490000-0x0000000000491000-memory.dmp
memory/2056-4779-0x00000000045A0000-0x00000000045E0000-memory.dmp
memory/2056-4782-0x0000000002200000-0x000000000224C000-memory.dmp
memory/2056-4781-0x0000000005850000-0x000000000591C000-memory.dmp
memory/2056-4799-0x00000000745A0000-0x0000000074C8E000-memory.dmp
memory/2056-2-0x0000000004BF0000-0x0000000004E74000-memory.dmp
memory/2056-0-0x00000000009A0000-0x0000000000CDE000-memory.dmp