Analysis

  • max time kernel
    143s
  • max time network
    112s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-05-2024 14:29

General

  • Target

    7dbf05d83f893a3fd85e266599155069e13d532333012d62fa0a41a625878965.exe

  • Size

    1.2MB

  • MD5

    0ebc98820c6a15e86629ecbf82323a08

  • SHA1

    2e443367c537780f39c92d70903bc500876b8f52

  • SHA256

    7dbf05d83f893a3fd85e266599155069e13d532333012d62fa0a41a625878965

  • SHA512

    8c0d1786416a52444f8920db9ed9900dd902c388519dc9045601f599308adae01cf7592b2dfe81119bcc992b2dae432c6e6df26d6ec739a3a9e3d1d836503b4b

  • SSDEEP

    12288:GWbqxxv297HF1HLZVrS5WPMkD+gaxMaRnoN7vhkmUuGZaU0M9cmyel8ePTtYOJeY:Vbqx5297HFpZVrMWP3DpaS1bUZjPSO

Malware Config

Signatures

  • Detect ZGRat V1 1 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7dbf05d83f893a3fd85e266599155069e13d532333012d62fa0a41a625878965.exe
    "C:\Users\Admin\AppData\Local\Temp\7dbf05d83f893a3fd85e266599155069e13d532333012d62fa0a41a625878965.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2344
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4172
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 336
      2⤵
      • Program crash
      PID:536
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2344 -ip 2344
    1⤵
      PID:1844

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Credential Access

    Unsecured Credentials

    2
    T1552

    Credentials In Files

    2
    T1552.001

    Discovery

    Query Registry

    1
    T1012

    Collection

    Data from Local System

    2
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2344-1-0x0000000000542000-0x0000000000543000-memory.dmp
      Filesize

      4KB

    • memory/4172-0-0x0000000000400000-0x000000000044A000-memory.dmp
      Filesize

      296KB

    • memory/4172-2-0x0000000074B5E000-0x0000000074B5F000-memory.dmp
      Filesize

      4KB

    • memory/4172-3-0x0000000005550000-0x0000000005AF4000-memory.dmp
      Filesize

      5.6MB

    • memory/4172-4-0x0000000004FA0000-0x0000000005032000-memory.dmp
      Filesize

      584KB

    • memory/4172-5-0x0000000074B50000-0x0000000075300000-memory.dmp
      Filesize

      7.7MB

    • memory/4172-6-0x0000000004F60000-0x0000000004F6A000-memory.dmp
      Filesize

      40KB

    • memory/4172-7-0x00000000065B0000-0x0000000006BC8000-memory.dmp
      Filesize

      6.1MB

    • memory/4172-8-0x00000000060E0000-0x00000000061EA000-memory.dmp
      Filesize

      1.0MB

    • memory/4172-9-0x0000000006010000-0x0000000006022000-memory.dmp
      Filesize

      72KB

    • memory/4172-10-0x0000000006070000-0x00000000060AC000-memory.dmp
      Filesize

      240KB

    • memory/4172-11-0x00000000061F0000-0x000000000623C000-memory.dmp
      Filesize

      304KB

    • memory/4172-12-0x0000000006370000-0x00000000063D6000-memory.dmp
      Filesize

      408KB

    • memory/4172-13-0x0000000006CD0000-0x0000000006D46000-memory.dmp
      Filesize

      472KB

    • memory/4172-14-0x0000000005E00000-0x0000000005E1E000-memory.dmp
      Filesize

      120KB

    • memory/4172-15-0x0000000008150000-0x0000000008312000-memory.dmp
      Filesize

      1.8MB

    • memory/4172-16-0x0000000008850000-0x0000000008D7C000-memory.dmp
      Filesize

      5.2MB

    • memory/4172-18-0x0000000074B50000-0x0000000075300000-memory.dmp
      Filesize

      7.7MB