Analysis
-
max time kernel
145s -
max time network
158s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
19/03/2024, 19:14
General
-
Target
tmp.exe
-
Size
4.6MB
-
MD5
397926927bca55be4a77839b1c44de6e
-
SHA1
e10f3434ef3021c399dbba047832f02b3c898dbd
-
SHA256
4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7
-
SHA512
cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954
-
SSDEEP
49152:1ZRCckM8wwGbtBiRFWSGqCW4FL5wslsAEL1ksS2NHsF3TjZ1I6bqmHC0Jg:1ZRCwrb64XwWsAwFaFXxg
Malware Config
Signatures
-
Detect ZGRat V1 3 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Downloads MZ/PE file
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 7 IoCs
-
Suspicious use of SendNotifyMessage 7 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD53dd3dd12bb8da42b420287f8b4eff4f1
SHA1eca7e3ed77b7cc38788af304aba1d61d04d25a20
SHA2565f70f74e06dc21b1b55e1f89d1f45e8fb94875387f9b201ada718b5e32f3e286
SHA512b568a5405f7a37644860d9ed8311753b61beafbaccf6151a6c16256e6eca93df686e2bb815dd0c556284842a311e7567fbdcd727e896e088d348584d64eb27ba
-
Filesize
3KB
MD5b2876ee63d62f5f40d9caca88a87c2e4
SHA13490c4e1be3bf391dc342a7ab57d3c17521d7854
SHA256d669b416f30c5e903c6045547629607cafa6e936483151dbccd921b1ba9c63fb
SHA5123804573287e4960afc1b300e72262e876f82792ee7ba660a049066a10b2e1bbe7db308102a185a1c08dabdb931c4fc117760c305a269a0d57893187d47487df7
-
Filesize
40KB
-
Filesize
3.0MB
-
Filesize
512KB
-
Filesize
9.9MB
-
Filesize
56.8MB
-
Filesize
512KB
-
Filesize
1.1MB
-
Filesize
64KB
-
Filesize
48KB
-
Filesize
80KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
168KB
-
Filesize
712KB
-
Filesize
488KB
-
Filesize
392KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
144KB
-
Filesize
40KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
40KB
-
Filesize
136KB
-
Filesize
512KB
-
Filesize
48KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4.7MB
-
Filesize
4.7MB