Analysis
-
max time kernel
453s -
max time network
455s -
platform
windows11-21h2_x64 -
resource
win11-20240214-en -
resource tags
arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system -
submitted
27-03-2024 19:56
Behavioral task
behavioral1
Sample
instrumentMAIN.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
instrumentMAIN.exe
Resource
win10-20240221-en
Behavioral task
behavioral3
Sample
instrumentMAIN.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral4
Sample
instrumentMAIN.exe
Resource
win11-20240214-en
General
-
Target
instrumentMAIN.exe
-
Size
4.5MB
-
MD5
c66b1f6942762649c44bca726995a227
-
SHA1
d22eba1dd78f3ab676afd3442a4b2a24c9342bf8
-
SHA256
859f296afcad7531a5e2ee4b5b8346da0d5ac0ba33700804216aa7365920f7cb
-
SHA512
1785bc2becad09b83aa98fe5d1191328f7f8336615144c07974ff4aeb61ec4a72940ba5d10cc9b91185a9f644b093ae74abef22531c0dc191839613369a23144
-
SSDEEP
98304:AaHg3Vqv+AigbRik7kZ3srMw2FX+qK60L:AaH0VqhiKj7kZ3U+FuqA
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
Processes:
resource yara_rule behavioral4/memory/2488-1-0x00000000009A0000-0x0000000000E1C000-memory.dmp family_zgrat_v1 -
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
MsBuild.exedescription pid Process procid_target PID 3448 created 2852 3448 MsBuild.exe 49 -
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
Processes:
resource yara_rule behavioral4/memory/2488-1-0x00000000009A0000-0x0000000000E1C000-memory.dmp net_reactor -
Loads dropped DLL 1 IoCs
Processes:
instrumentMAIN.exepid Process 2488 instrumentMAIN.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
instrumentMAIN.exedescription pid Process procid_target PID 2488 set thread context of 3448 2488 instrumentMAIN.exe 76 -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target Process procid_target 4412 3448 WerFault.exe 76 2504 3448 WerFault.exe 76 -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
MsBuild.exedialer.exepid Process 3448 MsBuild.exe 3448 MsBuild.exe 2312 dialer.exe 2312 dialer.exe 2312 dialer.exe 2312 dialer.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
instrumentMAIN.exeMsBuild.exedescription pid Process procid_target PID 2488 wrote to memory of 3448 2488 instrumentMAIN.exe 76 PID 2488 wrote to memory of 3448 2488 instrumentMAIN.exe 76 PID 2488 wrote to memory of 3448 2488 instrumentMAIN.exe 76 PID 2488 wrote to memory of 3448 2488 instrumentMAIN.exe 76 PID 2488 wrote to memory of 3448 2488 instrumentMAIN.exe 76 PID 2488 wrote to memory of 3448 2488 instrumentMAIN.exe 76 PID 2488 wrote to memory of 3448 2488 instrumentMAIN.exe 76 PID 2488 wrote to memory of 3448 2488 instrumentMAIN.exe 76 PID 2488 wrote to memory of 3448 2488 instrumentMAIN.exe 76 PID 2488 wrote to memory of 3448 2488 instrumentMAIN.exe 76 PID 2488 wrote to memory of 3448 2488 instrumentMAIN.exe 76 PID 3448 wrote to memory of 2312 3448 MsBuild.exe 77 PID 3448 wrote to memory of 2312 3448 MsBuild.exe 77 PID 3448 wrote to memory of 2312 3448 MsBuild.exe 77 PID 3448 wrote to memory of 2312 3448 MsBuild.exe 77 PID 3448 wrote to memory of 2312 3448 MsBuild.exe 77
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2852
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2312
-
-
C:\Users\Admin\AppData\Local\Temp\instrumentMAIN.exe"C:\Users\Admin\AppData\Local\Temp\instrumentMAIN.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 4563⤵
- Program crash
PID:4412
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 4523⤵
- Program crash
PID:2504
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3448 -ip 34481⤵PID:244
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3448 -ip 34481⤵PID:1664
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
742KB
MD5544cd51a596619b78e9b54b70088307d
SHA14769ddd2dbc1dc44b758964ed0bd231b85880b65
SHA256dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd
SHA512f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719