Analysis
-
max time kernel
362s -
max time network
366s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-03-2024 19:56
Behavioral task
behavioral1
Sample
instrumentMAIN.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
instrumentMAIN.exe
Resource
win10-20240221-en
Behavioral task
behavioral3
Sample
instrumentMAIN.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral4
Sample
instrumentMAIN.exe
Resource
win11-20240214-en
General
-
Target
instrumentMAIN.exe
-
Size
4.5MB
-
MD5
c66b1f6942762649c44bca726995a227
-
SHA1
d22eba1dd78f3ab676afd3442a4b2a24c9342bf8
-
SHA256
859f296afcad7531a5e2ee4b5b8346da0d5ac0ba33700804216aa7365920f7cb
-
SHA512
1785bc2becad09b83aa98fe5d1191328f7f8336615144c07974ff4aeb61ec4a72940ba5d10cc9b91185a9f644b093ae74abef22531c0dc191839613369a23144
-
SSDEEP
98304:AaHg3Vqv+AigbRik7kZ3srMw2FX+qK60L:AaH0VqhiKj7kZ3U+FuqA
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2328-0-0x0000000000BC0000-0x000000000103C000-memory.dmp family_zgrat_v1 -
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
Processes:
resource yara_rule behavioral1/memory/2328-0-0x0000000000BC0000-0x000000000103C000-memory.dmp net_reactor -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 2852 2328 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
instrumentMAIN.exedescription pid Process procid_target PID 2328 wrote to memory of 2852 2328 instrumentMAIN.exe 30 PID 2328 wrote to memory of 2852 2328 instrumentMAIN.exe 30 PID 2328 wrote to memory of 2852 2328 instrumentMAIN.exe 30 PID 2328 wrote to memory of 2852 2328 instrumentMAIN.exe 30