Resubmissions
08-09-2024 21:25
240908-z94qlsydkd 701-09-2024 03:28
240901-d1bgtazgqr 720-08-2024 00:24
240820-ap5pqsxgpl 731-07-2024 23:45
240731-3r53hazcqq 721-07-2024 05:34
240721-f9jwnavekb 719-07-2024 11:42
240719-nvdebsseqe 715-07-2024 02:08
240715-ckmpgatall 712-07-2024 03:13
240712-dqsncawemk 710-07-2024 03:52
240710-efav8avfkr 710-07-2024 03:26
240710-dzd7bawbpf 7Analysis
-
max time kernel
444s -
max time network
457s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
-
submitted
15-05-2024 00:39
General
-
Target
iplookup.exe
-
Size
2.1MB
-
MD5
cb4903c1c4f23b021905da634c002f04
-
SHA1
c2ccf3a1e5037c6e540b94a59e2c367ba8cd9090
-
SHA256
49945b5eb3f80e6bb9dba81c6c6f643245bb0831ce2f6e5abf4db12ab6709b76
-
SHA512
7f632331ba7f2fdd3c76f7f158a1cd6e79be796f2dc9f9149b7a071bb77b35fc4f0c6f189a8179eaf4947533513a3f926c879c50c8cf6cb13abdd424113f48fa
-
SSDEEP
49152:PFkR/VWoA1QfIBoq2Pkbu5Gk6hQW/3f2V1mPzidqz/CIaB2w:NkR/VMCGvj/vYkP9aB
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\iplookup.exe"C:\Users\Admin\AppData\Local\Temp\iplookup.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
2.1MB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
136KB
-
Filesize
3.3MB