Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
24-04-2024 14:45
Static task
static1
Behavioral task
behavioral1
Sample
3370e84692c4cc07d0a64cc4415bae2888682e27a4b5f53be516013e72ae13ff.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3370e84692c4cc07d0a64cc4415bae2888682e27a4b5f53be516013e72ae13ff.exe
Resource
win10v2004-20240412-en
General
-
Target
3370e84692c4cc07d0a64cc4415bae2888682e27a4b5f53be516013e72ae13ff.exe
-
Size
474KB
-
MD5
6695d71ce227e6762a4059811ea9f369
-
SHA1
3642bbe7fc4fff442f0be15c3c8f412cf12f4428
-
SHA256
3370e84692c4cc07d0a64cc4415bae2888682e27a4b5f53be516013e72ae13ff
-
SHA512
5cf3f7ac8ca1052443e3ebfe40e0ed9999277ca0d205444f944e61eec57220252e9fb1432227403ff71ef2fc2020da320ca84cca9c55c102aeee8a0f7e02beb0
-
SSDEEP
6144:xiESzl1QpPyTqW1JvsI45ExO+GFm+JbTQJiWIzDRHwjoI/RHEQj9TKO8RZ:xoZapIqKxsIw+OzNtQjoI5HZTKO8v
Malware Config
Signatures
-
Detect ZGRat V1 35 IoCs
Processes:
resource yara_rule behavioral2/memory/2836-4-0x00000000027B0000-0x00000000027EC000-memory.dmp family_zgrat_v1 behavioral2/memory/2836-8-0x0000000002B20000-0x0000000002B5A000-memory.dmp family_zgrat_v1 behavioral2/memory/2836-9-0x0000000002B20000-0x0000000002B55000-memory.dmp family_zgrat_v1 behavioral2/memory/2836-10-0x0000000002B20000-0x0000000002B55000-memory.dmp family_zgrat_v1 behavioral2/memory/2836-12-0x0000000002B20000-0x0000000002B55000-memory.dmp family_zgrat_v1 behavioral2/memory/2836-14-0x0000000002B20000-0x0000000002B55000-memory.dmp family_zgrat_v1 behavioral2/memory/2836-16-0x0000000002B20000-0x0000000002B55000-memory.dmp family_zgrat_v1 behavioral2/memory/2836-18-0x0000000002B20000-0x0000000002B55000-memory.dmp family_zgrat_v1 behavioral2/memory/2836-20-0x0000000002B20000-0x0000000002B55000-memory.dmp family_zgrat_v1 behavioral2/memory/2836-22-0x0000000002B20000-0x0000000002B55000-memory.dmp family_zgrat_v1 behavioral2/memory/2836-24-0x0000000002B20000-0x0000000002B55000-memory.dmp family_zgrat_v1 behavioral2/memory/2836-26-0x0000000002B20000-0x0000000002B55000-memory.dmp family_zgrat_v1 behavioral2/memory/2836-28-0x0000000002B20000-0x0000000002B55000-memory.dmp family_zgrat_v1 behavioral2/memory/2836-30-0x0000000002B20000-0x0000000002B55000-memory.dmp family_zgrat_v1 behavioral2/memory/2836-32-0x0000000002B20000-0x0000000002B55000-memory.dmp family_zgrat_v1 behavioral2/memory/2836-34-0x0000000002B20000-0x0000000002B55000-memory.dmp family_zgrat_v1 behavioral2/memory/2836-36-0x0000000002B20000-0x0000000002B55000-memory.dmp family_zgrat_v1 behavioral2/memory/2836-40-0x0000000002B20000-0x0000000002B55000-memory.dmp family_zgrat_v1 behavioral2/memory/2836-38-0x0000000002B20000-0x0000000002B55000-memory.dmp family_zgrat_v1 behavioral2/memory/2836-42-0x0000000002B20000-0x0000000002B55000-memory.dmp family_zgrat_v1 behavioral2/memory/2836-44-0x0000000002B20000-0x0000000002B55000-memory.dmp family_zgrat_v1 behavioral2/memory/2836-46-0x0000000002B20000-0x0000000002B55000-memory.dmp family_zgrat_v1 behavioral2/memory/2836-48-0x0000000002B20000-0x0000000002B55000-memory.dmp family_zgrat_v1 behavioral2/memory/2836-50-0x0000000002B20000-0x0000000002B55000-memory.dmp family_zgrat_v1 behavioral2/memory/2836-52-0x0000000002B20000-0x0000000002B55000-memory.dmp family_zgrat_v1 behavioral2/memory/2836-54-0x0000000002B20000-0x0000000002B55000-memory.dmp family_zgrat_v1 behavioral2/memory/2836-56-0x0000000002B20000-0x0000000002B55000-memory.dmp family_zgrat_v1 behavioral2/memory/2836-58-0x0000000002B20000-0x0000000002B55000-memory.dmp family_zgrat_v1 behavioral2/memory/2836-62-0x0000000002B20000-0x0000000002B55000-memory.dmp family_zgrat_v1 behavioral2/memory/2836-60-0x0000000002B20000-0x0000000002B55000-memory.dmp family_zgrat_v1 behavioral2/memory/2836-64-0x0000000002B20000-0x0000000002B55000-memory.dmp family_zgrat_v1 behavioral2/memory/2836-72-0x0000000002B20000-0x0000000002B55000-memory.dmp family_zgrat_v1 behavioral2/memory/2836-70-0x0000000002B20000-0x0000000002B55000-memory.dmp family_zgrat_v1 behavioral2/memory/2836-68-0x0000000002B20000-0x0000000002B55000-memory.dmp family_zgrat_v1 behavioral2/memory/2836-66-0x0000000002B20000-0x0000000002B55000-memory.dmp family_zgrat_v1 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
Processes:
resource yara_rule behavioral2/memory/2836-4-0x00000000027B0000-0x00000000027EC000-memory.dmp family_redline behavioral2/memory/2836-8-0x0000000002B20000-0x0000000002B5A000-memory.dmp family_redline behavioral2/memory/2836-9-0x0000000002B20000-0x0000000002B55000-memory.dmp family_redline behavioral2/memory/2836-10-0x0000000002B20000-0x0000000002B55000-memory.dmp family_redline behavioral2/memory/2836-12-0x0000000002B20000-0x0000000002B55000-memory.dmp family_redline behavioral2/memory/2836-14-0x0000000002B20000-0x0000000002B55000-memory.dmp family_redline behavioral2/memory/2836-16-0x0000000002B20000-0x0000000002B55000-memory.dmp family_redline behavioral2/memory/2836-18-0x0000000002B20000-0x0000000002B55000-memory.dmp family_redline behavioral2/memory/2836-20-0x0000000002B20000-0x0000000002B55000-memory.dmp family_redline behavioral2/memory/2836-22-0x0000000002B20000-0x0000000002B55000-memory.dmp family_redline behavioral2/memory/2836-24-0x0000000002B20000-0x0000000002B55000-memory.dmp family_redline behavioral2/memory/2836-26-0x0000000002B20000-0x0000000002B55000-memory.dmp family_redline behavioral2/memory/2836-28-0x0000000002B20000-0x0000000002B55000-memory.dmp family_redline behavioral2/memory/2836-30-0x0000000002B20000-0x0000000002B55000-memory.dmp family_redline behavioral2/memory/2836-32-0x0000000002B20000-0x0000000002B55000-memory.dmp family_redline behavioral2/memory/2836-34-0x0000000002B20000-0x0000000002B55000-memory.dmp family_redline behavioral2/memory/2836-36-0x0000000002B20000-0x0000000002B55000-memory.dmp family_redline behavioral2/memory/2836-40-0x0000000002B20000-0x0000000002B55000-memory.dmp family_redline behavioral2/memory/2836-38-0x0000000002B20000-0x0000000002B55000-memory.dmp family_redline behavioral2/memory/2836-42-0x0000000002B20000-0x0000000002B55000-memory.dmp family_redline behavioral2/memory/2836-44-0x0000000002B20000-0x0000000002B55000-memory.dmp family_redline behavioral2/memory/2836-46-0x0000000002B20000-0x0000000002B55000-memory.dmp family_redline behavioral2/memory/2836-48-0x0000000002B20000-0x0000000002B55000-memory.dmp family_redline behavioral2/memory/2836-50-0x0000000002B20000-0x0000000002B55000-memory.dmp family_redline behavioral2/memory/2836-52-0x0000000002B20000-0x0000000002B55000-memory.dmp family_redline behavioral2/memory/2836-54-0x0000000002B20000-0x0000000002B55000-memory.dmp family_redline behavioral2/memory/2836-56-0x0000000002B20000-0x0000000002B55000-memory.dmp family_redline behavioral2/memory/2836-58-0x0000000002B20000-0x0000000002B55000-memory.dmp family_redline behavioral2/memory/2836-62-0x0000000002B20000-0x0000000002B55000-memory.dmp family_redline behavioral2/memory/2836-60-0x0000000002B20000-0x0000000002B55000-memory.dmp family_redline behavioral2/memory/2836-64-0x0000000002B20000-0x0000000002B55000-memory.dmp family_redline behavioral2/memory/2836-72-0x0000000002B20000-0x0000000002B55000-memory.dmp family_redline behavioral2/memory/2836-70-0x0000000002B20000-0x0000000002B55000-memory.dmp family_redline behavioral2/memory/2836-68-0x0000000002B20000-0x0000000002B55000-memory.dmp family_redline behavioral2/memory/2836-66-0x0000000002B20000-0x0000000002B55000-memory.dmp family_redline -
Detects executables packed with ConfuserEx Mod 35 IoCs
Processes:
resource yara_rule behavioral2/memory/2836-4-0x00000000027B0000-0x00000000027EC000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/2836-8-0x0000000002B20000-0x0000000002B5A000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/2836-9-0x0000000002B20000-0x0000000002B55000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/2836-10-0x0000000002B20000-0x0000000002B55000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/2836-12-0x0000000002B20000-0x0000000002B55000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/2836-14-0x0000000002B20000-0x0000000002B55000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/2836-16-0x0000000002B20000-0x0000000002B55000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/2836-18-0x0000000002B20000-0x0000000002B55000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/2836-20-0x0000000002B20000-0x0000000002B55000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/2836-22-0x0000000002B20000-0x0000000002B55000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/2836-24-0x0000000002B20000-0x0000000002B55000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/2836-26-0x0000000002B20000-0x0000000002B55000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/2836-28-0x0000000002B20000-0x0000000002B55000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/2836-30-0x0000000002B20000-0x0000000002B55000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/2836-32-0x0000000002B20000-0x0000000002B55000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/2836-34-0x0000000002B20000-0x0000000002B55000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/2836-36-0x0000000002B20000-0x0000000002B55000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/2836-40-0x0000000002B20000-0x0000000002B55000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/2836-38-0x0000000002B20000-0x0000000002B55000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/2836-42-0x0000000002B20000-0x0000000002B55000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/2836-44-0x0000000002B20000-0x0000000002B55000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/2836-46-0x0000000002B20000-0x0000000002B55000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/2836-48-0x0000000002B20000-0x0000000002B55000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/2836-50-0x0000000002B20000-0x0000000002B55000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/2836-52-0x0000000002B20000-0x0000000002B55000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/2836-54-0x0000000002B20000-0x0000000002B55000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/2836-56-0x0000000002B20000-0x0000000002B55000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/2836-58-0x0000000002B20000-0x0000000002B55000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/2836-62-0x0000000002B20000-0x0000000002B55000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/2836-60-0x0000000002B20000-0x0000000002B55000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/2836-64-0x0000000002B20000-0x0000000002B55000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/2836-72-0x0000000002B20000-0x0000000002B55000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/2836-70-0x0000000002B20000-0x0000000002B55000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/2836-68-0x0000000002B20000-0x0000000002B55000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/2836-66-0x0000000002B20000-0x0000000002B55000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
3370e84692c4cc07d0a64cc4415bae2888682e27a4b5f53be516013e72ae13ff.exedescription pid process Token: SeDebugPrivilege 2836 3370e84692c4cc07d0a64cc4415bae2888682e27a4b5f53be516013e72ae13ff.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2836-1-0x00000000008A0000-0x00000000009A0000-memory.dmpFilesize
1024KB
-
memory/2836-2-0x0000000002560000-0x00000000025A6000-memory.dmpFilesize
280KB
-
memory/2836-3-0x0000000000400000-0x000000000081B000-memory.dmpFilesize
4.1MB
-
memory/2836-5-0x0000000074930000-0x00000000750E0000-memory.dmpFilesize
7.7MB
-
memory/2836-4-0x00000000027B0000-0x00000000027EC000-memory.dmpFilesize
240KB
-
memory/2836-6-0x00000000050C0000-0x00000000050D0000-memory.dmpFilesize
64KB
-
memory/2836-7-0x00000000050D0000-0x0000000005674000-memory.dmpFilesize
5.6MB
-
memory/2836-8-0x0000000002B20000-0x0000000002B5A000-memory.dmpFilesize
232KB
-
memory/2836-9-0x0000000002B20000-0x0000000002B55000-memory.dmpFilesize
212KB
-
memory/2836-10-0x0000000002B20000-0x0000000002B55000-memory.dmpFilesize
212KB
-
memory/2836-12-0x0000000002B20000-0x0000000002B55000-memory.dmpFilesize
212KB
-
memory/2836-14-0x0000000002B20000-0x0000000002B55000-memory.dmpFilesize
212KB
-
memory/2836-16-0x0000000002B20000-0x0000000002B55000-memory.dmpFilesize
212KB
-
memory/2836-18-0x0000000002B20000-0x0000000002B55000-memory.dmpFilesize
212KB
-
memory/2836-20-0x0000000002B20000-0x0000000002B55000-memory.dmpFilesize
212KB
-
memory/2836-22-0x0000000002B20000-0x0000000002B55000-memory.dmpFilesize
212KB
-
memory/2836-24-0x0000000002B20000-0x0000000002B55000-memory.dmpFilesize
212KB
-
memory/2836-26-0x0000000002B20000-0x0000000002B55000-memory.dmpFilesize
212KB
-
memory/2836-28-0x0000000002B20000-0x0000000002B55000-memory.dmpFilesize
212KB
-
memory/2836-30-0x0000000002B20000-0x0000000002B55000-memory.dmpFilesize
212KB
-
memory/2836-32-0x0000000002B20000-0x0000000002B55000-memory.dmpFilesize
212KB
-
memory/2836-34-0x0000000002B20000-0x0000000002B55000-memory.dmpFilesize
212KB
-
memory/2836-36-0x0000000002B20000-0x0000000002B55000-memory.dmpFilesize
212KB
-
memory/2836-40-0x0000000002B20000-0x0000000002B55000-memory.dmpFilesize
212KB
-
memory/2836-38-0x0000000002B20000-0x0000000002B55000-memory.dmpFilesize
212KB
-
memory/2836-42-0x0000000002B20000-0x0000000002B55000-memory.dmpFilesize
212KB
-
memory/2836-44-0x0000000002B20000-0x0000000002B55000-memory.dmpFilesize
212KB
-
memory/2836-46-0x0000000002B20000-0x0000000002B55000-memory.dmpFilesize
212KB
-
memory/2836-48-0x0000000002B20000-0x0000000002B55000-memory.dmpFilesize
212KB
-
memory/2836-50-0x0000000002B20000-0x0000000002B55000-memory.dmpFilesize
212KB
-
memory/2836-52-0x0000000002B20000-0x0000000002B55000-memory.dmpFilesize
212KB
-
memory/2836-54-0x0000000002B20000-0x0000000002B55000-memory.dmpFilesize
212KB
-
memory/2836-56-0x0000000002B20000-0x0000000002B55000-memory.dmpFilesize
212KB
-
memory/2836-58-0x0000000002B20000-0x0000000002B55000-memory.dmpFilesize
212KB
-
memory/2836-62-0x0000000002B20000-0x0000000002B55000-memory.dmpFilesize
212KB
-
memory/2836-60-0x0000000002B20000-0x0000000002B55000-memory.dmpFilesize
212KB
-
memory/2836-64-0x0000000002B20000-0x0000000002B55000-memory.dmpFilesize
212KB
-
memory/2836-72-0x0000000002B20000-0x0000000002B55000-memory.dmpFilesize
212KB
-
memory/2836-70-0x0000000002B20000-0x0000000002B55000-memory.dmpFilesize
212KB
-
memory/2836-68-0x0000000002B20000-0x0000000002B55000-memory.dmpFilesize
212KB
-
memory/2836-66-0x0000000002B20000-0x0000000002B55000-memory.dmpFilesize
212KB
-
memory/2836-801-0x0000000007B00000-0x0000000008118000-memory.dmpFilesize
6.1MB
-
memory/2836-802-0x0000000005080000-0x0000000005092000-memory.dmpFilesize
72KB
-
memory/2836-803-0x0000000008120000-0x000000000822A000-memory.dmpFilesize
1.0MB
-
memory/2836-804-0x00000000050C0000-0x00000000050D0000-memory.dmpFilesize
64KB
-
memory/2836-805-0x0000000008230000-0x000000000826C000-memory.dmpFilesize
240KB
-
memory/2836-806-0x0000000002720000-0x000000000276C000-memory.dmpFilesize
304KB
-
memory/2836-808-0x00000000008A0000-0x00000000009A0000-memory.dmpFilesize
1024KB
-
memory/2836-809-0x0000000002560000-0x00000000025A6000-memory.dmpFilesize
280KB
-
memory/2836-810-0x0000000074930000-0x00000000750E0000-memory.dmpFilesize
7.7MB
-
memory/2836-811-0x0000000000400000-0x000000000081B000-memory.dmpFilesize
4.1MB
-
memory/2836-813-0x00000000050C0000-0x00000000050D0000-memory.dmpFilesize
64KB
-
memory/2836-814-0x00000000050C0000-0x00000000050D0000-memory.dmpFilesize
64KB
-
memory/2836-815-0x00000000050C0000-0x00000000050D0000-memory.dmpFilesize
64KB