Analysis

  • max time kernel
    131s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-05-2024 09:48

General

  • Target

    39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe

  • Size

    145KB

  • MD5

    115b5aae8c9a24258d28bfb74f638ac8

  • SHA1

    3265a76ab3e92e5d77336427f3d6892fcb0d9cf7

  • SHA256

    39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a

  • SHA512

    2a8237a4b0f8dfcd6bce208a8b9a096f32edfe8de71ceb35e8bd842ffcc22dceae723c5270e766ab9f10f27e288344dd70d7f66b841cb828d21dcb313d8d058a

  • SSDEEP

    1536:PezR1zewFnNK7GRvKVnnatIl6X0QnX3OON8UbBGk0:PI1zDFMQvynnatC6dW2h0

Malware Config

Signatures

  • Detect ZGRat V1 35 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe
    "C:\Users\Admin\AppData\Local\Temp\39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4372
    • C:\Users\Admin\AppData\Local\Temp\39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe
      "C:\Users\Admin\AppData\Local\Temp\39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1444
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3960,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:8
    1⤵
      PID:1944

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe.log

      Filesize

      1KB

      MD5

      f3eb81974dc5933681e933f07209ff5f

      SHA1

      7af8cae0f1d03e82daaf784df9886705685baac7

      SHA256

      e82069884dd428bd6a1c67fe00c5fa56f9c4d62b538b694694a699588f1f4ab2

      SHA512

      d9aa3871dffb76c8a73a7940fa03bbc9b65cf575cbd07f7c1fbf490cb0f3d670415eaef0bf79e34689f61ab3cdfbb104efdef004becc12e54b501f02f948aaff

    • C:\Users\Admin\AppData\Local\Temp\Nlsipd.tmpdb

      Filesize

      152KB

      MD5

      73bd1e15afb04648c24593e8ba13e983

      SHA1

      4dd85ca46fcdf9d93f6b324f8bb0b5bb512a1b91

      SHA256

      aab0b201f392fef9fdff09e56a9d0ac33d0f68be95da270e6dab89bb1f971d8b

      SHA512

      6eb58fb41691894045569085bd64a83acd62277575ab002cf73d729bda4b6d43c36643a5fa336342e87a493326337ed43b8e5eaeae32f53210714699cb8dfac7

    • memory/1444-4897-0x00000000743C0000-0x0000000074B70000-memory.dmp

      Filesize

      7.7MB

    • memory/1444-4898-0x0000000005500000-0x0000000005616000-memory.dmp

      Filesize

      1.1MB

    • memory/1444-4895-0x0000000000400000-0x00000000004D8000-memory.dmp

      Filesize

      864KB

    • memory/1444-7189-0x0000000005730000-0x00000000057CE000-memory.dmp

      Filesize

      632KB

    • memory/1444-7223-0x00000000743C0000-0x0000000074B70000-memory.dmp

      Filesize

      7.7MB

    • memory/1444-7193-0x0000000007140000-0x00000000071BA000-memory.dmp

      Filesize

      488KB

    • memory/1444-7192-0x0000000006100000-0x0000000006166000-memory.dmp

      Filesize

      408KB

    • memory/1444-7191-0x0000000005EF0000-0x0000000005EFA000-memory.dmp

      Filesize

      40KB

    • memory/1444-7190-0x0000000005A60000-0x0000000005AD0000-memory.dmp

      Filesize

      448KB

    • memory/4372-48-0x0000000007630000-0x0000000007916000-memory.dmp

      Filesize

      2.9MB

    • memory/4372-34-0x0000000007630000-0x0000000007916000-memory.dmp

      Filesize

      2.9MB

    • memory/4372-18-0x0000000007630000-0x0000000007916000-memory.dmp

      Filesize

      2.9MB

    • memory/4372-24-0x0000000007630000-0x0000000007916000-memory.dmp

      Filesize

      2.9MB

    • memory/4372-30-0x0000000007630000-0x0000000007916000-memory.dmp

      Filesize

      2.9MB

    • memory/4372-40-0x0000000007630000-0x0000000007916000-memory.dmp

      Filesize

      2.9MB

    • memory/4372-70-0x0000000007630000-0x0000000007916000-memory.dmp

      Filesize

      2.9MB

    • memory/4372-66-0x0000000007630000-0x0000000007916000-memory.dmp

      Filesize

      2.9MB

    • memory/4372-64-0x0000000007630000-0x0000000007916000-memory.dmp

      Filesize

      2.9MB

    • memory/4372-62-0x0000000007630000-0x0000000007916000-memory.dmp

      Filesize

      2.9MB

    • memory/4372-60-0x0000000007630000-0x0000000007916000-memory.dmp

      Filesize

      2.9MB

    • memory/4372-58-0x0000000007630000-0x0000000007916000-memory.dmp

      Filesize

      2.9MB

    • memory/4372-56-0x0000000007630000-0x0000000007916000-memory.dmp

      Filesize

      2.9MB

    • memory/4372-68-0x0000000007630000-0x0000000007916000-memory.dmp

      Filesize

      2.9MB

    • memory/4372-54-0x0000000007630000-0x0000000007916000-memory.dmp

      Filesize

      2.9MB

    • memory/4372-52-0x0000000007630000-0x0000000007916000-memory.dmp

      Filesize

      2.9MB

    • memory/4372-50-0x0000000007630000-0x0000000007916000-memory.dmp

      Filesize

      2.9MB

    • memory/4372-6-0x0000000007B70000-0x0000000007C02000-memory.dmp

      Filesize

      584KB

    • memory/4372-46-0x0000000007630000-0x0000000007916000-memory.dmp

      Filesize

      2.9MB

    • memory/4372-44-0x0000000007630000-0x0000000007916000-memory.dmp

      Filesize

      2.9MB

    • memory/4372-42-0x0000000007630000-0x0000000007916000-memory.dmp

      Filesize

      2.9MB

    • memory/4372-38-0x0000000007630000-0x0000000007916000-memory.dmp

      Filesize

      2.9MB

    • memory/4372-36-0x0000000007630000-0x0000000007916000-memory.dmp

      Filesize

      2.9MB

    • memory/4372-14-0x0000000007630000-0x0000000007916000-memory.dmp

      Filesize

      2.9MB

    • memory/4372-32-0x0000000007630000-0x0000000007916000-memory.dmp

      Filesize

      2.9MB

    • memory/4372-26-0x0000000007630000-0x0000000007916000-memory.dmp

      Filesize

      2.9MB

    • memory/4372-28-0x0000000007630000-0x0000000007916000-memory.dmp

      Filesize

      2.9MB

    • memory/4372-22-0x0000000007630000-0x0000000007916000-memory.dmp

      Filesize

      2.9MB

    • memory/4372-16-0x0000000007630000-0x0000000007916000-memory.dmp

      Filesize

      2.9MB

    • memory/4372-20-0x0000000007630000-0x0000000007916000-memory.dmp

      Filesize

      2.9MB

    • memory/4372-12-0x0000000007630000-0x0000000007916000-memory.dmp

      Filesize

      2.9MB

    • memory/4372-10-0x0000000007630000-0x0000000007916000-memory.dmp

      Filesize

      2.9MB

    • memory/4372-8-0x0000000007630000-0x0000000007916000-memory.dmp

      Filesize

      2.9MB

    • memory/4372-7-0x0000000007630000-0x0000000007916000-memory.dmp

      Filesize

      2.9MB

    • memory/4372-4887-0x00000000743C0000-0x0000000074B70000-memory.dmp

      Filesize

      7.7MB

    • memory/4372-4888-0x0000000005A60000-0x0000000005B88000-memory.dmp

      Filesize

      1.2MB

    • memory/4372-5-0x0000000007F10000-0x00000000084B4000-memory.dmp

      Filesize

      5.6MB

    • memory/4372-4-0x0000000007630000-0x000000000791C000-memory.dmp

      Filesize

      2.9MB

    • memory/4372-3-0x00000000743C0000-0x0000000074B70000-memory.dmp

      Filesize

      7.7MB

    • memory/4372-2-0x00000000053E0000-0x00000000053E6000-memory.dmp

      Filesize

      24KB

    • memory/4372-1-0x0000000000830000-0x0000000000856000-memory.dmp

      Filesize

      152KB

    • memory/4372-0-0x00000000743CE000-0x00000000743CF000-memory.dmp

      Filesize

      4KB

    • memory/4372-4889-0x0000000005C90000-0x0000000005CDC000-memory.dmp

      Filesize

      304KB

    • memory/4372-4890-0x0000000006100000-0x0000000006154000-memory.dmp

      Filesize

      336KB

    • memory/4372-4896-0x00000000743C0000-0x0000000074B70000-memory.dmp

      Filesize

      7.7MB