Analysis

  • max time kernel
    122s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    13-05-2024 07:22

General

  • Target

    1885cacfae37edb28b438588771fb03f.exe

  • Size

    439KB

  • MD5

    1885cacfae37edb28b438588771fb03f

  • SHA1

    b8b86b6ddc681a9333628f344875d9d33fee7185

  • SHA256

    62990bd81297a42bf5348c15a196e488a531420d12869392c5bd0724ca997c9d

  • SHA512

    afc2b931689f21c1b7770735f2292c2fa667b86123354d8409d264118e1908f22dddd58fc17545e9feaae786c2414133923c2170be879ff502398f87c556d57e

  • SSDEEP

    6144:NZi9pP2JNMv8P4WyKNh6xzRnM3VVYijO9Wi7XMJRAc3ewc5n5:NZibPoKv6fNhEFMDBMWY3cu/5

Malware Config

Signatures

  • Detect ZGRat V1 34 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1885cacfae37edb28b438588771fb03f.exe
    "C:\Users\Admin\AppData\Local\Temp\1885cacfae37edb28b438588771fb03f.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2088
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name '1885cacfae37edb28b438588771fb03f';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name '1885cacfae37edb28b438588771fb03f' -Value '"C:\Users\Admin\AppData\Roaming\1885cacfae37edb28b438588771fb03f.exe"' -PropertyType 'String'
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:7784

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2088-0-0x000007FEF5BB3000-0x000007FEF5BB4000-memory.dmp

    Filesize

    4KB

  • memory/2088-1-0x0000000000EC0000-0x0000000000F34000-memory.dmp

    Filesize

    464KB

  • memory/2088-2-0x0000000000C40000-0x0000000000D1C000-memory.dmp

    Filesize

    880KB

  • memory/2088-3-0x000007FEF5BB0000-0x000007FEF659C000-memory.dmp

    Filesize

    9.9MB

  • memory/2088-4-0x0000000000C40000-0x0000000000D17000-memory.dmp

    Filesize

    860KB

  • memory/2088-5-0x0000000000C40000-0x0000000000D17000-memory.dmp

    Filesize

    860KB

  • memory/2088-13-0x0000000000C40000-0x0000000000D17000-memory.dmp

    Filesize

    860KB

  • memory/2088-25-0x0000000000C40000-0x0000000000D17000-memory.dmp

    Filesize

    860KB

  • memory/2088-41-0x0000000000C40000-0x0000000000D17000-memory.dmp

    Filesize

    860KB

  • memory/2088-59-0x0000000000C40000-0x0000000000D17000-memory.dmp

    Filesize

    860KB

  • memory/2088-7-0x0000000000C40000-0x0000000000D17000-memory.dmp

    Filesize

    860KB

  • memory/2088-67-0x0000000000C40000-0x0000000000D17000-memory.dmp

    Filesize

    860KB

  • memory/2088-65-0x0000000000C40000-0x0000000000D17000-memory.dmp

    Filesize

    860KB

  • memory/2088-63-0x0000000000C40000-0x0000000000D17000-memory.dmp

    Filesize

    860KB

  • memory/2088-61-0x0000000000C40000-0x0000000000D17000-memory.dmp

    Filesize

    860KB

  • memory/2088-57-0x0000000000C40000-0x0000000000D17000-memory.dmp

    Filesize

    860KB

  • memory/2088-55-0x0000000000C40000-0x0000000000D17000-memory.dmp

    Filesize

    860KB

  • memory/2088-54-0x0000000000C40000-0x0000000000D17000-memory.dmp

    Filesize

    860KB

  • memory/2088-51-0x0000000000C40000-0x0000000000D17000-memory.dmp

    Filesize

    860KB

  • memory/2088-49-0x0000000000C40000-0x0000000000D17000-memory.dmp

    Filesize

    860KB

  • memory/2088-47-0x0000000000C40000-0x0000000000D17000-memory.dmp

    Filesize

    860KB

  • memory/2088-45-0x0000000000C40000-0x0000000000D17000-memory.dmp

    Filesize

    860KB

  • memory/2088-43-0x0000000000C40000-0x0000000000D17000-memory.dmp

    Filesize

    860KB

  • memory/2088-39-0x0000000000C40000-0x0000000000D17000-memory.dmp

    Filesize

    860KB

  • memory/2088-37-0x0000000000C40000-0x0000000000D17000-memory.dmp

    Filesize

    860KB

  • memory/2088-35-0x0000000000C40000-0x0000000000D17000-memory.dmp

    Filesize

    860KB

  • memory/2088-33-0x0000000000C40000-0x0000000000D17000-memory.dmp

    Filesize

    860KB

  • memory/2088-31-0x0000000000C40000-0x0000000000D17000-memory.dmp

    Filesize

    860KB

  • memory/2088-29-0x0000000000C40000-0x0000000000D17000-memory.dmp

    Filesize

    860KB

  • memory/2088-27-0x0000000000C40000-0x0000000000D17000-memory.dmp

    Filesize

    860KB

  • memory/2088-23-0x0000000000C40000-0x0000000000D17000-memory.dmp

    Filesize

    860KB

  • memory/2088-21-0x0000000000C40000-0x0000000000D17000-memory.dmp

    Filesize

    860KB

  • memory/2088-19-0x0000000000C40000-0x0000000000D17000-memory.dmp

    Filesize

    860KB

  • memory/2088-17-0x0000000000C40000-0x0000000000D17000-memory.dmp

    Filesize

    860KB

  • memory/2088-15-0x0000000000C40000-0x0000000000D17000-memory.dmp

    Filesize

    860KB

  • memory/2088-11-0x0000000000C40000-0x0000000000D17000-memory.dmp

    Filesize

    860KB

  • memory/2088-9-0x0000000000C40000-0x0000000000D17000-memory.dmp

    Filesize

    860KB

  • memory/2088-6318-0x000007FEF5BB0000-0x000007FEF659C000-memory.dmp

    Filesize

    9.9MB

  • memory/2088-6333-0x000000001AE20000-0x000000001AEA0000-memory.dmp

    Filesize

    512KB

  • memory/2088-6351-0x000007FEF5BB3000-0x000007FEF5BB4000-memory.dmp

    Filesize

    4KB

  • memory/2088-6352-0x000007FEF5BB0000-0x000007FEF659C000-memory.dmp

    Filesize

    9.9MB

  • memory/2088-6353-0x000000001AE20000-0x000000001AEA0000-memory.dmp

    Filesize

    512KB

  • memory/7784-6323-0x000007FEEF34E000-0x000007FEEF34F000-memory.dmp

    Filesize

    4KB

  • memory/7784-6324-0x000000001B590000-0x000000001B872000-memory.dmp

    Filesize

    2.9MB

  • memory/7784-6325-0x0000000002290000-0x0000000002298000-memory.dmp

    Filesize

    32KB

  • memory/7784-6326-0x000007FEEF090000-0x000007FEEFA2D000-memory.dmp

    Filesize

    9.6MB

  • memory/7784-6327-0x000007FEEF090000-0x000007FEEFA2D000-memory.dmp

    Filesize

    9.6MB

  • memory/7784-6328-0x000007FEEF090000-0x000007FEEFA2D000-memory.dmp

    Filesize

    9.6MB

  • memory/7784-6329-0x000007FEEF090000-0x000007FEEFA2D000-memory.dmp

    Filesize

    9.6MB

  • memory/7784-6330-0x000007FEEF090000-0x000007FEEFA2D000-memory.dmp

    Filesize

    9.6MB

  • memory/7784-6331-0x000007FEEF090000-0x000007FEEFA2D000-memory.dmp

    Filesize

    9.6MB