Analysis
- max time kernel
198s - max time network
297s - platform
windows10-1703_x64 - resource
win10-20240221-en - resource tags
- submitted
18/03/2024, 15:12
General
- Target Narsil.exe
- Size 146.9MB
- Sample240318-slmnvscc5w
- SHA256 33e28ac931d8477eb8d20603b7b8d8cd55a4356ef106d24b02fa3a36be0ee087
Malware Config
Extracted
-
risepro
-
95.217.5.29:50500
Signatures
- Detect ZGRat V1 34 IoCs
- RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- ZGRat
ZGRat is remote access trojan written in C#.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Narsil.exe"C:\Users\Admin\AppData\Local\Temp\Narsil.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Narsil.exeC:\Users\Admin\AppData\Local\Temp\Narsil.exe2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/312-1-0x0000000073A70000-0x000000007415E000-memory.dmp
memory/312-0-0x0000000000250000-0x000000000058E000-memory.dmp
memory/312-2-0x0000000004E80000-0x0000000005104000-memory.dmp
memory/312-3-0x0000000004E80000-0x00000000050FF000-memory.dmp
memory/312-4-0x0000000004E80000-0x00000000050FF000-memory.dmp
memory/312-6-0x0000000004E80000-0x00000000050FF000-memory.dmp
memory/312-8-0x0000000004E80000-0x00000000050FF000-memory.dmp
memory/312-10-0x0000000004E80000-0x00000000050FF000-memory.dmp
memory/312-12-0x0000000004E80000-0x00000000050FF000-memory.dmp
memory/312-14-0x0000000004E80000-0x00000000050FF000-memory.dmp
memory/312-16-0x0000000004E80000-0x00000000050FF000-memory.dmp
memory/312-18-0x0000000004E80000-0x00000000050FF000-memory.dmp
memory/312-20-0x0000000004E80000-0x00000000050FF000-memory.dmp
memory/312-22-0x0000000004E80000-0x00000000050FF000-memory.dmp
memory/312-24-0x0000000004E80000-0x00000000050FF000-memory.dmp
memory/312-26-0x0000000004E80000-0x00000000050FF000-memory.dmp
memory/312-28-0x0000000004E80000-0x00000000050FF000-memory.dmp
memory/312-30-0x0000000004E80000-0x00000000050FF000-memory.dmp
memory/312-32-0x0000000004E80000-0x00000000050FF000-memory.dmp
memory/312-34-0x0000000004E80000-0x00000000050FF000-memory.dmp
memory/312-36-0x0000000004E80000-0x00000000050FF000-memory.dmp
memory/312-38-0x0000000004E80000-0x00000000050FF000-memory.dmp
memory/312-40-0x0000000004E80000-0x00000000050FF000-memory.dmp
memory/312-42-0x0000000004E80000-0x00000000050FF000-memory.dmp
memory/312-44-0x0000000004E80000-0x00000000050FF000-memory.dmp
memory/312-46-0x0000000004E80000-0x00000000050FF000-memory.dmp
memory/312-48-0x0000000004E80000-0x00000000050FF000-memory.dmp
memory/312-50-0x0000000004E80000-0x00000000050FF000-memory.dmp
memory/312-56-0x0000000004E80000-0x00000000050FF000-memory.dmp
memory/312-54-0x0000000004E80000-0x00000000050FF000-memory.dmp
memory/312-52-0x0000000004E80000-0x00000000050FF000-memory.dmp
memory/312-60-0x0000000004E80000-0x00000000050FF000-memory.dmp
memory/312-58-0x0000000004E80000-0x00000000050FF000-memory.dmp
memory/312-62-0x0000000004E80000-0x00000000050FF000-memory.dmp
memory/312-66-0x0000000004E80000-0x00000000050FF000-memory.dmp
memory/312-64-0x0000000004E80000-0x00000000050FF000-memory.dmp
memory/312-3094-0x0000000073A70000-0x000000007415E000-memory.dmp
memory/312-4780-0x0000000004E70000-0x0000000004E80000-memory.dmp
memory/312-4781-0x0000000004E60000-0x0000000004E61000-memory.dmp
memory/312-4782-0x0000000005580000-0x000000000564C000-memory.dmp
memory/312-4783-0x00000000053B0000-0x00000000053FC000-memory.dmp
memory/312-4784-0x0000000005CB0000-0x00000000061AE000-memory.dmp
memory/312-4788-0x0000000073A70000-0x000000007415E000-memory.dmp
memory/1556-4790-0x0000000000400000-0x0000000000544000-memory.dmp
memory/1556-4791-0x0000000000400000-0x0000000000544000-memory.dmp