Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-04-2024 11:11
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20240221-en
General
-
Target
tmp.exe
-
Size
4.6MB
-
MD5
397926927bca55be4a77839b1c44de6e
-
SHA1
e10f3434ef3021c399dbba047832f02b3c898dbd
-
SHA256
4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7
-
SHA512
cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954
-
SSDEEP
49152:1ZRCckM8wwGbtBiRFWSGqCW4FL5wslsAEL1ksS2NHsF3TjZ1I6bqmHC0Jg:1ZRCwrb64XwWsAwFaFXxg
Malware Config
Signatures
-
Detect ZGRat V1 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2468-40-0x00000000012A0000-0x0000000004B98000-memory.dmp family_zgrat_v1 behavioral1/memory/2468-42-0x000000001ED80000-0x000000001EE90000-memory.dmp family_zgrat_v1 behavioral1/memory/2468-46-0x000000001EA50000-0x000000001EA74000-memory.dmp family_zgrat_v1 -
Downloads MZ/PE file
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
tmp.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI tmp.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI tmp.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI tmp.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exepid process 2468 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 2468 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 2468 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 2468 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exedescription pid process Token: SeDebugPrivilege 2468 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
Processes:
tmp.exepid process 2012 tmp.exe 2012 tmp.exe 2012 tmp.exe 2012 tmp.exe 2012 tmp.exe 2012 tmp.exe 2012 tmp.exe -
Suspicious use of SendNotifyMessage 7 IoCs
Processes:
tmp.exepid process 2012 tmp.exe 2012 tmp.exe 2012 tmp.exe 2012 tmp.exe 2012 tmp.exe 2012 tmp.exe 2012 tmp.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
tmp.exedescription pid process target process PID 2012 wrote to memory of 2468 2012 tmp.exe SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe PID 2012 wrote to memory of 2468 2012 tmp.exe SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe PID 2012 wrote to memory of 2468 2012 tmp.exe SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe PID 2012 wrote to memory of 2468 2012 tmp.exe SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\ApplicationInsights\f40fa09571ae3e4604ca1ef5093c12d04345052412cd199086553bfab6d3b7c7\c9ce398278534e1ab4ae87039457e5b6.tmpFilesize
1KB
MD5e9e34bd58e305e1d421dad56a2795549
SHA1ee36e679951322b4e2b4834d4fc65398f7b0a974
SHA2561ecfd96d81ddd2dd4d043d1d3346b68b64464d0d97077521446bd4b759ac4b6d
SHA512e45b266a40522468acfeb5cd3c0c2a39aeb6c4c2b8fb3b8737271ddf19f79f9fd8ef1f25ef1a67f2562e5216628aa62ddb618f742bc5d58816b339a5e581a607
-
memory/2012-0-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2012-24-0x0000000000400000-0x00000000008AD000-memory.dmpFilesize
4.7MB
-
memory/2012-26-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2012-38-0x0000000000400000-0x00000000008AD000-memory.dmpFilesize
4.7MB
-
memory/2468-51-0x0000000000B10000-0x0000000000B72000-memory.dmpFilesize
392KB
-
memory/2468-59-0x000000001EA80000-0x000000001EB00000-memory.dmpFilesize
512KB
-
memory/2468-42-0x000000001ED80000-0x000000001EE90000-memory.dmpFilesize
1.1MB
-
memory/2468-43-0x00000000002E0000-0x00000000002F0000-memory.dmpFilesize
64KB
-
memory/2468-44-0x0000000000BF0000-0x0000000000BFC000-memory.dmpFilesize
48KB
-
memory/2468-45-0x0000000000300000-0x0000000000314000-memory.dmpFilesize
80KB
-
memory/2468-46-0x000000001EA50000-0x000000001EA74000-memory.dmpFilesize
144KB
-
memory/2468-47-0x0000000001290000-0x000000000129A000-memory.dmpFilesize
40KB
-
memory/2468-48-0x000000001EC00000-0x000000001EC2A000-memory.dmpFilesize
168KB
-
memory/2468-49-0x000000001F460000-0x000000001F512000-memory.dmpFilesize
712KB
-
memory/2468-50-0x000000001F510000-0x000000001F58A000-memory.dmpFilesize
488KB
-
memory/2468-40-0x00000000012A0000-0x0000000004B98000-memory.dmpFilesize
57.0MB
-
memory/2468-52-0x00000000005A0000-0x00000000005AA000-memory.dmpFilesize
40KB
-
memory/2468-56-0x000000001FD20000-0x0000000020020000-memory.dmpFilesize
3.0MB
-
memory/2468-58-0x00000000005C0000-0x00000000005CA000-memory.dmpFilesize
40KB
-
memory/2468-41-0x000000001EA80000-0x000000001EB00000-memory.dmpFilesize
512KB
-
memory/2468-60-0x000000001EA80000-0x000000001EB00000-memory.dmpFilesize
512KB
-
memory/2468-62-0x000000001E0B0000-0x000000001E0D2000-memory.dmpFilesize
136KB
-
memory/2468-61-0x000000001E0A0000-0x000000001E0AA000-memory.dmpFilesize
40KB
-
memory/2468-66-0x000000001EA80000-0x000000001EB00000-memory.dmpFilesize
512KB
-
memory/2468-65-0x000000001E0D0000-0x000000001E0DC000-memory.dmpFilesize
48KB
-
memory/2468-68-0x000007FEF5F80000-0x000007FEF696C000-memory.dmpFilesize
9.9MB
-
memory/2468-69-0x000000001EA80000-0x000000001EB00000-memory.dmpFilesize
512KB
-
memory/2468-71-0x00000000005C0000-0x00000000005CA000-memory.dmpFilesize
40KB
-
memory/2468-70-0x00000000005C0000-0x00000000005CA000-memory.dmpFilesize
40KB
-
memory/2468-72-0x000000001EA80000-0x000000001EB00000-memory.dmpFilesize
512KB
-
memory/2468-73-0x000000001EA80000-0x000000001EB00000-memory.dmpFilesize
512KB
-
memory/2468-74-0x000000001EA80000-0x000000001EB00000-memory.dmpFilesize
512KB
-
memory/2468-39-0x000007FEF5F80000-0x000007FEF696C000-memory.dmpFilesize
9.9MB