Analysis
-
max time kernel
103s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
12-05-2024 03:20
Behavioral task
behavioral1
Sample
PatchGadar.exe
Resource
win10-20240404-en
windows10-1703-x64
7 signatures
1800 seconds
Behavioral task
behavioral2
Sample
PatchGadar.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
1800 seconds
Behavioral task
behavioral3
Sample
PatchGadar.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
9 signatures
1800 seconds
General
-
Target
PatchGadar.exe
-
Size
293KB
-
MD5
edcfedc1c217b5907f6b69272e5ca98f
-
SHA1
e4bb7f3226e809c7ad1e12193ee26048cfc58790
-
SHA256
114ad98c82f045d81f4b456900e650ea316e7dda7a1d8c5396e585488986d6fe
-
SHA512
c1a9d970e7690f60eb1ad0ea85a57c942b31006db8dbbfcc46e1d0e1036ee2957f67ce205eba93b426d78dd6eb8bcf23fb713b3442ae1ab91f59a24ed6e4e626
-
SSDEEP
3072:e3MK0Jc5YQoIpwg9iO2OaiS40eBwYG3zRrYp2OplMGc8A6uHPMG7CUqkZFI0CADL:u2c5YQoI2gzai9kjJkhpuJvYuH
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
resource yara_rule behavioral3/memory/4780-1-0x0000000000C30000-0x0000000000C80000-memory.dmp family_zgrat_v1 -
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule behavioral3/memory/4780-1-0x0000000000C30000-0x0000000000C80000-memory.dmp net_reactor -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 38 IoCs
pid Process 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4576 taskmgr.exe Token: SeSystemProfilePrivilege 4576 taskmgr.exe Token: SeCreateGlobalPrivilege 4576 taskmgr.exe Token: 33 4576 taskmgr.exe Token: SeIncBasePriorityPrivilege 4576 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe 4576 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PatchGadar.exe"C:\Users\Admin\AppData\Local\Temp\PatchGadar.exe"1⤵PID:4780
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4192 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:81⤵PID:4508
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4576
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4788
-
C:\Windows\System32\_iyiwy.exe"C:\Windows\System32\_iyiwy.exe"1⤵PID:1344