Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
12-05-2024 01:57
General
-
Target
CashKamera.exe
-
Size
2.7MB
-
MD5
69cc2e20ea7a51666b8c14be90441073
-
SHA1
6a3c7d3267c5c2a679f5f41dff36c091dccfb337
-
SHA256
958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24
-
SHA512
de565813d0ddfe491c367e78b2a11891a73859a04efd83d8f35a4a6f6a028a29c873750dc863d1dfca9c40f9b4778cb1882bf8c07b9609f8463db22ac912922a
-
SSDEEP
49152:nsul/s9YiZYGuT/s9YEQtQRTMYIMi7ztf33cSywWyFoEgn9uw:nJVsG+YRzsG1tQRjdih8rwcr
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Drops startup file 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\CashKamera.exe"C:\Users\Admin\AppData\Local\Temp\CashKamera.exe"1⤵
- Drops startup file
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32B
MD56fefbb5355df68dc4e958c1f3e922c26
SHA1eb1fbb8a3a0a860b0deae89ac4f2647977aab664
SHA256648975aaa9c915b6a28effad47978f5a556f05f5139f2fd4e343e76aa802396e
SHA51220f50304af4a3fae7aa526790a1f95e0f371ebefe917ce53345ae61243b2e1ffc91679c18f3d3d80db2623fa18d44cfdb8a2ba6594c7c8497e748bfe24ba75e1
-
Filesize
8KB
MD5d796a44a789404336091c94859d8d61f
SHA1b4f95ecc6d9d07332cda87bd2c37f96548d3cd75
SHA256db22655fc131ec899efe54ecf5a68d0fb24d82ecfb2a84778b898cafa25cf6f5
SHA51232ed204e5b929d929050ee144abac1c5df5cf8076514d601c1f5feb76bce56d410bf1556149c8ca9ea464c92c1bb0bd8ca24162ce0bb33746b7aaecf0b765f85
-
Filesize
80B
MD5ec49562d4ef3e3cc82fb7b7cb46ea082
SHA1ea525b2b8aea07c76ffa4ebc173064f651bb4b58
SHA256bd955be201a2b355285fe95b18681cc46b9178e997fc4194deb8c7e6a6e7ea9f
SHA512901d11933f8aaca9cf9bafe581b75a0aae2c012a6b54732d331fd63bd08b6975d2d8aa09fdea1cabd37e80ea5572649225a5830a52578f46ab22edb669a40827
-
Filesize
28KB
MD5b6b577acf0fd74901e9976e549d17cd8
SHA1513ad0fc353dead6a7e70ffb0d5faae1ac7c515d
SHA256dfa3aec11b0d7f85aea1bf0ec4ae4c1069a059cd62b760d9529e07bf680840e7
SHA512aea94b2931470b2320891139276bbc90d54224002e39d0e507768b3bde2a8ef74ae547a9395b3d402ed7ab1e0d224490bc79dc068a3686cb5c7faef38e6088f1
-
Filesize
16B
MD5e70033a077f3e3d436d9fdc308f042a0
SHA1130aaddaa3dddd72eb25311cdf2dd80016642764
SHA256b437dd27a0b2c33c4e35c2d8bd1c7d357b84a6e7c8c476d6f73f504a3a99b729
SHA5125c8e2aecfc7b030f2797d9c2415e7be3d0a97b9ead2e8ce4466d197e5ddd94cd66de9c079ac45d63b7dc1cb5fbb87a65665088804db6c02751ee9c75e9515b74
-
Filesize
48KB
MD5f4fb714967aa4a966271cb6e0e8df5cd
SHA13e31ee89b99737d3d40b0b2095752e750bb57763
SHA256f8466f600c4c86ae8e0501ee3e16d13ed768f06bc78c2ce94f2ba7a957437276
SHA512ad423811225d7d3223a52911b4c8d7e4c1f34ac31f38e102a18ad2d83fb533b8b26a0ec6872633dd4f17d0e69bc003fc171f9338607b46b64ea3eb375bcde290
-
Filesize
4KB
-
Filesize
9.9MB
-
Filesize
2.7MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB