Analysis
-
max time kernel
316s -
max time network
392s -
platform
windows10-1703_x64 -
resource
win10-20240221-en -
resource tags
arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system -
submitted
27-03-2024 19:56
Behavioral task
behavioral1
Sample
instrumentMAIN.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
instrumentMAIN.exe
Resource
win10-20240221-en
Behavioral task
behavioral3
Sample
instrumentMAIN.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral4
Sample
instrumentMAIN.exe
Resource
win11-20240214-en
General
-
Target
instrumentMAIN.exe
-
Size
4.5MB
-
MD5
c66b1f6942762649c44bca726995a227
-
SHA1
d22eba1dd78f3ab676afd3442a4b2a24c9342bf8
-
SHA256
859f296afcad7531a5e2ee4b5b8346da0d5ac0ba33700804216aa7365920f7cb
-
SHA512
1785bc2becad09b83aa98fe5d1191328f7f8336615144c07974ff4aeb61ec4a72940ba5d10cc9b91185a9f644b093ae74abef22531c0dc191839613369a23144
-
SSDEEP
98304:AaHg3Vqv+AigbRik7kZ3srMw2FX+qK60L:AaH0VqhiKj7kZ3U+FuqA
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3708-1-0x0000000000BD0000-0x000000000104C000-memory.dmp family_zgrat_v1 -
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
MsBuild.exedescription pid Process procid_target PID 4576 created 2588 4576 MsBuild.exe 44 -
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
Processes:
resource yara_rule behavioral2/memory/3708-1-0x0000000000BD0000-0x000000000104C000-memory.dmp net_reactor -
Loads dropped DLL 1 IoCs
Processes:
instrumentMAIN.exepid Process 3708 instrumentMAIN.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
instrumentMAIN.exedescription pid Process procid_target PID 3708 set thread context of 4576 3708 instrumentMAIN.exe 73 -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target Process procid_target 1620 4576 WerFault.exe 73 1660 4576 WerFault.exe 73 -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
MsBuild.exedialer.exepid Process 4576 MsBuild.exe 4576 MsBuild.exe 4740 dialer.exe 4740 dialer.exe 4740 dialer.exe 4740 dialer.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
instrumentMAIN.exeMsBuild.exedescription pid Process procid_target PID 3708 wrote to memory of 4576 3708 instrumentMAIN.exe 73 PID 3708 wrote to memory of 4576 3708 instrumentMAIN.exe 73 PID 3708 wrote to memory of 4576 3708 instrumentMAIN.exe 73 PID 3708 wrote to memory of 4576 3708 instrumentMAIN.exe 73 PID 3708 wrote to memory of 4576 3708 instrumentMAIN.exe 73 PID 3708 wrote to memory of 4576 3708 instrumentMAIN.exe 73 PID 3708 wrote to memory of 4576 3708 instrumentMAIN.exe 73 PID 3708 wrote to memory of 4576 3708 instrumentMAIN.exe 73 PID 3708 wrote to memory of 4576 3708 instrumentMAIN.exe 73 PID 3708 wrote to memory of 4576 3708 instrumentMAIN.exe 73 PID 3708 wrote to memory of 4576 3708 instrumentMAIN.exe 73 PID 4576 wrote to memory of 4740 4576 MsBuild.exe 74 PID 4576 wrote to memory of 4740 4576 MsBuild.exe 74 PID 4576 wrote to memory of 4740 4576 MsBuild.exe 74 PID 4576 wrote to memory of 4740 4576 MsBuild.exe 74 PID 4576 wrote to memory of 4740 4576 MsBuild.exe 74
Processes
-
c:\windows\system32\sihost.exesihost.exe1⤵PID:2588
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4740
-
-
C:\Users\Admin\AppData\Local\Temp\instrumentMAIN.exe"C:\Users\Admin\AppData\Local\Temp\instrumentMAIN.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4576 -s 5003⤵
- Program crash
PID:1620
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4576 -s 4803⤵
- Program crash
PID:1660
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
742KB
MD5544cd51a596619b78e9b54b70088307d
SHA14769ddd2dbc1dc44b758964ed0bd231b85880b65
SHA256dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd
SHA512f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719