Overview

overview

10

Static

static

10

132ef1a933...c3.exe

windows7-x64

10

132ef1a933...c3.exe

windows10-2004-x64

10

Resubmissions

15-05-2024 08:14

240515-j493fagf47 10

15-05-2024 08:01

240515-jwlpwagc37 10

Analysis

  • max time kernel
    299s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    15-05-2024 08:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    132ef1a933f9d26fb0bb46b0a970dbfe05ad8fe0859ece8eb973b5584a580cc3.exe

  • Size

    2.6MB

  • MD5

    71f0e2645d9051c3a8f5cf2dbce9d074

  • SHA1

    a303632965f9fdc3b7cb4c532831c0b38f24df90

  • SHA256

    132ef1a933f9d26fb0bb46b0a970dbfe05ad8fe0859ece8eb973b5584a580cc3

  • SHA512

    14625c8fe238a41c0a45579731a15a705f153681a0f4e212b8315e3f5643542c57e17f82c247552b21417aa92dce36fd40fbcaaf85b4fb462182c2814f4f8077

  • SSDEEP

    49152:Til/s9YkCKuT/s9YEQtQRTMYIMi7ztf33cSywWyFoEgn9u:OVsGkClzsG1tQRjdih8rwc

Score
10/10
zgratransomwareratspywarestealer

Malware Config

Signatures

  • Detect ZGRat V1 1 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • .NET Reactor proctector 1 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\132ef1a933f9d26fb0bb46b0a970dbfe05ad8fe0859ece8eb973b5584a580cc3.exe
    "C:\Users\Admin\AppData\Local\Temp\132ef1a933f9d26fb0bb46b0a970dbfe05ad8fe0859ece8eb973b5584a580cc3.exe"
    1⤵
    • Sets desktop wallpaper using registry
    • Suspicious use of AdjustPrivilegeToken
    PID:1992

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Defacement

1
T1491

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1992-0-0x000007FEF5BB3000-0x000007FEF5BB4000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1992-1-0x0000000000910000-0x0000000000BAA000-memory.dmp
    Filesize

    2.6MB

    Download
  • memory/1992-2-0x000007FEF5BB0000-0x000007FEF659C000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/1992-9-0x000007FEF5BB0000-0x000007FEF659C000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/1992-10-0x000007FEF5BB0000-0x000007FEF659C000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/1992-11-0x000007FEF5BB3000-0x000007FEF5BB4000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1992-12-0x000007FEF5BB0000-0x000007FEF659C000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/1992-13-0x000007FEF5BB0000-0x000007FEF659C000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/1992-14-0x000007FEF5BB0000-0x000007FEF659C000-memory.dmp
    Filesize

    9.9MB

    Download