Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14-05-2024 04:45
Static task
static1
Behavioral task
behavioral1
Sample
db537a09e0185f8b941af6a5d2ceda40.exe
Resource
win7-20240221-en
General
-
Target
db537a09e0185f8b941af6a5d2ceda40.exe
-
Size
596KB
-
MD5
db537a09e0185f8b941af6a5d2ceda40
-
SHA1
8747013070a23b3d9dd386c1baab0cb79cff3786
-
SHA256
2a111b1a6650ea6e6b369583f8afe1bf8c5bb6164cb12f8e833d0638c1c2deaf
-
SHA512
1ecd816a35c50ccbb78a3911d517fe292c4ac8431cc54446ffd3136657dc0d1cc793800c5c5bef31cd76847c0c2cf1968c87f68b841a4bd245e1ced7ab3a37c7
-
SSDEEP
12288:Z48Xz4N3jJuKiMGejML/ldDKdgM/pMp00TIhmP8mWdCcLxUX0M39F+n:ePNT0KR/MqdgMhr6IhmkmWXuEM3Cn
Malware Config
Signatures
-
Detect ZGRat V1 34 IoCs
Processes:
resource yara_rule behavioral1/memory/2364-2-0x0000000004790000-0x0000000004878000-memory.dmp family_zgrat_v1 behavioral1/memory/2364-4-0x0000000004790000-0x0000000004872000-memory.dmp family_zgrat_v1 behavioral1/memory/2364-5-0x0000000004790000-0x0000000004872000-memory.dmp family_zgrat_v1 behavioral1/memory/2364-25-0x0000000004790000-0x0000000004872000-memory.dmp family_zgrat_v1 behavioral1/memory/2364-7-0x0000000004790000-0x0000000004872000-memory.dmp family_zgrat_v1 behavioral1/memory/2364-44-0x0000000004790000-0x0000000004872000-memory.dmp family_zgrat_v1 behavioral1/memory/2364-48-0x0000000004790000-0x0000000004872000-memory.dmp family_zgrat_v1 behavioral1/memory/2364-42-0x0000000004790000-0x0000000004872000-memory.dmp family_zgrat_v1 behavioral1/memory/2364-9-0x0000000004790000-0x0000000004872000-memory.dmp family_zgrat_v1 behavioral1/memory/2364-61-0x0000000004790000-0x0000000004872000-memory.dmp family_zgrat_v1 behavioral1/memory/2364-63-0x0000000004790000-0x0000000004872000-memory.dmp family_zgrat_v1 behavioral1/memory/2364-11-0x0000000004790000-0x0000000004872000-memory.dmp family_zgrat_v1 behavioral1/memory/2364-13-0x0000000004790000-0x0000000004872000-memory.dmp family_zgrat_v1 behavioral1/memory/2364-15-0x0000000004790000-0x0000000004872000-memory.dmp family_zgrat_v1 behavioral1/memory/2364-17-0x0000000004790000-0x0000000004872000-memory.dmp family_zgrat_v1 behavioral1/memory/2364-21-0x0000000004790000-0x0000000004872000-memory.dmp family_zgrat_v1 behavioral1/memory/2364-27-0x0000000004790000-0x0000000004872000-memory.dmp family_zgrat_v1 behavioral1/memory/2364-31-0x0000000004790000-0x0000000004872000-memory.dmp family_zgrat_v1 behavioral1/memory/2364-51-0x0000000004790000-0x0000000004872000-memory.dmp family_zgrat_v1 behavioral1/memory/2364-67-0x0000000004790000-0x0000000004872000-memory.dmp family_zgrat_v1 behavioral1/memory/2364-65-0x0000000004790000-0x0000000004872000-memory.dmp family_zgrat_v1 behavioral1/memory/2364-59-0x0000000004790000-0x0000000004872000-memory.dmp family_zgrat_v1 behavioral1/memory/2364-57-0x0000000004790000-0x0000000004872000-memory.dmp family_zgrat_v1 behavioral1/memory/2364-55-0x0000000004790000-0x0000000004872000-memory.dmp family_zgrat_v1 behavioral1/memory/2364-54-0x0000000004790000-0x0000000004872000-memory.dmp family_zgrat_v1 behavioral1/memory/2364-49-0x0000000004790000-0x0000000004872000-memory.dmp family_zgrat_v1 behavioral1/memory/2364-46-0x0000000004790000-0x0000000004872000-memory.dmp family_zgrat_v1 behavioral1/memory/2364-39-0x0000000004790000-0x0000000004872000-memory.dmp family_zgrat_v1 behavioral1/memory/2364-37-0x0000000004790000-0x0000000004872000-memory.dmp family_zgrat_v1 behavioral1/memory/2364-35-0x0000000004790000-0x0000000004872000-memory.dmp family_zgrat_v1 behavioral1/memory/2364-33-0x0000000004790000-0x0000000004872000-memory.dmp family_zgrat_v1 behavioral1/memory/2364-29-0x0000000004790000-0x0000000004872000-memory.dmp family_zgrat_v1 behavioral1/memory/2364-23-0x0000000004790000-0x0000000004872000-memory.dmp family_zgrat_v1 behavioral1/memory/2364-19-0x0000000004790000-0x0000000004872000-memory.dmp family_zgrat_v1 -
Downloads MZ/PE file
-
Drops startup file 2 IoCs
Processes:
Powershell.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ajgdmb.exe Powershell.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ajgdmb.exe Powershell.exe -
Executes dropped EXE 2 IoCs
Processes:
ajgdmb.exeajgdmb.exepid process 7600 ajgdmb.exe 7768 ajgdmb.exe -
Loads dropped DLL 1 IoCs
Processes:
ajgdmb.exepid process 7600 ajgdmb.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/7600-2216-0x0000000005930000-0x0000000005A04000-memory.dmp agile_net -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ajgdmb.exedescription pid process target process PID 7600 set thread context of 7768 7600 ajgdmb.exe ajgdmb.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
ajgdmb.exepid process 7768 ajgdmb.exe -
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
ajgdmb.exePowershell.exepid process 7600 ajgdmb.exe 7600 ajgdmb.exe 7600 ajgdmb.exe 7600 ajgdmb.exe 7600 ajgdmb.exe 7600 ajgdmb.exe 7600 ajgdmb.exe 7600 ajgdmb.exe 7600 ajgdmb.exe 7600 ajgdmb.exe 7600 ajgdmb.exe 7600 ajgdmb.exe 7600 ajgdmb.exe 7600 ajgdmb.exe 7600 ajgdmb.exe 7600 ajgdmb.exe 7600 ajgdmb.exe 7600 ajgdmb.exe 7600 ajgdmb.exe 7600 ajgdmb.exe 7600 ajgdmb.exe 7600 ajgdmb.exe 7600 ajgdmb.exe 7600 ajgdmb.exe 7600 ajgdmb.exe 7600 ajgdmb.exe 7720 Powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
db537a09e0185f8b941af6a5d2ceda40.exeajgdmb.exeajgdmb.exePowershell.exedescription pid process Token: SeDebugPrivilege 2364 db537a09e0185f8b941af6a5d2ceda40.exe Token: SeDebugPrivilege 7600 ajgdmb.exe Token: SeDebugPrivilege 7768 ajgdmb.exe Token: SeDebugPrivilege 7720 Powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
taskeng.exeajgdmb.exedescription pid process target process PID 7568 wrote to memory of 7600 7568 taskeng.exe ajgdmb.exe PID 7568 wrote to memory of 7600 7568 taskeng.exe ajgdmb.exe PID 7568 wrote to memory of 7600 7568 taskeng.exe ajgdmb.exe PID 7568 wrote to memory of 7600 7568 taskeng.exe ajgdmb.exe PID 7600 wrote to memory of 7720 7600 ajgdmb.exe Powershell.exe PID 7600 wrote to memory of 7720 7600 ajgdmb.exe Powershell.exe PID 7600 wrote to memory of 7720 7600 ajgdmb.exe Powershell.exe PID 7600 wrote to memory of 7720 7600 ajgdmb.exe Powershell.exe PID 7600 wrote to memory of 7768 7600 ajgdmb.exe ajgdmb.exe PID 7600 wrote to memory of 7768 7600 ajgdmb.exe ajgdmb.exe PID 7600 wrote to memory of 7768 7600 ajgdmb.exe ajgdmb.exe PID 7600 wrote to memory of 7768 7600 ajgdmb.exe ajgdmb.exe PID 7600 wrote to memory of 7768 7600 ajgdmb.exe ajgdmb.exe PID 7600 wrote to memory of 7768 7600 ajgdmb.exe ajgdmb.exe PID 7600 wrote to memory of 7768 7600 ajgdmb.exe ajgdmb.exe PID 7600 wrote to memory of 7768 7600 ajgdmb.exe ajgdmb.exe PID 7600 wrote to memory of 7768 7600 ajgdmb.exe ajgdmb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\db537a09e0185f8b941af6a5d2ceda40.exe"C:\Users\Admin\AppData\Local\Temp\db537a09e0185f8b941af6a5d2ceda40.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2364
-
C:\Windows\system32\taskeng.exetaskeng.exe {ADF40CD1-EED2-4AA0-B62F-DDC0F450DBFA} S-1-5-21-3452737119-3959686427-228443150-1000:QGTQZTRE\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:7568 -
C:\Users\Admin\AppData\Local\Temp\ajgdmb.exeC:\Users\Admin\AppData\Local\Temp\ajgdmb.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:7600 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe"Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\ajgdmb.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ajgdmb.exe' -Force3⤵
- Drops startup file
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:7720
-
-
C:\Users\Admin\AppData\Local\Temp\ajgdmb.exe"C:\Users\Admin\AppData\Local\Temp\ajgdmb.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
PID:7768
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
26KB
MD51f90151f3470f316a645a6617534a0be
SHA180dd3641418ff22c353b2d1f0f4c86990cfdaee1
SHA256aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c
SHA5125609219d6a7ece553032589d9765e7fcf394253fa4df5d64539e231a4350bf9c8b3bfd2ec5ca1904a6584b793f3a174353261e23983f7ac428b7957379eccbcf