Analysis
- max time kernel
148s - max time network
154s - platform
windows11-21h2_x64 - resource
win11-20240319-en - resource tags
- submitted
25/03/2024, 02:00
General
- Target d0f7fb07005ab151b76ab0cd9f5b45a7d319fb3273044c2f5b66a491c6161f9e.exe
- Size 2.3MB
- Sample240325-ce81hsda23
- SHA256 d0f7fb07005ab151b76ab0cd9f5b45a7d319fb3273044c2f5b66a491c6161f9e
Malware Config
Extracted
-
amadey
-
4.18
-
http://ruspyc.top
-
install_dir
5027aaabaf
-
install_file
Dctooux.exe
-
strings_key
ea32980f4b5f2367967b03fa80659f80
-
url_paths
/j4Fvskd3/index.php
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Detect ZGRat V1 34 IoCs
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Downloads MZ/PE file
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\d0f7fb07005ab151b76ab0cd9f5b45a7d319fb3273044c2f5b66a491c6161f9e.exe"C:\Users\Admin\AppData\Local\Temp\d0f7fb07005ab151b76ab0cd9f5b45a7d319fb3273044c2f5b66a491c6161f9e.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\d0f7fb07005ab151b76ab0cd9f5b45a7d319fb3273044c2f5b66a491c6161f9e.exe"C:\Users\Admin\AppData\Local\Temp\d0f7fb07005ab151b76ab0cd9f5b45a7d319fb3273044c2f5b66a491c6161f9e.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1192-0-0x0000000000EB0000-0x0000000001104000-memory.dmp
memory/1192-1-0x00000000743B0000-0x0000000074B61000-memory.dmp
memory/1192-2-0x0000000005B40000-0x0000000005B50000-memory.dmp
memory/1192-3-0x0000000006290000-0x00000000064DE000-memory.dmp
memory/1192-4-0x0000000006AA0000-0x0000000007046000-memory.dmp
memory/1192-5-0x0000000006600000-0x0000000006692000-memory.dmp
memory/1192-6-0x0000000006290000-0x00000000064D8000-memory.dmp
memory/1192-7-0x0000000006290000-0x00000000064D8000-memory.dmp
memory/1192-9-0x0000000006290000-0x00000000064D8000-memory.dmp
memory/1192-11-0x0000000006290000-0x00000000064D8000-memory.dmp
memory/1192-13-0x0000000006290000-0x00000000064D8000-memory.dmp
memory/1192-15-0x0000000006290000-0x00000000064D8000-memory.dmp
memory/1192-17-0x0000000006290000-0x00000000064D8000-memory.dmp
memory/1192-19-0x0000000006290000-0x00000000064D8000-memory.dmp
memory/1192-21-0x0000000006290000-0x00000000064D8000-memory.dmp
memory/1192-23-0x0000000006290000-0x00000000064D8000-memory.dmp
memory/1192-25-0x0000000006290000-0x00000000064D8000-memory.dmp
memory/1192-27-0x0000000006290000-0x00000000064D8000-memory.dmp
memory/1192-29-0x0000000006290000-0x00000000064D8000-memory.dmp
memory/1192-31-0x0000000006290000-0x00000000064D8000-memory.dmp
memory/1192-33-0x0000000006290000-0x00000000064D8000-memory.dmp
memory/1192-35-0x0000000006290000-0x00000000064D8000-memory.dmp
memory/1192-37-0x0000000006290000-0x00000000064D8000-memory.dmp
memory/1192-39-0x0000000006290000-0x00000000064D8000-memory.dmp
memory/1192-41-0x0000000006290000-0x00000000064D8000-memory.dmp
memory/1192-43-0x0000000006290000-0x00000000064D8000-memory.dmp
memory/1192-45-0x0000000006290000-0x00000000064D8000-memory.dmp
memory/1192-47-0x0000000006290000-0x00000000064D8000-memory.dmp
memory/1192-49-0x0000000006290000-0x00000000064D8000-memory.dmp
memory/1192-51-0x0000000006290000-0x00000000064D8000-memory.dmp
memory/1192-53-0x0000000006290000-0x00000000064D8000-memory.dmp
memory/1192-55-0x0000000006290000-0x00000000064D8000-memory.dmp
memory/1192-57-0x0000000006290000-0x00000000064D8000-memory.dmp
memory/1192-59-0x0000000006290000-0x00000000064D8000-memory.dmp
memory/1192-61-0x0000000006290000-0x00000000064D8000-memory.dmp
memory/1192-63-0x0000000006290000-0x00000000064D8000-memory.dmp
memory/1192-65-0x0000000006290000-0x00000000064D8000-memory.dmp
memory/1192-67-0x0000000006290000-0x00000000064D8000-memory.dmp
memory/1192-69-0x0000000006290000-0x00000000064D8000-memory.dmp
memory/1192-2024-0x00000000743B0000-0x0000000074B61000-memory.dmp
memory/1192-2255-0x0000000005B40000-0x0000000005B50000-memory.dmp
memory/1192-4888-0x0000000005F20000-0x0000000005F21000-memory.dmp
memory/1192-4889-0x00000000060F0000-0x000000000617C000-memory.dmp
memory/1192-4890-0x00000000061B0000-0x00000000061FC000-memory.dmp
memory/1192-4891-0x00000000067A0000-0x00000000067F4000-memory.dmp
memory/1192-4898-0x00000000743B0000-0x0000000074B61000-memory.dmp
memory/3060-4897-0x0000000000400000-0x000000000046D000-memory.dmp
memory/3060-4900-0x0000000000400000-0x000000000046D000-memory.dmp