Analysis
-
max time kernel
71s -
max time network
60s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
14-05-2024 19:17
General
-
Target
Project-ALM.exe
-
Size
5.4MB
-
MD5
404b5f5ddc06a5221ec2af9a05731a40
-
SHA1
c981ceba9a5b29b1009af554d12a7817cee802db
-
SHA256
e0b43431908bdaa74ee3df9b069951a2e237336fa42cb71ef5da2de6b15b7435
-
SHA512
5381607ce49f093a58e23f09d1307506a63d90030bf95d975670870b3d44257330527b8dfbaee53eeea4960f275e3205f802420e88053ff8fd2bcf8e7283c358
-
SSDEEP
98304:qYiM41pHpp9Zd1exMKE2q4+prBzkqXf0FJ7WLYWk4/hwftm6Tx:qYiMcpHpp9Zd1eNBYlzkSIJ74YWk4mVV
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
-
Drops file in Windows directory 7 IoCs
-
Modifies Internet Explorer settings 1 TTPs 4 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: MapViewOfSection 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Project-ALM.exe"C:\Users\Admin\AppData\Local\Temp\Project-ALM.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\Project-ALM.exe"C:\Users\Admin\AppData\Local\Temp\Project-ALM.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
576B
MD5a78fc0417076b521be811780549a3b96
SHA1e24b8e51fcca383ea52f7679cce938783c69104c
SHA256b48aeb2d9c0ef2443f0ebeb92e969ce35df421c60e0e755dffe809657e2c416a
SHA512ec8fd6a7840d69e45501956bffdc4ee42ecb59ca872ae4181a68d82491e53f2b564d5f0b838f3f2ea4381cea746865385c78f915fc41e06c4938f9f06f9462f7
-
Filesize
575B
MD5cc82a533f42b895853e7e1e313c2a0e7
SHA19799e20a51b5b2acd10335b3f85814344ce432fc
SHA2563124a3c5dc4b72e8f258f646417c85335b889c95c875ed398d99feda43ad5f59
SHA512800ba96dc65806ee9f7504ece0ab9f0e92017e48c1445e12a504bbfea8e1c59b1de986a66dc0f552f081794bdab747d19f52be5c526fb86bf8c160a7438dc0a2
-
Filesize
2KB
MD5c2d9a71e254c064c3f169aec667c843a
SHA1a2f0e6e4d51a0762dd33e4887b267e6897683538
SHA256db8553d65c93fa8105affd5f7b56dcb97e16f9dcd3b363bb9f6eb66329c3d14e
SHA512539f47bc4f893caf82717e2f953e6fa70066934388abc7103fb6ecfb0d2b075f35c7d7c9f50ba1e216af9896522566ee615a0f1fef985e4f5cc98d7c04e7dc91
-
Filesize
5KB
MD5f3418a443e7d841097c714d69ec4bcb8
SHA149263695f6b0cdd72f45cf1b775e660fdc36c606
SHA2566da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
SHA51282d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563
-
Filesize
512KB
MD5462a2dfab55aa6d5d1cbe73725c5aebd
SHA1964d1102c3ebbb0e958dc59efd3f791a97defccf
SHA2561e49f0b0159f95590ca51a68e062a8026b4d4aa807c499c42060a3b85f5b9153
SHA5124e11a21bdf51624a70daef01ba7813a10808140a2f60272a1a357b4d2ae4f0a495b4ed46bf6caa1e91ada096a5964eace845ad896bd43b781d7b7267a89c7b55
-
Filesize
16KB
MD5c5dfdcbb0b214f6f22845aee027a3981
SHA1c87740b14157d3de4e0831fabf074e63c4422de9
SHA25678bc4647f26647a6aff3a96b252539fab203603fa876594b17c26d0f0745c022
SHA5125c368d5ea24a9396821917f00c25a353c85ae3a64525daf28ae9a53adcfa67ea375dd6ffdc6ddbc3e1caa2c65208b5fa07f7d7df4f21907dcbf2ea01b9b040e6
-
Filesize
512KB
MD582220e28e514f4f1bcb10c121f1c3a68
SHA14f73273cc53520e9be7ac28340ff36155a818885
SHA256ade7185513c28ac32211d9c9ed828dbdb84fd7e42c7b08fbd033f89dd5ee9e1f
SHA512345dd0387daae20543e6c34cb19714c248798134929d689a799bf5aeba579c87a43977e1a8ab1f8668aa0f310b5637bb6b5f739d0bce2cbacb3fb3e1d64d0ee3
-
Filesize
8KB
MD55ce9de1182bd2015b3d08803c9f46d7c
SHA1f228c9e2e33ef1a63039fad1f1ad1263ef423754
SHA2569f4aef1a69b87eb89936cfbcb95fdb3acd0cd0be5317cacc2c2c02b6a9a30aaa
SHA512cfab3731df0471e25aed7779fe836cef9c0e70adbf2d765f39e9812ee4aaa42649d303202963df44e271abc15a4485deb19040d83fa4c899a0e8478c326ea69a
-
Filesize
2.0MB
MD5722e00f21143d2b34d483f929e2dfe01
SHA16c367d9d60647ada51a283a85a4f0afe7a850c80
SHA25686dacba0c2ff67d83e78ec15314dc8885d6aee9a319d7fddc9c2fce78fed6009
SHA51215ab809f99c543e4a2b5ec9d91a4cfb50e62193f697bfd556a11aed2fea618c77732af56c774bda3713957c42c66c215f450d3b31e590d9787d5b1607b12c537
-
Filesize
16KB
MD54eafa65ea60e7ea69af24b41858032bb
SHA10c53913ef475a8ac239d0ac0d553d7ece02b3886
SHA256c0bb84fa14d8f5e1221eae84271bddae56244155847f0dfda7c8a070d2b6bae7
SHA5129eec5cc737c1918a6c373e1dcc46f9e6da3015bf82688c2f43b4b410aec55613ab6f0f452c8374fed5ab006efaa907b04dedbf8e9a51caccbe4106b955c84d25
-
Filesize
5KB
MD51f8e6ebb30a5082b079205de058c383a
SHA1b01e8122c0191e81e1fc8305490cfaaf4ac4e874
SHA25640fceedeb7e6163efaae08e7e77776ddcce8e0489c5d16d1581dcc3c72323880
SHA512f7756d96dbf6885965f26edc102c54c8337d7d9f2c1d4a8d9195bdaf16d04c55d9983f88640656e2b44c58e00fc9d20eb7963981ac65480fadcc617297ae1a6b
-
Filesize
5KB
MD5dbb54cae123082b88ae8617dd7956de3
SHA1f6fda5f03c9eb962cff7ad85623e397f1c3781ab
SHA2562cf90b81402eda2cc4cd88322c088ef8b8f22534584ce71fa132292b16050c7a
SHA512992b0f12795c4b00b94b9fe1dcf02f649818c0fcf8008137c353e85c04583ed87084c79371463400129e26a1b8ff53683490beae8370e11e13fe3c12bdd636b2
-
Filesize
7KB
MD5373576683cce510e2e899d52680dfae3
SHA1bd664766b9bfb6bb309e34b2329834204fe2d7c1
SHA256aa4d8c1e300f18b6c132d87ae5219e6ca955cdff4981dde82ec2d4613a5a140f
SHA512fb91802121333ebf734f28769c0aef13a3c05e1b4c0f44d3aa849cca71770d262d24e9d352b743975c4123ae2f52fa1aa0ab708d975eac5a8bc20a780793d78c
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
1024KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
5.5MB
-
Filesize
5.0MB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
768KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
712KB
-
Filesize
136KB
-
Filesize
3.3MB
-
Filesize
464KB
-
Filesize
600KB
-
Filesize
136KB
-
Filesize
1024KB
-
Filesize
1024KB