Overview

overview

10

Static

static

10

5525d297a3...79.exe

windows7-x64

10

5525d297a3...79.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    08/05/2024, 01:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    5525d297a346b80912c4f5ec0ac4875e9d49f96d01e52c10df5c064bd803bd79.exe

  • Size

    2.6MB

  • MD5

    33559005506dae5967c8ddeaa8a65f5b

  • SHA1

    0d3c40848c443d4c7dbada45fe976cb9f616c9c2

  • SHA256

    5525d297a346b80912c4f5ec0ac4875e9d49f96d01e52c10df5c064bd803bd79

  • SHA512

    1591fe81d82b18b854299b0ccc72ec2f31208a9ab11afd75047a3d2e3b2ae7931bd412a8401eff57790348ddb5463c31dfc3f870a6c9eef8ef86006b55be7e55

  • SSDEEP

    49152:xDmflSXRl/s9YcuT/s9YEQtQRTMYIMi7ztf33cSywWyFoEgn9u:xDmflEVsGfzsG1tQRjdih8rwc

Score
10/10
zgratransomwareratspywarestealer

Malware Config

Signatures

  • Detect ZGRat V1 1 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs
  • Detects executables packed with unregistered version of .NET Reactor 1 IoCs
  • .NET Reactor proctector 1 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Drops startup file 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5525d297a346b80912c4f5ec0ac4875e9d49f96d01e52c10df5c064bd803bd79.exe
    "C:\Users\Admin\AppData\Local\Temp\5525d297a346b80912c4f5ec0ac4875e9d49f96d01e52c10df5c064bd803bd79.exe"
    1⤵
    • Drops startup file
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1916

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\CURRENT.CashRansomware
    Filesize

    32B

    MD5

    ba92574b102a7d4329ea560d729ab48d

    SHA1

    cb0f07c3460faefc5f2ca5f322c24af8e5314341

    SHA256

    f94dc355fa74a4cfc5834326e93d326c3dc41a4ce1b2774b086056cab9bcf2fc

    SHA512

    a83775c3ee1f00103e9d8f49b1420796e7468d1e3041b252c033111a446cb35be748e0fe7db537ff78dc3971dbf82bf6847bf08765ec4647f1e3698519ae30b6

    Download Submit

  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_2.CashRansomware
    Filesize

    8KB

    MD5

    efd109a7d2ab0bf4781caab1fcedae0f

    SHA1

    d8ddc8d859bb73ced36931fb745214db7160aef9

    SHA256

    5774ddf49633f351809e7868e4eaf81c8c3bba7eb3a8c8d53a7e40c29d322dbe

    SHA512

    396e54829d26c231523269754c10073b9ed05aeb793b66f13ded1e33ccf602363e0d90abf50b77d4f7a4dde2ffa7cd583e2afdf23b9b6f7a7bdf86821497787f

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\QE6QYUAB\desktop.ini.CashRansomware
    Filesize

    80B

    MD5

    a447d92fdf5639e96d301503e0905e1a

    SHA1

    dcdd8a9563ce87306f041be5f97ae6c80486c309

    SHA256

    50f428a339fdc6501c343cff412922c7616a4055eb8c261efc697e52550df199

    SHA512

    2cc04e609b97b634c9c0590dbee13496efc770b95a2abde93b9516f08415fe1692e37ba378ca325574c3be4681f10e8eca53a8529704f8933dae6dee2ee4d5ce

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\MSNBC News~.feed-ms.CashRansomware
    Filesize

    28KB

    MD5

    70f38593070334d9655247d740a21951

    SHA1

    a0227888712753d7a5dea316593a5d2728b50aff

    SHA256

    49d1d1a154881bbb7a8da7c29cf9108f384919343dfb397582877c81678f8c35

    SHA512

    9c7f21b5dc7ceff338fe4c22ea6ae1e058bdca1b916cb0574338a087799904e9adedeb0686a86f46a6e50fc5bb22c6a67190543295455a7458ff6a1fe5231d77

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IEDownloadHistory\container.dat.CashRansomware
    Filesize

    16B

    MD5

    50a93174f8954084a280023364d839a1

    SHA1

    ae1fc24355dea1fb65839950a3b253ec7c7bbb0b

    SHA256

    702b5f38ec78dd8ac99a8e32df99f31d7196de45df07e06dd0096207bd0149c0

    SHA512

    d847d799b9885ed09a3a9041a3760b44db85ac64767a8e2815c9a15f57da9ce3e93171e23c5b21fd4cc3e956616398969337a1312f20992a3a39321f3cc786f6

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ty9peokp.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.CashRansomware
    Filesize

    48KB

    MD5

    428ba7a50edbb3a95d7ec7516c962d87

    SHA1

    8fb4786ce94232cf47485a0db0db955f3833b3fa

    SHA256

    d618a86101613438a3c42c86f220fb7e915f4a670a42a1c47619539c206e9386

    SHA512

    e369f36fb235fe137d98caacb1aded0df15f664d80a74358cd306d1f080b19d9b8742cdf19c4966194ce2cb572d0c0d55d40d6a0f186df31426dcf60d1170410

    Download Submit

  • memory/1916-0-0x000007FEF5C93000-0x000007FEF5C94000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1916-2-0x000007FEF5C90000-0x000007FEF667C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/1916-1-0x00000000010E0000-0x000000000137A000-memory.dmp

    Filesize

    2.6MB

    Download

  • memory/1916-1210-0x000007FEF5C90000-0x000007FEF667C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/1916-1211-0x000007FEF5C90000-0x000007FEF667C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/1916-1212-0x000007FEF5C93000-0x000007FEF5C94000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1916-1213-0x000007FEF5C90000-0x000007FEF667C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/1916-1214-0x000007FEF5C90000-0x000007FEF667C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/1916-1215-0x000007FEF5C90000-0x000007FEF667C000-memory.dmp

    Filesize

    9.9MB

    Download