Overview

overview

10

Static

static

3

3370e84692...ff.exe

windows7-x64

10

3370e84692...ff.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    141s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    24-04-2024 14:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3370e84692c4cc07d0a64cc4415bae2888682e27a4b5f53be516013e72ae13ff.exe

  • Size

    474KB

  • MD5

    6695d71ce227e6762a4059811ea9f369

  • SHA1

    3642bbe7fc4fff442f0be15c3c8f412cf12f4428

  • SHA256

    3370e84692c4cc07d0a64cc4415bae2888682e27a4b5f53be516013e72ae13ff

  • SHA512

    5cf3f7ac8ca1052443e3ebfe40e0ed9999277ca0d205444f944e61eec57220252e9fb1432227403ff71ef2fc2020da320ca84cca9c55c102aeee8a0f7e02beb0

  • SSDEEP

    6144:xiESzl1QpPyTqW1JvsI45ExO+GFm+JbTQJiWIzDRHwjoI/RHEQj9TKO8RZ:xoZapIqKxsIw+OzNtQjoI5HZTKO8v

Score
10/10
redlinezgratinfostealerrat

Malware Config

Signatures

  • Detect ZGRat V1 37 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 37 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Detects executables packed with ConfuserEx Mod 37 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3370e84692c4cc07d0a64cc4415bae2888682e27a4b5f53be516013e72ae13ff.exe
    "C:\Users\Admin\AppData\Local\Temp\3370e84692c4cc07d0a64cc4415bae2888682e27a4b5f53be516013e72ae13ff.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1692-2-0x0000000000290000-0x00000000002D6000-memory.dmp
    Filesize

    280KB

    Download
  • memory/1692-1-0x00000000002F0000-0x00000000003F0000-memory.dmp
    Filesize

    1024KB

    Download
  • memory/1692-3-0x0000000000400000-0x000000000081B000-memory.dmp
    Filesize

    4.1MB

    Download
  • memory/1692-5-0x0000000074250000-0x000000007493E000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/1692-4-0x00000000021B0000-0x00000000021EC000-memory.dmp
    Filesize

    240KB

    Download
  • memory/1692-6-0x0000000004EE0000-0x0000000004F20000-memory.dmp
    Filesize

    256KB

    Download
  • memory/1692-8-0x0000000004EE0000-0x0000000004F20000-memory.dmp
    Filesize

    256KB

    Download
  • memory/1692-7-0x0000000004EE0000-0x0000000004F20000-memory.dmp
    Filesize

    256KB

    Download
  • memory/1692-9-0x00000000023F0000-0x000000000242A000-memory.dmp
    Filesize

    232KB

    Download
  • memory/1692-10-0x00000000023F0000-0x0000000002425000-memory.dmp
    Filesize

    212KB

    Download
  • memory/1692-11-0x00000000023F0000-0x0000000002425000-memory.dmp
    Filesize

    212KB

    Download
  • memory/1692-15-0x00000000023F0000-0x0000000002425000-memory.dmp
    Filesize

    212KB

    Download
  • memory/1692-13-0x00000000023F0000-0x0000000002425000-memory.dmp
    Filesize

    212KB

    Download
  • memory/1692-17-0x00000000023F0000-0x0000000002425000-memory.dmp
    Filesize

    212KB

    Download
  • memory/1692-19-0x00000000023F0000-0x0000000002425000-memory.dmp
    Filesize

    212KB

    Download
  • memory/1692-21-0x00000000023F0000-0x0000000002425000-memory.dmp
    Filesize

    212KB

    Download
  • memory/1692-23-0x00000000023F0000-0x0000000002425000-memory.dmp
    Filesize

    212KB

    Download
  • memory/1692-25-0x00000000023F0000-0x0000000002425000-memory.dmp
    Filesize

    212KB

    Download
  • memory/1692-27-0x00000000023F0000-0x0000000002425000-memory.dmp
    Filesize

    212KB

    Download
  • memory/1692-29-0x00000000023F0000-0x0000000002425000-memory.dmp
    Filesize

    212KB

    Download
  • memory/1692-33-0x00000000023F0000-0x0000000002425000-memory.dmp
    Filesize

    212KB

    Download
  • memory/1692-31-0x00000000023F0000-0x0000000002425000-memory.dmp
    Filesize

    212KB

    Download
  • memory/1692-35-0x00000000023F0000-0x0000000002425000-memory.dmp
    Filesize

    212KB

    Download
  • memory/1692-37-0x00000000023F0000-0x0000000002425000-memory.dmp
    Filesize

    212KB

    Download
  • memory/1692-39-0x00000000023F0000-0x0000000002425000-memory.dmp
    Filesize

    212KB

    Download
  • memory/1692-41-0x00000000023F0000-0x0000000002425000-memory.dmp
    Filesize

    212KB

    Download
  • memory/1692-43-0x00000000023F0000-0x0000000002425000-memory.dmp
    Filesize

    212KB

    Download
  • memory/1692-45-0x00000000023F0000-0x0000000002425000-memory.dmp
    Filesize

    212KB

    Download
  • memory/1692-49-0x00000000023F0000-0x0000000002425000-memory.dmp
    Filesize

    212KB

    Download
  • memory/1692-47-0x00000000023F0000-0x0000000002425000-memory.dmp
    Filesize

    212KB

    Download
  • memory/1692-51-0x00000000023F0000-0x0000000002425000-memory.dmp
    Filesize

    212KB

    Download
  • memory/1692-53-0x00000000023F0000-0x0000000002425000-memory.dmp
    Filesize

    212KB

    Download
  • memory/1692-55-0x00000000023F0000-0x0000000002425000-memory.dmp
    Filesize

    212KB

    Download
  • memory/1692-57-0x00000000023F0000-0x0000000002425000-memory.dmp
    Filesize

    212KB

    Download
  • memory/1692-59-0x00000000023F0000-0x0000000002425000-memory.dmp
    Filesize

    212KB

    Download
  • memory/1692-61-0x00000000023F0000-0x0000000002425000-memory.dmp
    Filesize

    212KB

    Download
  • memory/1692-63-0x00000000023F0000-0x0000000002425000-memory.dmp
    Filesize

    212KB

    Download
  • memory/1692-65-0x00000000023F0000-0x0000000002425000-memory.dmp
    Filesize

    212KB

    Download
  • memory/1692-67-0x00000000023F0000-0x0000000002425000-memory.dmp
    Filesize

    212KB

    Download
  • memory/1692-69-0x00000000023F0000-0x0000000002425000-memory.dmp
    Filesize

    212KB

    Download
  • memory/1692-71-0x00000000023F0000-0x0000000002425000-memory.dmp
    Filesize

    212KB

    Download
  • memory/1692-73-0x00000000023F0000-0x0000000002425000-memory.dmp
    Filesize

    212KB

    Download
  • memory/1692-802-0x0000000004EE0000-0x0000000004F20000-memory.dmp
    Filesize

    256KB

    Download
  • memory/1692-804-0x00000000002F0000-0x00000000003F0000-memory.dmp
    Filesize

    1024KB

    Download
  • memory/1692-805-0x0000000074250000-0x000000007493E000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/1692-807-0x0000000004EE0000-0x0000000004F20000-memory.dmp
    Filesize

    256KB

    Download
  • memory/1692-808-0x0000000004EE0000-0x0000000004F20000-memory.dmp
    Filesize

    256KB

    Download
  • memory/1692-809-0x0000000004EE0000-0x0000000004F20000-memory.dmp
    Filesize

    256KB

    Download