Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
02-05-2024 05:45
General
-
Target
f90a36f4d63973328f1e9574dd259c401f253e2c98a57bbb2f05d728dcb42b3c.exe
-
Size
536KB
-
MD5
946ce9bbd3ec2564134ccde23c3870ad
-
SHA1
2053c03eb99bd9f97bf87cc2dae1d6e37e46aa8e
-
SHA256
f90a36f4d63973328f1e9574dd259c401f253e2c98a57bbb2f05d728dcb42b3c
-
SHA512
fa9e9c13356caaf47cd2548959ce3c376d3a865978885ac8f2c5355a680ea203517c4f2b2b830e05fe3cf5cc290d26ed5020fc3beee7357887509362ba7c5ce1
-
SSDEEP
12288:Ty90g489FMFZjIj6vXfEuixQUqr0DB62am9ElY:TyE89RgXMHRpA2aAElY
Malware Config
Signatures
-
Detect ZGRat V1 20 IoCs
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 17 IoCs
-
Detects executables packed with ConfuserEx Mod 20 IoCs
-
Executes dropped EXE 2 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f90a36f4d63973328f1e9574dd259c401f253e2c98a57bbb2f05d728dcb42b3c.exe"C:\Users\Admin\AppData\Local\Temp\f90a36f4d63973328f1e9574dd259c401f253e2c98a57bbb2f05d728dcb42b3c.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\04447002.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\04447002.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 11003⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rk664141.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rk664141.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3636 -ip 36361⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
259KB
MD570fad5d9c3ad01581c79278f9c66d972
SHA1fb09bd9838bb98426271705ddd7a0f0c9e2584f3
SHA2562ebcf392616d2eb2128f1cce9f537dfc98783d1595806ac0be0959fea856211c
SHA51249c6550cde46e643754ea13bf8bfce59724e42cca08753956297f25b604d5ca89866718c66f1cc750158805fc7c74eb2f635bbb95d7d0049cbf0048813da60d8
-
Filesize
341KB
MD53ea494f11fa64d263fa40ef7b07c6c52
SHA1f44d0431f2a36645701e4b04509eaeb946e8e7e7
SHA25629779782e75937b7bb2e85096c1ee4b3a7db913b0b2991c583bb2e8918c8541c
SHA5124c1ba94a57ed4ec18be4ab91805eb574016e64953105d06c4ebf754f56411b03f7b475901a98e5f7e16885035618bedc01f79bf035adc33d9215359802530ff5
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
304KB
-
Filesize
232KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
424KB
-
Filesize
72KB
-
Filesize
6.1MB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
424KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
1.0MB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
424KB
-
Filesize
76KB
-
Filesize
104KB
-
Filesize
5.6MB
-
Filesize
180KB
-
Filesize
192KB
-
Filesize
340KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
192KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
1024KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
96KB
-
Filesize
340KB