Analysis
-
max time kernel
131s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09-05-2024 09:48
Static task
static1
Behavioral task
behavioral1
Sample
39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe
Resource
win10v2004-20240508-en
General
-
Target
39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe
-
Size
145KB
-
MD5
115b5aae8c9a24258d28bfb74f638ac8
-
SHA1
3265a76ab3e92e5d77336427f3d6892fcb0d9cf7
-
SHA256
39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a
-
SHA512
2a8237a4b0f8dfcd6bce208a8b9a096f32edfe8de71ceb35e8bd842ffcc22dceae723c5270e766ab9f10f27e288344dd70d7f66b841cb828d21dcb313d8d058a
-
SSDEEP
1536:PezR1zewFnNK7GRvKVnnatIl6X0QnX3OON8UbBGk0:PI1zDFMQvynnatC6dW2h0
Malware Config
Signatures
-
Detect ZGRat V1 35 IoCs
Processes:
resource yara_rule behavioral2/memory/4372-4-0x0000000007630000-0x000000000791C000-memory.dmp family_zgrat_v1 behavioral2/memory/4372-14-0x0000000007630000-0x0000000007916000-memory.dmp family_zgrat_v1 behavioral2/memory/4372-18-0x0000000007630000-0x0000000007916000-memory.dmp family_zgrat_v1 behavioral2/memory/4372-24-0x0000000007630000-0x0000000007916000-memory.dmp family_zgrat_v1 behavioral2/memory/4372-30-0x0000000007630000-0x0000000007916000-memory.dmp family_zgrat_v1 behavioral2/memory/4372-40-0x0000000007630000-0x0000000007916000-memory.dmp family_zgrat_v1 behavioral2/memory/4372-70-0x0000000007630000-0x0000000007916000-memory.dmp family_zgrat_v1 behavioral2/memory/4372-66-0x0000000007630000-0x0000000007916000-memory.dmp family_zgrat_v1 behavioral2/memory/4372-64-0x0000000007630000-0x0000000007916000-memory.dmp family_zgrat_v1 behavioral2/memory/4372-62-0x0000000007630000-0x0000000007916000-memory.dmp family_zgrat_v1 behavioral2/memory/4372-60-0x0000000007630000-0x0000000007916000-memory.dmp family_zgrat_v1 behavioral2/memory/4372-58-0x0000000007630000-0x0000000007916000-memory.dmp family_zgrat_v1 behavioral2/memory/4372-56-0x0000000007630000-0x0000000007916000-memory.dmp family_zgrat_v1 behavioral2/memory/4372-68-0x0000000007630000-0x0000000007916000-memory.dmp family_zgrat_v1 behavioral2/memory/4372-54-0x0000000007630000-0x0000000007916000-memory.dmp family_zgrat_v1 behavioral2/memory/4372-52-0x0000000007630000-0x0000000007916000-memory.dmp family_zgrat_v1 behavioral2/memory/4372-50-0x0000000007630000-0x0000000007916000-memory.dmp family_zgrat_v1 behavioral2/memory/4372-48-0x0000000007630000-0x0000000007916000-memory.dmp family_zgrat_v1 behavioral2/memory/4372-46-0x0000000007630000-0x0000000007916000-memory.dmp family_zgrat_v1 behavioral2/memory/4372-44-0x0000000007630000-0x0000000007916000-memory.dmp family_zgrat_v1 behavioral2/memory/4372-42-0x0000000007630000-0x0000000007916000-memory.dmp family_zgrat_v1 behavioral2/memory/4372-38-0x0000000007630000-0x0000000007916000-memory.dmp family_zgrat_v1 behavioral2/memory/4372-36-0x0000000007630000-0x0000000007916000-memory.dmp family_zgrat_v1 behavioral2/memory/4372-34-0x0000000007630000-0x0000000007916000-memory.dmp family_zgrat_v1 behavioral2/memory/4372-32-0x0000000007630000-0x0000000007916000-memory.dmp family_zgrat_v1 behavioral2/memory/4372-26-0x0000000007630000-0x0000000007916000-memory.dmp family_zgrat_v1 behavioral2/memory/4372-28-0x0000000007630000-0x0000000007916000-memory.dmp family_zgrat_v1 behavioral2/memory/4372-22-0x0000000007630000-0x0000000007916000-memory.dmp family_zgrat_v1 behavioral2/memory/4372-16-0x0000000007630000-0x0000000007916000-memory.dmp family_zgrat_v1 behavioral2/memory/4372-20-0x0000000007630000-0x0000000007916000-memory.dmp family_zgrat_v1 behavioral2/memory/4372-12-0x0000000007630000-0x0000000007916000-memory.dmp family_zgrat_v1 behavioral2/memory/4372-10-0x0000000007630000-0x0000000007916000-memory.dmp family_zgrat_v1 behavioral2/memory/4372-8-0x0000000007630000-0x0000000007916000-memory.dmp family_zgrat_v1 behavioral2/memory/4372-7-0x0000000007630000-0x0000000007916000-memory.dmp family_zgrat_v1 behavioral2/memory/1444-7190-0x0000000005A60000-0x0000000005AD0000-memory.dmp family_zgrat_v1 -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\notepad = "C:\\Users\\Admin\\AppData\\Roaming\\notepad.exe" 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exedescription pid Process procid_target PID 4372 set thread context of 1444 4372 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe 94 -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exepid Process 1444 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe 1444 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe 1444 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe 1444 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe 1444 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe 1444 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe 1444 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe 1444 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe 1444 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe 1444 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exedescription pid Process Token: SeDebugPrivilege 4372 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Token: SeDebugPrivilege 4372 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe Token: SeDebugPrivilege 1444 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exedescription pid Process procid_target PID 4372 wrote to memory of 1444 4372 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe 94 PID 4372 wrote to memory of 1444 4372 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe 94 PID 4372 wrote to memory of 1444 4372 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe 94 PID 4372 wrote to memory of 1444 4372 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe 94 PID 4372 wrote to memory of 1444 4372 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe 94 PID 4372 wrote to memory of 1444 4372 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe 94 PID 4372 wrote to memory of 1444 4372 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe 94 PID 4372 wrote to memory of 1444 4372 39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe"C:\Users\Admin\AppData\Local\Temp\39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe"C:\Users\Admin\AppData\Local\Temp\39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3960,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:81⤵PID:1944
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe.log
Filesize1KB
MD5f3eb81974dc5933681e933f07209ff5f
SHA17af8cae0f1d03e82daaf784df9886705685baac7
SHA256e82069884dd428bd6a1c67fe00c5fa56f9c4d62b538b694694a699588f1f4ab2
SHA512d9aa3871dffb76c8a73a7940fa03bbc9b65cf575cbd07f7c1fbf490cb0f3d670415eaef0bf79e34689f61ab3cdfbb104efdef004becc12e54b501f02f948aaff
-
Filesize
152KB
MD573bd1e15afb04648c24593e8ba13e983
SHA14dd85ca46fcdf9d93f6b324f8bb0b5bb512a1b91
SHA256aab0b201f392fef9fdff09e56a9d0ac33d0f68be95da270e6dab89bb1f971d8b
SHA5126eb58fb41691894045569085bd64a83acd62277575ab002cf73d729bda4b6d43c36643a5fa336342e87a493326337ed43b8e5eaeae32f53210714699cb8dfac7