Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
01-05-2024 22:16
General
-
Target
5ed90a1f4d5e30a6a6d8a3d8aa3f84d875c0527d59ac4ef2cf549e829fb4a0b5.exe
-
Size
690KB
-
MD5
ad4014cc2568c355da9f9f860d6c42e4
-
SHA1
296377a589dab944f543eeb8433b29d957b22d4a
-
SHA256
5ed90a1f4d5e30a6a6d8a3d8aa3f84d875c0527d59ac4ef2cf549e829fb4a0b5
-
SHA512
ea71866536a8200be49e0edcc86e5cb78a1844692f97bb19f7d62008201babc6fdae26218be186375aea7d5d6c2897e7e81724b0481aec7897c7e3e2aa2c350b
-
SSDEEP
12288:cy90wPk7S6Fq6asuoGcOSsQV7vhmzWGM0/S2XB1wldCikLNUZNvoa:cyGXq6asuornNPGM0a2KgiK4Rn
Malware Config
Signatures
-
Detect ZGRat V1 20 IoCs
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 17 IoCs
-
Detects executables packed with ConfuserEx Mod 20 IoCs
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ed90a1f4d5e30a6a6d8a3d8aa3f84d875c0527d59ac4ef2cf549e829fb4a0b5.exe"C:\Users\Admin\AppData\Local\Temp\5ed90a1f4d5e30a6a6d8a3d8aa3f84d875c0527d59ac4ef2cf549e829fb4a0b5.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un084450.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un084450.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\12869306.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\12869306.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 10844⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk622902.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk622902.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3520 -ip 35201⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
536KB
MD5dae959df45789f5b236e3a40afc1e883
SHA14402007f23f98aef46561ae692ee621f385f9515
SHA25635a069bcc4a210210de2b15c982322ef0d0811245a9672686c4e03c413f38b90
SHA5122aaa3bca7dfccb6d4deecb85d3d8f34bac9ffd4b66cba9f5b8282079aa67a0b6b443a7eb1a5cdc2210df67be9e1f68d01ae1dd5068944053cd4f4d328284c4d3
-
Filesize
259KB
MD5ecae5f726f6cce6e2cd107f5cd4dfa1f
SHA11c7e13eb906e6228f9c4e20de78e25377a397b9c
SHA25637a9dab840d162807b33e936f86438dbeab8e05cf443db80b01d2ebb39f22569
SHA512e891aa12a70f05105fb2139196a6ca0614c851ed4b8c4b20ae32cbb98b2167eb0058c53f28ec1f44be587b2a5d3007f3e327f91aea22459e253e4c9f542611e5
-
Filesize
341KB
MD5adf4151b56d6dd60291ebeabf8ba48c2
SHA1478fc6ea02c926dbe947840c6d15e176ee314a63
SHA25621e115253f2f66729e3e31c0484d8a9d2dc9ed08701d84fe382fac0ebab07d76
SHA5123a1b5e5c39de91267b80a4d3d2dab007f8f83d169e5fd765c38861a5eb4d249ba1aa245a7cb8093b54f5e997d8b39d7ddcda302496dc50e6b9b138c2bcb898d1
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
304KB
-
Filesize
240KB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
232KB
-
Filesize
6.1MB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
240KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
340KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
180KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
1024KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
96KB
-
Filesize
5.6MB
-
Filesize
104KB
-
Filesize
340KB