Resubmissions
09/04/2024, 03:49
240409-edcl2adf681009/04/2024, 03:48
240409-ec33ladf591009/04/2024, 03:47
240409-ecqr9sdf461009/04/2024, 03:47
240409-eb8xfshb7t1003/04/2024, 12:14
240403-peb21add4210Analysis
- max time kernel
148s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
03/04/2024, 12:14
General
- Target Ezxotfkmz.exe
- Size 451KB
- Sample240403-peb21add42
- SHA256 89d511c97a4e0f4bf48a72fe764adb6d3de9007859c7632dc07477f2062c2b20
Malware Config
Extracted
-
bitrat
-
1.38
-
103.153.182.247:6161
-
communication_password
81dc9bdb52d04dc20036dbd8313ed055
-
install_dir
Install path
-
install_file
Install name
-
tor_process
tor
Signatures
- BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
- Detect ZGRat V1 34 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Drops startup file 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: RenamesItself 4 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ezxotfkmz.exe"C:\Users\Admin\AppData\Local\Temp\Ezxotfkmz.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ezxotfkmz.exe"C:\Users\Admin\AppData\Local\Temp\Ezxotfkmz.exe"2⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1344-39-0x00000000061E0000-0x00000000065BF000-memory.dmp
memory/1344-19-0x00000000061E0000-0x00000000065BF000-memory.dmp
memory/1344-2-0x0000000005850000-0x0000000005860000-memory.dmp
memory/1344-3-0x00000000061E0000-0x00000000065C4000-memory.dmp
memory/1344-4-0x00000000061E0000-0x00000000065BF000-memory.dmp
memory/1344-5-0x00000000061E0000-0x00000000065BF000-memory.dmp
memory/1344-7-0x00000000061E0000-0x00000000065BF000-memory.dmp
memory/1344-9-0x00000000061E0000-0x00000000065BF000-memory.dmp
memory/1344-11-0x00000000061E0000-0x00000000065BF000-memory.dmp
memory/1344-13-0x00000000061E0000-0x00000000065BF000-memory.dmp
memory/1344-15-0x00000000061E0000-0x00000000065BF000-memory.dmp
memory/1344-17-0x00000000061E0000-0x00000000065BF000-memory.dmp
memory/1344-41-0x00000000061E0000-0x00000000065BF000-memory.dmp
memory/1344-21-0x00000000061E0000-0x00000000065BF000-memory.dmp
memory/1344-23-0x00000000061E0000-0x00000000065BF000-memory.dmp
memory/1344-25-0x00000000061E0000-0x00000000065BF000-memory.dmp
memory/1344-27-0x00000000061E0000-0x00000000065BF000-memory.dmp
memory/1344-29-0x00000000061E0000-0x00000000065BF000-memory.dmp
memory/1344-31-0x00000000061E0000-0x00000000065BF000-memory.dmp
memory/1344-33-0x00000000061E0000-0x00000000065BF000-memory.dmp
memory/1344-35-0x00000000061E0000-0x00000000065BF000-memory.dmp
memory/1344-37-0x00000000061E0000-0x00000000065BF000-memory.dmp
memory/1344-1-0x0000000075010000-0x00000000757C0000-memory.dmp
memory/1344-0-0x0000000000D00000-0x0000000000D76000-memory.dmp
memory/1344-57-0x00000000061E0000-0x00000000065BF000-memory.dmp
memory/1344-45-0x00000000061E0000-0x00000000065BF000-memory.dmp
memory/1344-47-0x00000000061E0000-0x00000000065BF000-memory.dmp
memory/1344-49-0x00000000061E0000-0x00000000065BF000-memory.dmp
memory/1344-51-0x00000000061E0000-0x00000000065BF000-memory.dmp
memory/1344-53-0x00000000061E0000-0x00000000065BF000-memory.dmp
memory/1344-55-0x00000000061E0000-0x00000000065BF000-memory.dmp
memory/1344-43-0x00000000061E0000-0x00000000065BF000-memory.dmp
memory/1344-59-0x00000000061E0000-0x00000000065BF000-memory.dmp
memory/1344-61-0x00000000061E0000-0x00000000065BF000-memory.dmp
memory/1344-63-0x00000000061E0000-0x00000000065BF000-memory.dmp
memory/1344-65-0x00000000061E0000-0x00000000065BF000-memory.dmp
memory/1344-67-0x00000000061E0000-0x00000000065BF000-memory.dmp
memory/1344-1397-0x0000000075010000-0x00000000757C0000-memory.dmp
memory/1344-1564-0x0000000005850000-0x0000000005860000-memory.dmp
memory/1344-4886-0x0000000001210000-0x0000000001211000-memory.dmp
memory/1344-4887-0x0000000007890000-0x0000000007AB0000-memory.dmp
memory/1344-4888-0x0000000002E70000-0x0000000002EBC000-memory.dmp
memory/1344-4889-0x0000000008060000-0x0000000008604000-memory.dmp
memory/1344-4890-0x0000000005540000-0x0000000005594000-memory.dmp
memory/1344-4898-0x0000000075010000-0x00000000757C0000-memory.dmp
memory/3852-4897-0x0000000000400000-0x00000000007CE000-memory.dmp
memory/3852-4900-0x0000000074F20000-0x0000000074F59000-memory.dmp