Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
13-05-2024 07:19
Static task
static1
Behavioral task
behavioral1
Sample
f5fe6435df7702338b1320b55f96caa4.exe
Resource
win7-20231129-en
General
-
Target
f5fe6435df7702338b1320b55f96caa4.exe
-
Size
594KB
-
MD5
f5fe6435df7702338b1320b55f96caa4
-
SHA1
fab2bbc6e43cc01217673b2753e223099c3c297f
-
SHA256
3f352445c521895812735acebb5f944cd1e88024cade5b201c562166619ffc9f
-
SHA512
4c355979435dc7519c4e4ee1a9ff6ad4be9cabcaa6b376473b039fcd785837689f16662e680b196f2b74ec689ff894175a2892206f1883e6e22ca89a292a6fab
-
SSDEEP
12288:Ta+kA8UkbVvyhzR8OQtgR64Hh4oPRSviJFwuHnOr387dPex:FFgkh21gR3JSviJFbnOz87dPe
Malware Config
Signatures
-
Detect ZGRat V1 34 IoCs
Processes:
resource yara_rule behavioral1/memory/2372-2-0x00000000010D0000-0x00000000011B8000-memory.dmp family_zgrat_v1 behavioral1/memory/2372-4-0x00000000010D0000-0x00000000011B2000-memory.dmp family_zgrat_v1 behavioral1/memory/2372-29-0x00000000010D0000-0x00000000011B2000-memory.dmp family_zgrat_v1 behavioral1/memory/2372-7-0x00000000010D0000-0x00000000011B2000-memory.dmp family_zgrat_v1 behavioral1/memory/2372-67-0x00000000010D0000-0x00000000011B2000-memory.dmp family_zgrat_v1 behavioral1/memory/2372-9-0x00000000010D0000-0x00000000011B2000-memory.dmp family_zgrat_v1 behavioral1/memory/2372-65-0x00000000010D0000-0x00000000011B2000-memory.dmp family_zgrat_v1 behavioral1/memory/2372-45-0x00000000010D0000-0x00000000011B2000-memory.dmp family_zgrat_v1 behavioral1/memory/2372-27-0x00000000010D0000-0x00000000011B2000-memory.dmp family_zgrat_v1 behavioral1/memory/2372-25-0x00000000010D0000-0x00000000011B2000-memory.dmp family_zgrat_v1 behavioral1/memory/2372-57-0x00000000010D0000-0x00000000011B2000-memory.dmp family_zgrat_v1 behavioral1/memory/2372-63-0x00000000010D0000-0x00000000011B2000-memory.dmp family_zgrat_v1 behavioral1/memory/2372-61-0x00000000010D0000-0x00000000011B2000-memory.dmp family_zgrat_v1 behavioral1/memory/2372-60-0x00000000010D0000-0x00000000011B2000-memory.dmp family_zgrat_v1 behavioral1/memory/2372-55-0x00000000010D0000-0x00000000011B2000-memory.dmp family_zgrat_v1 behavioral1/memory/2372-53-0x00000000010D0000-0x00000000011B2000-memory.dmp family_zgrat_v1 behavioral1/memory/2372-52-0x00000000010D0000-0x00000000011B2000-memory.dmp family_zgrat_v1 behavioral1/memory/2372-49-0x00000000010D0000-0x00000000011B2000-memory.dmp family_zgrat_v1 behavioral1/memory/2372-47-0x00000000010D0000-0x00000000011B2000-memory.dmp family_zgrat_v1 behavioral1/memory/2372-43-0x00000000010D0000-0x00000000011B2000-memory.dmp family_zgrat_v1 behavioral1/memory/2372-41-0x00000000010D0000-0x00000000011B2000-memory.dmp family_zgrat_v1 behavioral1/memory/2372-40-0x00000000010D0000-0x00000000011B2000-memory.dmp family_zgrat_v1 behavioral1/memory/2372-37-0x00000000010D0000-0x00000000011B2000-memory.dmp family_zgrat_v1 behavioral1/memory/2372-35-0x00000000010D0000-0x00000000011B2000-memory.dmp family_zgrat_v1 behavioral1/memory/2372-33-0x00000000010D0000-0x00000000011B2000-memory.dmp family_zgrat_v1 behavioral1/memory/2372-31-0x00000000010D0000-0x00000000011B2000-memory.dmp family_zgrat_v1 behavioral1/memory/2372-23-0x00000000010D0000-0x00000000011B2000-memory.dmp family_zgrat_v1 behavioral1/memory/2372-21-0x00000000010D0000-0x00000000011B2000-memory.dmp family_zgrat_v1 behavioral1/memory/2372-19-0x00000000010D0000-0x00000000011B2000-memory.dmp family_zgrat_v1 behavioral1/memory/2372-11-0x00000000010D0000-0x00000000011B2000-memory.dmp family_zgrat_v1 behavioral1/memory/2372-5-0x00000000010D0000-0x00000000011B2000-memory.dmp family_zgrat_v1 behavioral1/memory/2372-17-0x00000000010D0000-0x00000000011B2000-memory.dmp family_zgrat_v1 behavioral1/memory/2372-15-0x00000000010D0000-0x00000000011B2000-memory.dmp family_zgrat_v1 behavioral1/memory/2372-13-0x00000000010D0000-0x00000000011B2000-memory.dmp family_zgrat_v1 -
Downloads MZ/PE file
-
Drops startup file 2 IoCs
Processes:
Powershell.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\slvvhwq.exe Powershell.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\slvvhwq.exe Powershell.exe -
Executes dropped EXE 3 IoCs
Processes:
TypeId.exeslvvhwq.exeslvvhwq.exepid process 7828 TypeId.exe 7468 slvvhwq.exe 7652 slvvhwq.exe -
Loads dropped DLL 1 IoCs
Processes:
slvvhwq.exepid process 7468 slvvhwq.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/7468-6719-0x0000000005EF0000-0x0000000005FC4000-memory.dmp agile_net -
Suspicious use of SetThreadContext 2 IoCs
Processes:
TypeId.exeslvvhwq.exedescription pid process target process PID 7828 set thread context of 2712 7828 TypeId.exe InstallUtil.exe PID 7468 set thread context of 7652 7468 slvvhwq.exe slvvhwq.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
slvvhwq.exepid process 7652 slvvhwq.exe -
Suspicious behavior: EnumeratesProcesses 29 IoCs
Processes:
TypeId.exeslvvhwq.exePowershell.exepid process 7828 TypeId.exe 7828 TypeId.exe 7468 slvvhwq.exe 7468 slvvhwq.exe 7468 slvvhwq.exe 7468 slvvhwq.exe 7468 slvvhwq.exe 7468 slvvhwq.exe 7468 slvvhwq.exe 7468 slvvhwq.exe 7468 slvvhwq.exe 7468 slvvhwq.exe 7468 slvvhwq.exe 7468 slvvhwq.exe 7468 slvvhwq.exe 7468 slvvhwq.exe 7468 slvvhwq.exe 7468 slvvhwq.exe 7468 slvvhwq.exe 7468 slvvhwq.exe 7468 slvvhwq.exe 7468 slvvhwq.exe 7468 slvvhwq.exe 7468 slvvhwq.exe 7468 slvvhwq.exe 7468 slvvhwq.exe 7468 slvvhwq.exe 7468 slvvhwq.exe 7576 Powershell.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
f5fe6435df7702338b1320b55f96caa4.exeTypeId.exeInstallUtil.exeslvvhwq.exeslvvhwq.exePowershell.exedescription pid process Token: SeDebugPrivilege 2372 f5fe6435df7702338b1320b55f96caa4.exe Token: SeDebugPrivilege 7828 TypeId.exe Token: SeDebugPrivilege 2712 InstallUtil.exe Token: SeDebugPrivilege 7468 slvvhwq.exe Token: SeDebugPrivilege 7652 slvvhwq.exe Token: SeDebugPrivilege 7576 Powershell.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
taskeng.exeTypeId.exeslvvhwq.exedescription pid process target process PID 7796 wrote to memory of 7828 7796 taskeng.exe TypeId.exe PID 7796 wrote to memory of 7828 7796 taskeng.exe TypeId.exe PID 7796 wrote to memory of 7828 7796 taskeng.exe TypeId.exe PID 7796 wrote to memory of 7828 7796 taskeng.exe TypeId.exe PID 7828 wrote to memory of 2712 7828 TypeId.exe InstallUtil.exe PID 7828 wrote to memory of 2712 7828 TypeId.exe InstallUtil.exe PID 7828 wrote to memory of 2712 7828 TypeId.exe InstallUtil.exe PID 7828 wrote to memory of 2712 7828 TypeId.exe InstallUtil.exe PID 7828 wrote to memory of 2712 7828 TypeId.exe InstallUtil.exe PID 7828 wrote to memory of 2712 7828 TypeId.exe InstallUtil.exe PID 7828 wrote to memory of 2712 7828 TypeId.exe InstallUtil.exe PID 7828 wrote to memory of 2712 7828 TypeId.exe InstallUtil.exe PID 7828 wrote to memory of 2712 7828 TypeId.exe InstallUtil.exe PID 7828 wrote to memory of 2712 7828 TypeId.exe InstallUtil.exe PID 7828 wrote to memory of 2712 7828 TypeId.exe InstallUtil.exe PID 7828 wrote to memory of 2712 7828 TypeId.exe InstallUtil.exe PID 7796 wrote to memory of 7468 7796 taskeng.exe slvvhwq.exe PID 7796 wrote to memory of 7468 7796 taskeng.exe slvvhwq.exe PID 7796 wrote to memory of 7468 7796 taskeng.exe slvvhwq.exe PID 7796 wrote to memory of 7468 7796 taskeng.exe slvvhwq.exe PID 7468 wrote to memory of 7576 7468 slvvhwq.exe Powershell.exe PID 7468 wrote to memory of 7576 7468 slvvhwq.exe Powershell.exe PID 7468 wrote to memory of 7576 7468 slvvhwq.exe Powershell.exe PID 7468 wrote to memory of 7576 7468 slvvhwq.exe Powershell.exe PID 7468 wrote to memory of 7652 7468 slvvhwq.exe slvvhwq.exe PID 7468 wrote to memory of 7652 7468 slvvhwq.exe slvvhwq.exe PID 7468 wrote to memory of 7652 7468 slvvhwq.exe slvvhwq.exe PID 7468 wrote to memory of 7652 7468 slvvhwq.exe slvvhwq.exe PID 7468 wrote to memory of 7652 7468 slvvhwq.exe slvvhwq.exe PID 7468 wrote to memory of 7652 7468 slvvhwq.exe slvvhwq.exe PID 7468 wrote to memory of 7652 7468 slvvhwq.exe slvvhwq.exe PID 7468 wrote to memory of 7652 7468 slvvhwq.exe slvvhwq.exe PID 7468 wrote to memory of 7652 7468 slvvhwq.exe slvvhwq.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f5fe6435df7702338b1320b55f96caa4.exe"C:\Users\Admin\AppData\Local\Temp\f5fe6435df7702338b1320b55f96caa4.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskeng.exetaskeng.exe {AAB65847-DC50-4F9F-9783-1188A6E4A15D} S-1-5-21-3627615824-4061627003-3019543961-1000:SCFGBRBT\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\FrameworkDisplayName\cwfraaxr\TypeId.exeC:\Users\Admin\AppData\Local\FrameworkDisplayName\cwfraaxr\TypeId.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\slvvhwq.exeC:\Users\Admin\AppData\Local\Temp\slvvhwq.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe"Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\slvvhwq.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\slvvhwq.exe' -Force3⤵
- Drops startup file
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\slvvhwq.exe"C:\Users\Admin\AppData\Local\Temp\slvvhwq.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\FrameworkDisplayName\cwfraaxr\TypeId.exeFilesize
594KB
MD5f5fe6435df7702338b1320b55f96caa4
SHA1fab2bbc6e43cc01217673b2753e223099c3c297f
SHA2563f352445c521895812735acebb5f944cd1e88024cade5b201c562166619ffc9f
SHA5124c355979435dc7519c4e4ee1a9ff6ad4be9cabcaa6b376473b039fcd785837689f16662e680b196f2b74ec689ff894175a2892206f1883e6e22ca89a292a6fab
-
C:\Users\Admin\AppData\Local\Temp\slvvhwq.exeFilesize
26KB
MD51f90151f3470f316a645a6617534a0be
SHA180dd3641418ff22c353b2d1f0f4c86990cfdaee1
SHA256aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c
SHA5125609219d6a7ece553032589d9765e7fcf394253fa4df5d64539e231a4350bf9c8b3bfd2ec5ca1904a6584b793f3a174353261e23983f7ac428b7957379eccbcf
-
memory/2372-0-0x000000007415E000-0x000000007415F000-memory.dmpFilesize
4KB
-
memory/2372-1-0x00000000012E0000-0x000000000137A000-memory.dmpFilesize
616KB
-
memory/2372-2-0x00000000010D0000-0x00000000011B8000-memory.dmpFilesize
928KB
-
memory/2372-4-0x00000000010D0000-0x00000000011B2000-memory.dmpFilesize
904KB
-
memory/2372-29-0x00000000010D0000-0x00000000011B2000-memory.dmpFilesize
904KB
-
memory/2372-7-0x00000000010D0000-0x00000000011B2000-memory.dmpFilesize
904KB
-
memory/2372-67-0x00000000010D0000-0x00000000011B2000-memory.dmpFilesize
904KB
-
memory/2372-9-0x00000000010D0000-0x00000000011B2000-memory.dmpFilesize
904KB
-
memory/2372-65-0x00000000010D0000-0x00000000011B2000-memory.dmpFilesize
904KB
-
memory/2372-45-0x00000000010D0000-0x00000000011B2000-memory.dmpFilesize
904KB
-
memory/2372-27-0x00000000010D0000-0x00000000011B2000-memory.dmpFilesize
904KB
-
memory/2372-25-0x00000000010D0000-0x00000000011B2000-memory.dmpFilesize
904KB
-
memory/2372-57-0x00000000010D0000-0x00000000011B2000-memory.dmpFilesize
904KB
-
memory/2372-63-0x00000000010D0000-0x00000000011B2000-memory.dmpFilesize
904KB
-
memory/2372-61-0x00000000010D0000-0x00000000011B2000-memory.dmpFilesize
904KB
-
memory/2372-60-0x00000000010D0000-0x00000000011B2000-memory.dmpFilesize
904KB
-
memory/2372-55-0x00000000010D0000-0x00000000011B2000-memory.dmpFilesize
904KB
-
memory/2372-53-0x00000000010D0000-0x00000000011B2000-memory.dmpFilesize
904KB
-
memory/2372-52-0x00000000010D0000-0x00000000011B2000-memory.dmpFilesize
904KB
-
memory/2372-49-0x00000000010D0000-0x00000000011B2000-memory.dmpFilesize
904KB
-
memory/2372-47-0x00000000010D0000-0x00000000011B2000-memory.dmpFilesize
904KB
-
memory/2372-43-0x00000000010D0000-0x00000000011B2000-memory.dmpFilesize
904KB
-
memory/2372-41-0x00000000010D0000-0x00000000011B2000-memory.dmpFilesize
904KB
-
memory/2372-40-0x00000000010D0000-0x00000000011B2000-memory.dmpFilesize
904KB
-
memory/2372-37-0x00000000010D0000-0x00000000011B2000-memory.dmpFilesize
904KB
-
memory/2372-35-0x00000000010D0000-0x00000000011B2000-memory.dmpFilesize
904KB
-
memory/2372-33-0x00000000010D0000-0x00000000011B2000-memory.dmpFilesize
904KB
-
memory/2372-31-0x00000000010D0000-0x00000000011B2000-memory.dmpFilesize
904KB
-
memory/2372-23-0x00000000010D0000-0x00000000011B2000-memory.dmpFilesize
904KB
-
memory/2372-21-0x00000000010D0000-0x00000000011B2000-memory.dmpFilesize
904KB
-
memory/2372-19-0x00000000010D0000-0x00000000011B2000-memory.dmpFilesize
904KB
-
memory/2372-11-0x00000000010D0000-0x00000000011B2000-memory.dmpFilesize
904KB
-
memory/2372-5-0x00000000010D0000-0x00000000011B2000-memory.dmpFilesize
904KB
-
memory/2372-17-0x00000000010D0000-0x00000000011B2000-memory.dmpFilesize
904KB
-
memory/2372-15-0x00000000010D0000-0x00000000011B2000-memory.dmpFilesize
904KB
-
memory/2372-13-0x00000000010D0000-0x00000000011B2000-memory.dmpFilesize
904KB
-
memory/2372-3-0x0000000074150000-0x000000007483E000-memory.dmpFilesize
6.9MB
-
memory/2372-2233-0x0000000000B10000-0x0000000000B5C000-memory.dmpFilesize
304KB
-
memory/2372-2232-0x0000000000670000-0x00000000006C6000-memory.dmpFilesize
344KB
-
memory/2372-2234-0x0000000000B80000-0x0000000000BD4000-memory.dmpFilesize
336KB
-
memory/2372-2236-0x0000000074150000-0x000000007483E000-memory.dmpFilesize
6.9MB
-
memory/2712-4485-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/7468-6718-0x0000000000C30000-0x0000000000C3C000-memory.dmpFilesize
48KB
-
memory/7468-6719-0x0000000005EF0000-0x0000000005FC4000-memory.dmpFilesize
848KB
-
memory/7652-6734-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/7652-6735-0x0000000004190000-0x0000000004256000-memory.dmpFilesize
792KB
-
memory/7652-7590-0x0000000004250000-0x00000000042A6000-memory.dmpFilesize
344KB
-
memory/7828-2239-0x0000000000AC0000-0x0000000000B5A000-memory.dmpFilesize
616KB
-
memory/7828-2240-0x0000000074090000-0x0000000074185000-memory.dmpFilesize
980KB
-
memory/7828-4484-0x0000000074090000-0x0000000074185000-memory.dmpFilesize
980KB