Analysis
-
max time kernel
41s -
max time network
44s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-de -
resource tags
arch:x64arch:x86image:win10v2004-20240426-delocale:de-deos:windows10-2004-x64systemwindows -
submitted
14-05-2024 09:47
Static task
static1
General
-
Target
369be61aca46750085c842147909f80c8f938555071adeaceac6727bfcf74186.exe
-
Size
2.3MB
-
MD5
a717a432c558f56c46709d6d3ec9837f
-
SHA1
ceda052be2519383085089a41c422ce2b1400a46
-
SHA256
369be61aca46750085c842147909f80c8f938555071adeaceac6727bfcf74186
-
SHA512
e859810a198b8b946581ed6197b1154856e736687dd593d383dc952a3afd597ed6b5a631a8e6b2228a425b809b772457e6e10e0ca6f68cd8f0a8cc637a81132c
-
SSDEEP
49152:T+GJaXbo4IKA2WN4M63n4dHzCJYU6Mm4/4w2RAObR8XlZrzyiko:TboxWN4UHzCJYCmX5w1ZXyik
Malware Config
Extracted
asyncrat
0.5.8
Default
5512.sytes.net:6606
5512.sytes.net:7707
5512.sytes.net:8808
95.211.208.153:6606
95.211.208.153:7707
95.211.208.153:8808
Llg9a02PERRO
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Detect ZGRat V1 34 IoCs
Processes:
resource yara_rule behavioral1/memory/3448-30-0x0000000005080000-0x00000000052A0000-memory.dmp family_zgrat_v1 behavioral1/memory/3448-45-0x0000000005080000-0x000000000529A000-memory.dmp family_zgrat_v1 behavioral1/memory/3448-64-0x0000000005080000-0x000000000529A000-memory.dmp family_zgrat_v1 behavioral1/memory/3448-76-0x0000000005080000-0x000000000529A000-memory.dmp family_zgrat_v1 behavioral1/memory/3448-99-0x0000000005080000-0x000000000529A000-memory.dmp family_zgrat_v1 behavioral1/memory/3448-111-0x0000000005080000-0x000000000529A000-memory.dmp family_zgrat_v1 behavioral1/memory/3448-114-0x0000000005080000-0x000000000529A000-memory.dmp family_zgrat_v1 behavioral1/memory/3448-109-0x0000000005080000-0x000000000529A000-memory.dmp family_zgrat_v1 behavioral1/memory/3448-107-0x0000000005080000-0x000000000529A000-memory.dmp family_zgrat_v1 behavioral1/memory/3448-105-0x0000000005080000-0x000000000529A000-memory.dmp family_zgrat_v1 behavioral1/memory/3448-103-0x0000000005080000-0x000000000529A000-memory.dmp family_zgrat_v1 behavioral1/memory/3448-97-0x0000000005080000-0x000000000529A000-memory.dmp family_zgrat_v1 behavioral1/memory/3448-95-0x0000000005080000-0x000000000529A000-memory.dmp family_zgrat_v1 behavioral1/memory/3448-93-0x0000000005080000-0x000000000529A000-memory.dmp family_zgrat_v1 behavioral1/memory/3448-91-0x0000000005080000-0x000000000529A000-memory.dmp family_zgrat_v1 behavioral1/memory/3448-89-0x0000000005080000-0x000000000529A000-memory.dmp family_zgrat_v1 behavioral1/memory/3448-86-0x0000000005080000-0x000000000529A000-memory.dmp family_zgrat_v1 behavioral1/memory/3448-84-0x0000000005080000-0x000000000529A000-memory.dmp family_zgrat_v1 behavioral1/memory/3448-101-0x0000000005080000-0x000000000529A000-memory.dmp family_zgrat_v1 behavioral1/memory/3448-80-0x0000000005080000-0x000000000529A000-memory.dmp family_zgrat_v1 behavioral1/memory/3448-78-0x0000000005080000-0x000000000529A000-memory.dmp family_zgrat_v1 behavioral1/memory/3448-82-0x0000000005080000-0x000000000529A000-memory.dmp family_zgrat_v1 behavioral1/memory/3448-74-0x0000000005080000-0x000000000529A000-memory.dmp family_zgrat_v1 behavioral1/memory/3448-72-0x0000000005080000-0x000000000529A000-memory.dmp family_zgrat_v1 behavioral1/memory/3448-70-0x0000000005080000-0x000000000529A000-memory.dmp family_zgrat_v1 behavioral1/memory/3448-68-0x0000000005080000-0x000000000529A000-memory.dmp family_zgrat_v1 behavioral1/memory/3448-66-0x0000000005080000-0x000000000529A000-memory.dmp family_zgrat_v1 behavioral1/memory/3448-62-0x0000000005080000-0x000000000529A000-memory.dmp family_zgrat_v1 behavioral1/memory/3448-60-0x0000000005080000-0x000000000529A000-memory.dmp family_zgrat_v1 behavioral1/memory/3448-58-0x0000000005080000-0x000000000529A000-memory.dmp family_zgrat_v1 behavioral1/memory/3448-54-0x0000000005080000-0x000000000529A000-memory.dmp family_zgrat_v1 behavioral1/memory/3448-51-0x0000000005080000-0x000000000529A000-memory.dmp family_zgrat_v1 behavioral1/memory/3448-49-0x0000000005080000-0x000000000529A000-memory.dmp family_zgrat_v1 behavioral1/memory/3448-46-0x0000000005080000-0x000000000529A000-memory.dmp family_zgrat_v1 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
369be61aca46750085c842147909f80c8f938555071adeaceac6727bfcf74186.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation 369be61aca46750085c842147909f80c8f938555071adeaceac6727bfcf74186.exe -
Executes dropped EXE 2 IoCs
Processes:
Dfzxuwcml.exehd.sentinel.pro.4.x-5.x-patch.exepid process 3448 Dfzxuwcml.exe 4480 hd.sentinel.pro.4.x-5.x-patch.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Dfzxuwcml.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Kpteiazy = "C:\\Users\\Admin\\AppData\\Roaming\\Kpteiazy.exe" Dfzxuwcml.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Dfzxuwcml.exedescription pid process target process PID 3448 set thread context of 3236 3448 Dfzxuwcml.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 1708 powershell.exe 1708 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exeDfzxuwcml.exeAppLaunch.exedescription pid process Token: SeDebugPrivilege 1708 powershell.exe Token: SeDebugPrivilege 3448 Dfzxuwcml.exe Token: SeDebugPrivilege 3448 Dfzxuwcml.exe Token: SeDebugPrivilege 3236 AppLaunch.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
369be61aca46750085c842147909f80c8f938555071adeaceac6727bfcf74186.exeDfzxuwcml.exedescription pid process target process PID 3392 wrote to memory of 1708 3392 369be61aca46750085c842147909f80c8f938555071adeaceac6727bfcf74186.exe powershell.exe PID 3392 wrote to memory of 1708 3392 369be61aca46750085c842147909f80c8f938555071adeaceac6727bfcf74186.exe powershell.exe PID 3392 wrote to memory of 1708 3392 369be61aca46750085c842147909f80c8f938555071adeaceac6727bfcf74186.exe powershell.exe PID 3392 wrote to memory of 3448 3392 369be61aca46750085c842147909f80c8f938555071adeaceac6727bfcf74186.exe Dfzxuwcml.exe PID 3392 wrote to memory of 3448 3392 369be61aca46750085c842147909f80c8f938555071adeaceac6727bfcf74186.exe Dfzxuwcml.exe PID 3392 wrote to memory of 3448 3392 369be61aca46750085c842147909f80c8f938555071adeaceac6727bfcf74186.exe Dfzxuwcml.exe PID 3392 wrote to memory of 4480 3392 369be61aca46750085c842147909f80c8f938555071adeaceac6727bfcf74186.exe hd.sentinel.pro.4.x-5.x-patch.exe PID 3392 wrote to memory of 4480 3392 369be61aca46750085c842147909f80c8f938555071adeaceac6727bfcf74186.exe hd.sentinel.pro.4.x-5.x-patch.exe PID 3392 wrote to memory of 4480 3392 369be61aca46750085c842147909f80c8f938555071adeaceac6727bfcf74186.exe hd.sentinel.pro.4.x-5.x-patch.exe PID 3448 wrote to memory of 3236 3448 Dfzxuwcml.exe AppLaunch.exe PID 3448 wrote to memory of 3236 3448 Dfzxuwcml.exe AppLaunch.exe PID 3448 wrote to memory of 3236 3448 Dfzxuwcml.exe AppLaunch.exe PID 3448 wrote to memory of 3236 3448 Dfzxuwcml.exe AppLaunch.exe PID 3448 wrote to memory of 3236 3448 Dfzxuwcml.exe AppLaunch.exe PID 3448 wrote to memory of 3236 3448 Dfzxuwcml.exe AppLaunch.exe PID 3448 wrote to memory of 3236 3448 Dfzxuwcml.exe AppLaunch.exe PID 3448 wrote to memory of 3236 3448 Dfzxuwcml.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\369be61aca46750085c842147909f80c8f938555071adeaceac6727bfcf74186.exe"C:\Users\Admin\AppData\Local\Temp\369be61aca46750085c842147909f80c8f938555071adeaceac6727bfcf74186.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZQBkACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAagBkACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHMAawBmACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAZwB4ACMAPgA="2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Dfzxuwcml.exe"C:\Users\Admin\AppData\Local\Dfzxuwcml.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\hd.sentinel.pro.4.x-5.x-patch.exe"C:\Users\Admin\AppData\Local\Temp\hd.sentinel.pro.4.x-5.x-patch.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Dfzxuwcml.exeFilesize
2.2MB
MD5577b8f4cd65df6e3cd42d7d37c7917cf
SHA15033814e5aade04682bf7cb7fca3e32c46c5512a
SHA256d4360ef0464f7620fe0e3d5185adcdc0781aacfe23510d2c6c2e85c1095c8948
SHA512a42dab76abe41e53d7eee1ff3cec3092b26e1a05bdd6c91e8f12e35f6f14fc36df5ef918d0a2818d9f549db1e8ace169ff8ed3f441253a9a27b89c1ec816ff9d
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_doo12the.0pm.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\hd.sentinel.pro.4.x-5.x-patch.exeFilesize
85KB
MD557824abbb9afe394c8a17a410e60c6fd
SHA1cdb3fe63c22e7d93d4a47bdb966b09f1b478f19f
SHA256becb4e1eaa4fbd915241f1138e2ed7b9833dc1cf66d6da25f9fac1a3e317c3ee
SHA5128b4e82437d6a30e73b65d0abc41b68d8420454622efd43d8d874ecee7a9251f36555d4c35dd13f886250948df1b9606ee61d0bcb2c8abb748b316dadff539c3d
-
memory/1708-4761-0x0000000007210000-0x0000000007224000-memory.dmpFilesize
80KB
-
memory/1708-177-0x00000000061A0000-0x00000000061BE000-memory.dmpFilesize
120KB
-
memory/1708-4248-0x0000000007200000-0x000000000720E000-memory.dmpFilesize
56KB
-
memory/1708-28-0x0000000073390000-0x0000000073B40000-memory.dmpFilesize
7.7MB
-
memory/1708-4963-0x0000000073390000-0x0000000073B40000-memory.dmpFilesize
7.7MB
-
memory/1708-31-0x0000000073390000-0x0000000073B40000-memory.dmpFilesize
7.7MB
-
memory/1708-4960-0x0000000007240000-0x0000000007248000-memory.dmpFilesize
32KB
-
memory/1708-4958-0x0000000007250000-0x000000000726A000-memory.dmpFilesize
104KB
-
memory/1708-33-0x0000000073390000-0x0000000073B40000-memory.dmpFilesize
7.7MB
-
memory/1708-35-0x0000000004AD0000-0x0000000004B56000-memory.dmpFilesize
536KB
-
memory/1708-36-0x0000000004A70000-0x0000000004A92000-memory.dmpFilesize
136KB
-
memory/1708-38-0x0000000005470000-0x00000000054D6000-memory.dmpFilesize
408KB
-
memory/1708-179-0x0000000007570000-0x0000000007BEA000-memory.dmpFilesize
6.5MB
-
memory/1708-178-0x0000000006E10000-0x0000000006EB3000-memory.dmpFilesize
652KB
-
memory/1708-29-0x0000000004D20000-0x0000000005348000-memory.dmpFilesize
6.2MB
-
memory/1708-88-0x00000000053E0000-0x00000000053F0000-memory.dmpFilesize
64KB
-
memory/1708-27-0x00000000020E0000-0x0000000002116000-memory.dmpFilesize
216KB
-
memory/1708-2449-0x0000000007170000-0x0000000007181000-memory.dmpFilesize
68KB
-
memory/1708-1922-0x0000000007290000-0x0000000007326000-memory.dmpFilesize
600KB
-
memory/1708-1816-0x00000000071A0000-0x00000000071EA000-memory.dmpFilesize
296KB
-
memory/1708-412-0x00000000047D0000-0x00000000047DA000-memory.dmpFilesize
40KB
-
memory/1708-37-0x0000000005400000-0x0000000005466000-memory.dmpFilesize
408KB
-
memory/1708-163-0x0000000005A70000-0x0000000005B74000-memory.dmpFilesize
1.0MB
-
memory/1708-164-0x0000000005BE0000-0x0000000005BFE000-memory.dmpFilesize
120KB
-
memory/1708-165-0x0000000005C20000-0x0000000005C6C000-memory.dmpFilesize
304KB
-
memory/1708-52-0x00000000055E0000-0x0000000005934000-memory.dmpFilesize
3.3MB
-
memory/1708-166-0x0000000006DD0000-0x0000000006E02000-memory.dmpFilesize
200KB
-
memory/1708-180-0x0000000006F30000-0x0000000006F4A000-memory.dmpFilesize
104KB
-
memory/1708-167-0x000000006FAE0000-0x000000006FB2C000-memory.dmpFilesize
304KB
-
memory/3236-4968-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3236-4972-0x0000000005760000-0x00000000057A2000-memory.dmpFilesize
264KB
-
memory/3448-76-0x0000000005080000-0x000000000529A000-memory.dmpFilesize
2.1MB
-
memory/3448-54-0x0000000005080000-0x000000000529A000-memory.dmpFilesize
2.1MB
-
memory/3448-91-0x0000000005080000-0x000000000529A000-memory.dmpFilesize
2.1MB
-
memory/3448-93-0x0000000005080000-0x000000000529A000-memory.dmpFilesize
2.1MB
-
memory/3448-95-0x0000000005080000-0x000000000529A000-memory.dmpFilesize
2.1MB
-
memory/3448-97-0x0000000005080000-0x000000000529A000-memory.dmpFilesize
2.1MB
-
memory/3448-103-0x0000000005080000-0x000000000529A000-memory.dmpFilesize
2.1MB
-
memory/3448-86-0x0000000005080000-0x000000000529A000-memory.dmpFilesize
2.1MB
-
memory/3448-84-0x0000000005080000-0x000000000529A000-memory.dmpFilesize
2.1MB
-
memory/3448-101-0x0000000005080000-0x000000000529A000-memory.dmpFilesize
2.1MB
-
memory/3448-80-0x0000000005080000-0x000000000529A000-memory.dmpFilesize
2.1MB
-
memory/3448-78-0x0000000005080000-0x000000000529A000-memory.dmpFilesize
2.1MB
-
memory/3448-82-0x0000000005080000-0x000000000529A000-memory.dmpFilesize
2.1MB
-
memory/3448-74-0x0000000005080000-0x000000000529A000-memory.dmpFilesize
2.1MB
-
memory/3448-72-0x0000000005080000-0x000000000529A000-memory.dmpFilesize
2.1MB
-
memory/3448-70-0x0000000005080000-0x000000000529A000-memory.dmpFilesize
2.1MB
-
memory/3448-68-0x0000000005080000-0x000000000529A000-memory.dmpFilesize
2.1MB
-
memory/3448-66-0x0000000005080000-0x000000000529A000-memory.dmpFilesize
2.1MB
-
memory/3448-62-0x0000000005080000-0x000000000529A000-memory.dmpFilesize
2.1MB
-
memory/3448-60-0x0000000005080000-0x000000000529A000-memory.dmpFilesize
2.1MB
-
memory/3448-58-0x0000000005080000-0x000000000529A000-memory.dmpFilesize
2.1MB
-
memory/3448-89-0x0000000005080000-0x000000000529A000-memory.dmpFilesize
2.1MB
-
memory/3448-51-0x0000000005080000-0x000000000529A000-memory.dmpFilesize
2.1MB
-
memory/3448-105-0x0000000005080000-0x000000000529A000-memory.dmpFilesize
2.1MB
-
memory/3448-49-0x0000000005080000-0x000000000529A000-memory.dmpFilesize
2.1MB
-
memory/3448-46-0x0000000005080000-0x000000000529A000-memory.dmpFilesize
2.1MB
-
memory/3448-107-0x0000000005080000-0x000000000529A000-memory.dmpFilesize
2.1MB
-
memory/3448-109-0x0000000005080000-0x000000000529A000-memory.dmpFilesize
2.1MB
-
memory/3448-114-0x0000000005080000-0x000000000529A000-memory.dmpFilesize
2.1MB
-
memory/3448-111-0x0000000005080000-0x000000000529A000-memory.dmpFilesize
2.1MB
-
memory/3448-99-0x0000000005080000-0x000000000529A000-memory.dmpFilesize
2.1MB
-
memory/3448-64-0x0000000005080000-0x000000000529A000-memory.dmpFilesize
2.1MB
-
memory/3448-45-0x0000000005080000-0x000000000529A000-memory.dmpFilesize
2.1MB
-
memory/3448-4956-0x0000000073390000-0x0000000073B40000-memory.dmpFilesize
7.7MB
-
memory/3448-34-0x0000000005340000-0x00000000053D2000-memory.dmpFilesize
584KB
-
memory/3448-4959-0x0000000005580000-0x00000000055CC000-memory.dmpFilesize
304KB
-
memory/3448-4957-0x00000000054E0000-0x000000000553C000-memory.dmpFilesize
368KB
-
memory/3448-32-0x0000000005850000-0x0000000005DF4000-memory.dmpFilesize
5.6MB
-
memory/3448-4964-0x0000000005E50000-0x0000000005EA4000-memory.dmpFilesize
336KB
-
memory/3448-30-0x0000000005080000-0x00000000052A0000-memory.dmpFilesize
2.1MB
-
memory/3448-26-0x0000000000580000-0x00000000007B2000-memory.dmpFilesize
2.2MB
-
memory/3448-4969-0x0000000073390000-0x0000000073B40000-memory.dmpFilesize
7.7MB
-
memory/3448-25-0x000000007339E000-0x000000007339F000-memory.dmpFilesize
4KB