Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
05/05/2024, 01:16
General
-
Target
d89a4c3756f842044ad790423cfc72cd0545499f71f5f2a177add6b09eb2cec5.exe
-
Size
66KB
-
MD5
ea88b0b8e02bf86c2a0f3eceaed3443e
-
SHA1
2bc488407a87339a3d32eefb9c1f88e7fd87cd3c
-
SHA256
d89a4c3756f842044ad790423cfc72cd0545499f71f5f2a177add6b09eb2cec5
-
SHA512
a8f48b0acc072f7469ee8649d81e019cad8945a11c6b7a2583c9bee97401589b1b073bb02517c6ec308171d89f9c2a9528a492597990412e8a6992e5c032be74
-
SSDEEP
1536:ybJT7XskGBXK3wDu3Y6Uk9jg+rr6GbOsKpeQiQKWOtnoHei+:MsxBnDud7r6GiX8QiQ/OtD5
Malware Config
Signatures
-
Detect ZGRat V1 35 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d89a4c3756f842044ad790423cfc72cd0545499f71f5f2a177add6b09eb2cec5.exe"C:\Users\Admin\AppData\Local\Temp\d89a4c3756f842044ad790423cfc72cd0545499f71f5f2a177add6b09eb2cec5.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d89a4c3756f842044ad790423cfc72cd0545499f71f5f2a177add6b09eb2cec5.exe"C:\Users\Admin\AppData\Local\Temp\d89a4c3756f842044ad790423cfc72cd0545499f71f5f2a177add6b09eb2cec5.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4108 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5f3eb81974dc5933681e933f07209ff5f
SHA17af8cae0f1d03e82daaf784df9886705685baac7
SHA256e82069884dd428bd6a1c67fe00c5fa56f9c4d62b538b694694a699588f1f4ab2
SHA512d9aa3871dffb76c8a73a7940fa03bbc9b65cf575cbd07f7c1fbf490cb0f3d670415eaef0bf79e34689f61ab3cdfbb104efdef004becc12e54b501f02f948aaff
-
Filesize
148KB
MD590a1d4b55edf36fa8b4cc6974ed7d4c4
SHA1aba1b8d0e05421e7df5982899f626211c3c4b5c1
SHA2567cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c
SHA512ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2
-
Filesize
4KB
-
Filesize
80KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
2.9MB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
304KB
-
Filesize
1.2MB
-
Filesize
336KB
-
Filesize
7.7MB
-
Filesize
864KB
-
Filesize
1.1MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
632KB
-
Filesize
448KB
-
Filesize
40KB
-
Filesize
408KB
-
Filesize
488KB
-
Filesize
7.7MB