Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
22-04-2024 21:47
General
-
Target
4d7f6c2eae7ed4296c464bd766ac39624281b2910b491c82811c1140b9ea6658.exe
-
Size
706KB
-
MD5
e3e2ce0f438f98d0ea00ffe6bd872645
-
SHA1
a30c4c4a1d92e19c3c38c093819374ee801ec5f5
-
SHA256
4d7f6c2eae7ed4296c464bd766ac39624281b2910b491c82811c1140b9ea6658
-
SHA512
5e7f80a2202737e107f6608aba6f0c263d5468bdfb703f5916b3a5a8d3c6c28adb0224cc64960c0652b83ea779c62f36306fca3a0ae9d9175291fb78fabe05f6
-
SSDEEP
12288:gy90OIebMzNc6GS6pUymLZ/1TRvTpXzGygrEiUVOVwRDun4:gytIeENc6VLTTRvTpXzyUVimH
Malware Config
Signatures
-
Detect ZGRat V1 20 IoCs
-
Detects Healer an antivirus disabler dropper 18 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 18 IoCs
-
Detects executables packed with ConfuserEx Mod 20 IoCs
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d7f6c2eae7ed4296c464bd766ac39624281b2910b491c82811c1140b9ea6658.exe"C:\Users\Admin\AppData\Local\Temp\4d7f6c2eae7ed4296c464bd766ac39624281b2910b491c82811c1140b9ea6658.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un967469.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un967469.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr066793.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr066793.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 10284⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu100848.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu100848.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2816 -ip 28161⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
552KB
MD5f63e0039974791d3df10f319af23c6ef
SHA1f63c87c01ba1b018e50531bee626ece4afb80ad7
SHA256cf5b4e60da46a9dfdd5a11f200bf40a2745af5e839cb0a562a736d7e0240c065
SHA512e392edb94594bf5b4255f33e875afb9d3f5c0bafc3de7f28f30055c915d65b8e803024deecb120c321216ea7d58575ac97e673698e3d8862dbc72ba850a4db10
-
Filesize
299KB
MD5d55d56de75d02cdadfbf5af0525f1db3
SHA1db33cce6071696b1a9459d82f0586cbb35df9c57
SHA256efa287fab819d949fa2a8559c2135ee4cb1296b54bd5b79a197e4f5c35036c5a
SHA512caa7beeac8a3ae8724e28129c2a822ee8c68a683cdc77a8563b0fe98d766f2e5bdb4a36daeb908332018c9cdfb7c6f12e23c0ee6d0fb307238cbe7fdd4023ac0
-
Filesize
381KB
MD53bea2550962e1630579639d8e61ba069
SHA1b5cb58f4e844e6d40cdc6c10ec5514d9e59fed69
SHA256805949e5452744035797b5b61bc9c3777e9c9c5af1165b6765c0156aaceb7179
SHA5123258d7cf8c9e8fdd764c2e074309a77875c8501071dffdcad99e8282a0793a3f7c741cf0c4a009890609fffdf2bbea25427fe1ebdedfb9b00a3e1ff456295267
-
Filesize
1024KB
-
Filesize
180KB
-
Filesize
104KB
-
Filesize
39.7MB
-
Filesize
5.6MB
-
Filesize
64KB
-
Filesize
96KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
39.7MB
-
Filesize
39.7MB
-
Filesize
7.7MB
-
Filesize
180KB
-
Filesize
1024KB
-
Filesize
240KB
-
Filesize
232KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
64KB
-
Filesize
212KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
39.8MB
-
Filesize
212KB
-
Filesize
280KB
-
Filesize
7.7MB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
6.1MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
1024KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
64KB