Overview

overview

10

Static

static

10

C_RAAS.exe

windows7-x64

10

C_RAAS.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    12-05-2024 01:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    C_RAAS.exe

  • Size

    2.6MB

  • MD5

    2e7d68cbc3752a9b475b76d964c11a03

  • SHA1

    20dc966993d469c3ba30a9731952ad90cae42927

  • SHA256

    39096e9a521ea1c001083d8c82317c8e6dbdd5d705d9a92beb15db102fb87263

  • SHA512

    900178639ff60d82a96fb8995b596ffeb55b8199eb0be5d7e16a236a4864cf1564fb4204a59264de3a2e36e343195604cb23738a45067d4c037596dde1042d89

  • SSDEEP

    49152:Uhl/s9YKOEKuT/s9YEQtQRTMYIMi7ztf33cSywWyFoEgn9u:mVsGKJzsG1tQRjdih8rwc

Score
10/10
zgratransomwareratspywarestealer

Malware Config

Signatures

  • Detect ZGRat V1 1 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • .NET Reactor proctector 1 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Drops startup file 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\C_RAAS.exe
    "C:\Users\Admin\AppData\Local\Temp\C_RAAS.exe"
    1⤵
    • Drops startup file
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2028

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\CURRENT.CashRansomware
    Filesize

    32B

    MD5

    5c412eaaa995acf67959d864090b6862

    SHA1

    5fcbe45112dd401ac857e902093fc3cfafc0daab

    SHA256

    fde3b77b960b729e0b2a44e3b9e6bfc4c708c9a5c895da650256c631d77dbec9

    SHA512

    4fc184eed09650d771c00774dd57233d0c60fc5d8e90c24de1521ed687a867b175706cb205866f52619371241255e30688cc2669464dc07d884cee37f132d853

    Download Submit

  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_2.CashRansomware
    Filesize

    8KB

    MD5

    bfb33fed3d32f6a6f1d41731eb1b7da9

    SHA1

    dc35694fe496da827a78c2fb7f6a25c94b5b941f

    SHA256

    3abd94ea203e84b4e00d07eaae1a7079e78275cec2e608d964dbc464ba8afc97

    SHA512

    e4da2cc343eeb519250ab1399898253a6290d90ee0130ce5ebf3a288176ed7a3480aa90ba4f3a1aee09bb12d0d1e65bfb611ceaccf9d9965f0baeced3e6848df

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\NNULH633\desktop.ini.CashRansomware
    Filesize

    80B

    MD5

    213a720208e39531f9adfe2f547f93bd

    SHA1

    993267df454c3fa51d1ed2c1df54dd95c234fbec

    SHA256

    d09683a79f611ce894de68c5f4ebe33cdea2c2dc147977ec2d40a23cd4287579

    SHA512

    ed9710bc3613062c91f7ca37c200e80f9450ede1eca7f6b982b61b44fb8821400a1f5e26113a95407a5c4088a7d36663c713eece2587c09e22d8ae5990688710

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\MSNBC News~.feed-ms.CashRansomware
    Filesize

    28KB

    MD5

    dd248ea46931d98abc27a5bd9d249cee

    SHA1

    d92859135420799afb4b3a06d7ddf25aa341bd1f

    SHA256

    f51cccc0c914f35cf72707eb67ef9c8a0a39b39abc8c1a19806088e999dff34c

    SHA512

    25911ba098ae7567cfef2988ef42dd310fdd3260edaee8b1f4163e8242e0dd8e5d99244bacfe71858352dd74696e3ba691f0986bea19f33172b592de5672c310

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IEDownloadHistory\container.dat.CashRansomware
    Filesize

    16B

    MD5

    3389b53fe5f0e87ead56e0184897ee5e

    SHA1

    f5567eba83e5e894dd1226ba1b157efca90b96d2

    SHA256

    38f77a27106520ffa17fd3b16e3f0bcde43146b1d618ae0d554161798709ac17

    SHA512

    a5f06b4e5f431d850cfbe9cc8db8f59e17ad3bf4db188940f074fd58bd6847dcd8da89f0de8383ffcebbfe468563ac6a46a9548e482f63352db340874a4b0def

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.CashRansomware
    Filesize

    48KB

    MD5

    1fd616ce9f819f4380642312f68fd920

    SHA1

    a4144e00b6cac7c9add1d3915a3acead73473e62

    SHA256

    a873ffb3a2150584f97afc1edd27f895c0aee8bca9e83fdeedc9469770e47852

    SHA512

    9514cabec9b4413f10cbbe69c4f60ed2c506f092a82bb047846cecbd184b3307619c8e2c42d03a2d66fa307ca7bcb1435d468d61b542686ee7a95c29c7765363

    Download Submit

  • memory/2028-0-0x000007FEF5FA3000-0x000007FEF5FA4000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2028-2-0x000007FEF5FA0000-0x000007FEF698C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2028-1-0x00000000011F0000-0x000000000148A000-memory.dmp

    Filesize

    2.6MB

    Download

  • memory/2028-1193-0x000007FEF5FA0000-0x000007FEF698C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2028-1194-0x000007FEF5FA0000-0x000007FEF698C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2028-1195-0x000007FEF5FA3000-0x000007FEF5FA4000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2028-1196-0x000007FEF5FA0000-0x000007FEF698C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2028-1197-0x000007FEF5FA0000-0x000007FEF698C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2028-1198-0x000007FEF5FA0000-0x000007FEF698C000-memory.dmp

    Filesize

    9.9MB

    Download