Analysis
- max time kernel
151s - max time network
159s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
02/04/2024, 01:26
General
- Target ad997dc4ee32ab469e45009f218175d0.exe
- Size 314KB
- Sample240402-bthlfadb73
- SHA256 a1f8bb5990775f277540eb4c7579695477445afd90262cb819567cc9b3042166
Malware Config
Signatures
- Detect ZGRat V1 1 IoCs
- LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
- ZGRat
ZGRat is remote access trojan written in C#.
- .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad997dc4ee32ab469e45009f218175d0.exe"C:\Users\Admin\AppData\Local\Temp\ad997dc4ee32ab469e45009f218175d0.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Roaming\Necobit.exe'"2⤵
- Creates scheduled task(s)
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1348 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/684-0-0x00000000744E0000-0x0000000074C90000-memory.dmp
memory/684-1-0x00000000007B0000-0x0000000000804000-memory.dmp
memory/684-2-0x0000000005230000-0x0000000005240000-memory.dmp
memory/684-3-0x00000000052E0000-0x000000000537C000-memory.dmp
memory/684-4-0x00000000744E0000-0x0000000074C90000-memory.dmp
memory/684-5-0x0000000005230000-0x0000000005240000-memory.dmp
memory/684-6-0x0000000001130000-0x0000000001196000-memory.dmp
memory/684-7-0x0000000005F70000-0x0000000006514000-memory.dmp