Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
12-05-2024 01:56
General
-
Target
zune.exe
-
Size
2.7MB
-
MD5
d395e798b9884b6c1837fe4fe147a3fa
-
SHA1
530ffbe23bbb3f88fb97ff95ef5486d3628776a3
-
SHA256
e1696968ad55e7e03a8334711d90350c4145fb4f60de5fb4a2f5f19187183c05
-
SHA512
30cc4aa9b0e7e6ff85d56a11b2f81e079687d4c2ac87ac72835c15253787fe9b15bd4308ffdb689301b5816f0f3c7fd8f6700b71aa991bf8c066a5f6ba36eb27
-
SSDEEP
49152:Bik3l/s9YcuT/s9YEQtQRTMYIMi7ztf33cSywWyFoEgn9u4:BvVsGfzsG1tQRjdih8rwc
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Drops startup file 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\zune.exe"C:\Users\Admin\AppData\Local\Temp\zune.exe"1⤵
- Drops startup file
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32B
MD50e31d5b1d97b312e06c14d2cd1eb0ddb
SHA11903d7c6c60fe80cffb97ceac784a289637b5bab
SHA256d834fb7528cfa704a6a2381d48df2ef5e923ca543a70c10f39e43b008a19b1c5
SHA512e33a4404103ac8a5c7734c6b4731fc27c3bdc304a5843944637d0deb160b64398e1ce699fcd800a0d0d45025dc5aca3ac239ac15818495792224a8e6b9c68c20
-
Filesize
8KB
MD569bff365c172be59fc79d6ff4b6f543b
SHA1ab69709bcad8e0ffb5dcfb6623128419a84ee9c6
SHA25637a61c17633e78d8f2d7d7614992ea44405648aa5ee53db5b220c7b62e372b26
SHA5124e13bef0bbfd44e2ebe95c2b827e931fc31d6b8fc8b1b937e86f080e9261fc997165987a0c55bce19274038f7e963e01d3d7e5f6d7c7ebd3312783b7d54a7654
-
Filesize
80B
MD525053400700f8f12158b862e5cbf8a1a
SHA132c1fc551ee6e084b5dfb430f8d314a02a6c7cce
SHA2560b9b39fcb1ea99a0fc1baf2218c0dfb272e4cb527c66f45f5bd2d35dab35749c
SHA512707e42d560877961167d7da327da6d05f1ae62e5e6be1483800b64c3ff20ba0c71f9ff054cbb9134cef2144dbd5435a83dc4e5477acd5f0d93f98ae4b9089260
-
Filesize
28KB
MD583c7f9308f489d164d32a158e1951cc1
SHA13eceb9842120a75fe9eee94b169a3b68707c23b6
SHA2561015368c69d0a8b8d8681618b274f8185b71be6759be33dbe7d90adba6dc1b1b
SHA5129cb6ea49f4914dee740f292ee6530e45aadfbd9ed1b27e89a2710108597811111f5dd0a1be12e317b87544906bfd565e9f5a1cc2af5942e5badbb4c36caff946
-
Filesize
16B
MD5fddf02a0b8d16e3d57eede1d26894a19
SHA16e21f47c7dada0a73c41a0c87a9f675e87677687
SHA256f7550859de30138f2649d29fdc771c896a10330b5154d06528f570d7c9b18a62
SHA5124389b7fdf51719842d2ad071941f5ac19068fcc89e0ffe8d23f6eb96577644a3b6b9a59917176c4c6f7174e577c36fe5136dd552533e9b9cbc200bde0eebe44b
-
Filesize
48KB
MD50dd986cfd2380502ab313993b91e900c
SHA1025b02f3602e5f66442cf83c2b087fd20c12110b
SHA2566b735c27dcdc9974779d69f951b1547e40aa09cd94a3add29db0e2cb41b85056
SHA5122cbd9fd621de6f13cd2fb8fe5571be0609c9b286babe0cff5c25036379412c250e202ef6449a12d66b990133129927540233a1090ab1ae1f44c9dcd5c899a614
-
Filesize
4KB
-
Filesize
9.9MB
-
Filesize
2.7MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB