Analysis
- max time kernel
149s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
31/03/2024, 02:42
General
- Target net.exe
- Size 5.3MB
- Sample240331-c67a1ach47
- SHA256 432747c04ab478a654328867d7ca806b52fedf1572c74712fa8b7c0edb71df67
Malware Config
Signatures
- Detect ZGRat V1 35 IoCs
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\net.exe"C:\Users\Admin\AppData\Local\Temp\net.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BLHisbnd.exe"C:\Users\Admin\AppData\Local\Temp\BLHisbnd.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\net.exe"C:\Users\Admin\AppData\Local\Temp\net.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 4483⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 1803⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1124 -ip 11241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1124 -ip 11241⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
BLHisbnd.exe
memory/640-5080-0x00000000021F0000-0x00000000025F0000-memory.dmp
memory/640-5061-0x00000000021F0000-0x00000000025F0000-memory.dmp
memory/640-5055-0x00000000021F0000-0x00000000025F0000-memory.dmp
memory/704-52-0x0000000005880000-0x0000000005D2B000-memory.dmp
memory/704-28-0x0000000005880000-0x0000000005D2B000-memory.dmp
memory/704-10-0x0000000005880000-0x0000000005D2B000-memory.dmp
memory/704-12-0x0000000005880000-0x0000000005D2B000-memory.dmp
memory/704-14-0x0000000005880000-0x0000000005D2B000-memory.dmp
memory/704-16-0x0000000005880000-0x0000000005D2B000-memory.dmp
memory/704-18-0x0000000005880000-0x0000000005D2B000-memory.dmp
memory/704-20-0x0000000005880000-0x0000000005D2B000-memory.dmp
memory/704-4-0x0000000005880000-0x0000000005D2B000-memory.dmp
memory/704-22-0x0000000005880000-0x0000000005D2B000-memory.dmp
memory/704-24-0x0000000005880000-0x0000000005D2B000-memory.dmp
memory/704-26-0x0000000005880000-0x0000000005D2B000-memory.dmp
memory/704-56-0x0000000005880000-0x0000000005D2B000-memory.dmp
memory/704-30-0x0000000005880000-0x0000000005D2B000-memory.dmp
memory/704-32-0x0000000005880000-0x0000000005D2B000-memory.dmp
memory/704-34-0x0000000005880000-0x0000000005D2B000-memory.dmp
memory/704-36-0x0000000005880000-0x0000000005D2B000-memory.dmp
memory/704-38-0x0000000005880000-0x0000000005D2B000-memory.dmp
memory/704-40-0x0000000005880000-0x0000000005D2B000-memory.dmp
memory/704-42-0x0000000005880000-0x0000000005D2B000-memory.dmp
memory/704-44-0x0000000005880000-0x0000000005D2B000-memory.dmp
memory/704-46-0x0000000005880000-0x0000000005D2B000-memory.dmp
memory/704-48-0x0000000005880000-0x0000000005D2B000-memory.dmp
memory/704-50-0x0000000005880000-0x0000000005D2B000-memory.dmp
memory/704-8-0x0000000005880000-0x0000000005D2B000-memory.dmp
memory/704-1-0x00000000007C0000-0x0000000000D1A000-memory.dmp
memory/704-0-0x0000000074B70000-0x0000000075320000-memory.dmp
memory/704-58-0x0000000005880000-0x0000000005D2B000-memory.dmp
memory/704-60-0x0000000005880000-0x0000000005D2B000-memory.dmp
memory/704-62-0x0000000005880000-0x0000000005D2B000-memory.dmp
memory/704-64-0x0000000005880000-0x0000000005D2B000-memory.dmp
memory/704-66-0x0000000005880000-0x0000000005D2B000-memory.dmp
memory/704-1434-0x0000000074B70000-0x0000000075320000-memory.dmp
memory/704-4884-0x0000000005770000-0x0000000005780000-memory.dmp
memory/704-4885-0x0000000001210000-0x0000000001211000-memory.dmp
memory/704-4886-0x0000000007070000-0x000000000735C000-memory.dmp
memory/704-4887-0x00000000016C0000-0x000000000170C000-memory.dmp
memory/704-6-0x0000000005880000-0x0000000005D2B000-memory.dmp
memory/704-2-0x0000000005880000-0x0000000005D30000-memory.dmp
memory/704-4902-0x0000000007490000-0x00000000074E4000-memory.dmp
memory/704-4900-0x0000000008160000-0x0000000008704000-memory.dmp
memory/704-3-0x0000000005880000-0x0000000005D2B000-memory.dmp
memory/704-4914-0x0000000074B70000-0x0000000075320000-memory.dmp
memory/704-54-0x0000000005880000-0x0000000005D2B000-memory.dmp
memory/1124-5037-0x00000000040B0000-0x00000000044B0000-memory.dmp
memory/1124-5044-0x00000000040B0000-0x00000000044B0000-memory.dmp
memory/1124-4913-0x0000000000400000-0x000000000046D000-memory.dmp
memory/1124-5083-0x00000000040B0000-0x00000000044B0000-memory.dmp
memory/3684-4903-0x0000000004CC0000-0x0000000004F78000-memory.dmp
memory/3684-4899-0x0000000000020000-0x0000000000380000-memory.dmp
memory/3684-4901-0x0000000074B70000-0x0000000075320000-memory.dmp
memory/3684-6107-0x0000000074B70000-0x0000000075320000-memory.dmp