Analysis
-
max time kernel
130s -
max time network
138s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
06-05-2024 14:28
General
-
Target
AZURE PROXYLESS CHECKER-noAnti_Slayed.exe
-
Size
2.3MB
-
MD5
5122f846edafa2010c57c3e898b4a12a
-
SHA1
83132f608365e96021fe5d2466e3577d959415c7
-
SHA256
3c21cb1b6a535cbdfc874821b7836516ebd20ab8afb94b3c18636780666ff9ba
-
SHA512
f53a7469c2d00bd9e8949d6eb69ba7e8a3814d631ee1647fb6fc86c6fe6f9160eca68f9777bdc4721a201ec2dc4ad1234ebc6ddf280060edff52af7b6f1a668f
-
SSDEEP
49152:KfhNO/E5yqDpXtWqwK75F5745fzSjoZNQPajoNeOyJuhA:Kfh4s5zhpwKdH7gfzScZt0eOys
Score
10/10
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Suspicious use of SetThreadContext 1 IoCs
-
Program crash 1 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AZURE PROXYLESS CHECKER-noAnti_Slayed.exe"C:\Users\Admin\AppData\Local\Temp\AZURE PROXYLESS CHECKER-noAnti_Slayed.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 5803⤵
- Program crash
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
2.4MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB