Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
03/05/2024, 12:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eb508c21c59a7fff7924f7243e5949e8.exe
Resource
win7-20240221-en
0 signatures
150 seconds
General
-
Target
eb508c21c59a7fff7924f7243e5949e8.exe
-
Size
545KB
-
MD5
eb508c21c59a7fff7924f7243e5949e8
-
SHA1
8ff01f312f4c37aeb98e6a4afd61aa9dd0fec383
-
SHA256
bc415aafd68de975f42d71ef25868a7de65ddf166a0bb03246243c6d1b0a0af1
-
SHA512
3e5b19768160960710b3d7d198d5a8bc3d040a084ad6a47c1e7f1b03bf780df3886a0c7d8ff58c30f06afc4a136b91eb2841c895c01f0e8020f52b298a9de5e0
-
SSDEEP
12288:/AyIUo5xsD8c/7Oyo8LR9zom3Q3WZaIVir52gPi:9IHLyogR5omUIAv
Malware Config
Signatures
-
Detect ZGRat V1 2 IoCs
resource yara_rule behavioral2/memory/1064-1-0x0000000000400000-0x000000000045C000-memory.dmp family_zgrat_v1 behavioral2/memory/1000-6-0x00000000001B0000-0x0000000000239953-memory.dmp family_zgrat_v1 -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1000 set thread context of 1064 1000 eb508c21c59a7fff7924f7243e5949e8.exe 83 -
Program crash 1 IoCs
pid pid_target Process procid_target 4784 1000 WerFault.exe 82 -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeDebugPrivilege 1064 RegAsm.exe Token: SeBackupPrivilege 1064 RegAsm.exe Token: SeSecurityPrivilege 1064 RegAsm.exe Token: SeSecurityPrivilege 1064 RegAsm.exe Token: SeSecurityPrivilege 1064 RegAsm.exe Token: SeSecurityPrivilege 1064 RegAsm.exe Token: SeBackupPrivilege 1064 RegAsm.exe Token: SeSecurityPrivilege 1064 RegAsm.exe Token: SeSecurityPrivilege 1064 RegAsm.exe Token: SeSecurityPrivilege 1064 RegAsm.exe Token: SeSecurityPrivilege 1064 RegAsm.exe Token: SeBackupPrivilege 1064 RegAsm.exe Token: SeSecurityPrivilege 1064 RegAsm.exe Token: SeSecurityPrivilege 1064 RegAsm.exe Token: SeSecurityPrivilege 1064 RegAsm.exe Token: SeSecurityPrivilege 1064 RegAsm.exe Token: SeBackupPrivilege 1064 RegAsm.exe Token: SeSecurityPrivilege 1064 RegAsm.exe Token: SeSecurityPrivilege 1064 RegAsm.exe Token: SeSecurityPrivilege 1064 RegAsm.exe Token: SeSecurityPrivilege 1064 RegAsm.exe Token: SeBackupPrivilege 1064 RegAsm.exe Token: SeSecurityPrivilege 1064 RegAsm.exe Token: SeSecurityPrivilege 1064 RegAsm.exe Token: SeSecurityPrivilege 1064 RegAsm.exe Token: SeSecurityPrivilege 1064 RegAsm.exe Token: SeBackupPrivilege 1064 RegAsm.exe Token: SeSecurityPrivilege 1064 RegAsm.exe Token: SeSecurityPrivilege 1064 RegAsm.exe Token: SeSecurityPrivilege 1064 RegAsm.exe Token: SeSecurityPrivilege 1064 RegAsm.exe Token: SeBackupPrivilege 1064 RegAsm.exe Token: SeSecurityPrivilege 1064 RegAsm.exe Token: SeSecurityPrivilege 1064 RegAsm.exe Token: SeSecurityPrivilege 1064 RegAsm.exe Token: SeSecurityPrivilege 1064 RegAsm.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1000 wrote to memory of 1064 1000 eb508c21c59a7fff7924f7243e5949e8.exe 83 PID 1000 wrote to memory of 1064 1000 eb508c21c59a7fff7924f7243e5949e8.exe 83 PID 1000 wrote to memory of 1064 1000 eb508c21c59a7fff7924f7243e5949e8.exe 83 PID 1000 wrote to memory of 1064 1000 eb508c21c59a7fff7924f7243e5949e8.exe 83 PID 1000 wrote to memory of 1064 1000 eb508c21c59a7fff7924f7243e5949e8.exe 83 PID 1000 wrote to memory of 1064 1000 eb508c21c59a7fff7924f7243e5949e8.exe 83 PID 1000 wrote to memory of 1064 1000 eb508c21c59a7fff7924f7243e5949e8.exe 83 PID 1000 wrote to memory of 1064 1000 eb508c21c59a7fff7924f7243e5949e8.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb508c21c59a7fff7924f7243e5949e8.exe"C:\Users\Admin\AppData\Local\Temp\eb508c21c59a7fff7924f7243e5949e8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1064
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 2762⤵
- Program crash
PID:4784
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1000 -ip 10001⤵PID:2980