Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
24-04-2024 17:51
General
-
Target
7c960045ac7897a81ce01f974abb7aa83300a65aaefc94493b8d1f3b6f7a2354.exe
-
Size
696KB
-
MD5
4ca06158407b9d95c86f42dbb09487f4
-
SHA1
d16920e8b6a12e631d3be57be69d2038f1236813
-
SHA256
7c960045ac7897a81ce01f974abb7aa83300a65aaefc94493b8d1f3b6f7a2354
-
SHA512
1b0f9cc86ae32c4789349edaa17b75b8dde3e500a97b32db5c55db4d4ca8bbc17c5aa4dbc5ea0bfc89ca6d8267bd21754236bb0e4e09de1bc84428d7fe005324
-
SSDEEP
12288:jy90CgQx7nUfjX/OPqVQqT3hxKjOuYYEcYrUHVJH4:jyBKjX/OSVlD9uY12s
Malware Config
Signatures
-
Detect ZGRat V1 20 IoCs
-
Detects Healer an antivirus disabler dropper 18 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 18 IoCs
-
Detects executables packed with ConfuserEx Mod 20 IoCs
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c960045ac7897a81ce01f974abb7aa83300a65aaefc94493b8d1f3b6f7a2354.exe"C:\Users\Admin\AppData\Local\Temp\7c960045ac7897a81ce01f974abb7aa83300a65aaefc94493b8d1f3b6f7a2354.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un639802.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un639802.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr399239.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr399239.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1068 -s 10804⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu051503.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu051503.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1068 -ip 10681⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
543KB
MD500878ae94239027c6ac0ce0456c9a361
SHA154f29558ab5f63bf62a4a83e66f69d863eafe4fb
SHA25601b702685250315679d5eb07cde349e2410e2acd7c2c2678b53f9eb99a50ff2e
SHA512ba477fef4c1996c60b6d7fdc958bba53e9c3da9d82f5030dec2cde287ae4841a94eb5bfb98d5b7b00813ce5b2449b45bc11e16a73fb4a3454571d1a0c20d6af8
-
Filesize
269KB
MD551760ce0e328ced19f6df0b15917e990
SHA151de00adfc945ff585e8748a19c73f51a3ce1851
SHA25641ea0044cbcb091b71e51cac039e51bd1f64b071240062f32c0f7dbd910f8cf1
SHA5120141440edd082d8f662a63dfcd54796b08145d578adcd7c9de37b12141ae342ae4999654ec466e7da3688e1938c1b0e440e769068968a91b019ca70622a50108
-
Filesize
351KB
MD5f91e92e49af44f1855c1d733f7407c09
SHA1e0893c65b0af985549de8d17e76712407527aa60
SHA256a4b94c14067a61e830a27d71ef0a2630a64b64f5dd59576ad5ed13cf0b4eefc5
SHA51268bef83cdc2a87260fb79bfa350777fab4935c3ef6fe68deeeab99729b692f5589ee53bec031383b6180f55cfe323bd89753e616d5979f51ddad9071ba3a4929
-
Filesize
1024KB
-
Filesize
180KB
-
Filesize
104KB
-
Filesize
5.6MB
-
Filesize
39.7MB
-
Filesize
96KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
7.7MB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
39.7MB
-
Filesize
7.7MB
-
Filesize
240KB
-
Filesize
1024KB
-
Filesize
232KB
-
Filesize
212KB
-
Filesize
280KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
39.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
6.1MB
-
Filesize
72KB
-
Filesize
1.0MB
-
Filesize
64KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
1024KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB