Analysis

  • max time kernel
    65s
  • max time network
    74s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/05/2024, 00:06

General

  • Target

    OwnCheat/OwnCheat.exe

  • Size

    433KB

  • MD5

    7e46d11cc986f86dc1210adfc6f51248

  • SHA1

    89823c4faf48f75c9578c2e31367bd2d0fd7225a

  • SHA256

    af8c537868eae76c5616f69dde5d25fa0ac00d9ac60d3afc0eff574830f5c123

  • SHA512

    61f4e103115ae908a68ac001d7e73d600ea727646c6daeff0474a6f18102ee70de67e145875827a70a0f7a47138eb55724c266252aa792ef514994328a8aed4d

  • SSDEEP

    12288:vAmzq9FyLqvk/5c1bTmsygfKKP8EQi8vrm:vAm+6q+sK/gSbiY

Malware Config

Signatures

  • Detect ZGRat V1 1 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\OwnCheat\OwnCheat.exe
    "C:\Users\Admin\AppData\Local\Temp\OwnCheat\OwnCheat.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4440
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4784
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:1004

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/4440-0-0x0000000000EBA000-0x0000000000EBB000-memory.dmp

            Filesize

            4KB

          • memory/4784-1-0x0000000000400000-0x000000000044A000-memory.dmp

            Filesize

            296KB

          • memory/4784-3-0x0000000074C3E000-0x0000000074C3F000-memory.dmp

            Filesize

            4KB

          • memory/4784-4-0x0000000005860000-0x0000000005E04000-memory.dmp

            Filesize

            5.6MB

          • memory/4784-5-0x0000000005350000-0x00000000053E2000-memory.dmp

            Filesize

            584KB

          • memory/4784-6-0x0000000074C30000-0x00000000753E0000-memory.dmp

            Filesize

            7.7MB

          • memory/4784-7-0x00000000052B0000-0x00000000052BA000-memory.dmp

            Filesize

            40KB

          • memory/4784-8-0x00000000068C0000-0x0000000006ED8000-memory.dmp

            Filesize

            6.1MB

          • memory/4784-9-0x0000000006420000-0x000000000652A000-memory.dmp

            Filesize

            1.0MB

          • memory/4784-10-0x0000000006350000-0x0000000006362000-memory.dmp

            Filesize

            72KB

          • memory/4784-11-0x00000000063B0000-0x00000000063EC000-memory.dmp

            Filesize

            240KB

          • memory/4784-12-0x0000000006530000-0x000000000657C000-memory.dmp

            Filesize

            304KB

          • memory/4784-13-0x00000000066B0000-0x0000000006716000-memory.dmp

            Filesize

            408KB

          • memory/4784-14-0x0000000007060000-0x00000000070D6000-memory.dmp

            Filesize

            472KB

          • memory/4784-15-0x0000000006110000-0x000000000612E000-memory.dmp

            Filesize

            120KB

          • memory/4784-16-0x0000000007470000-0x0000000007632000-memory.dmp

            Filesize

            1.8MB

          • memory/4784-17-0x00000000088F0000-0x0000000008E1C000-memory.dmp

            Filesize

            5.2MB

          • memory/4784-19-0x0000000074C30000-0x00000000753E0000-memory.dmp

            Filesize

            7.7MB