Analysis
-
max time kernel
55s -
max time network
49s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
28-04-2024 02:13
General
-
Target
ef52e496deef5f97729b97696c20c43eae3b183ac23711beab021693f37be761.exe
-
Size
830KB
-
MD5
4083c7b8b4ba81bf66179b0b7072bdab
-
SHA1
ee01f16e7fc58dc37d245de797de118f751c0824
-
SHA256
ef52e496deef5f97729b97696c20c43eae3b183ac23711beab021693f37be761
-
SHA512
10d38d5baabe19f331b10a1548fa2d2ef028c16aba087f65595733fd107bcf9524939cbd050aa5501931bf559923cb44ac49c817aea111f0acdefa02af211d92
-
SSDEEP
12288:1gaKDyLliWtG1VXiTtcB9AC0bipbZ3cxRA9JSi6stKSsiblxmPd5R:vGDCt0H01if6VxiZEPd5
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Detect packed .NET executables. Mostly AgentTeslaV4. 1 IoCs
-
Detects executables packed with unregistered version of .NET Reactor 1 IoCs
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef52e496deef5f97729b97696c20c43eae3b183ac23711beab021693f37be761.exe"C:\Users\Admin\AppData\Local\Temp\ef52e496deef5f97729b97696c20c43eae3b183ac23711beab021693f37be761.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
856KB
-
Filesize
7.7MB
-
Filesize
584KB
-
Filesize
64KB
-
Filesize
5.6MB
-
Filesize
624KB
-
Filesize
408KB
-
Filesize
1.8MB
-
Filesize
7.7MB
-
Filesize
320KB
-
Filesize
40KB