Overview

overview

10

Static

static

10

132ef1a933...c3.exe

windows7-x64

10

132ef1a933...c3.exe

windows10-2004-x64

10

Resubmissions

15-05-2024 08:14

240515-j493fagf47 10

15-05-2024 08:01

240515-jwlpwagc37 10

Analysis

  • max time kernel
    134s
  • max time network
    203s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-05-2024 08:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    132ef1a933f9d26fb0bb46b0a970dbfe05ad8fe0859ece8eb973b5584a580cc3.exe

  • Size

    2.6MB

  • MD5

    71f0e2645d9051c3a8f5cf2dbce9d074

  • SHA1

    a303632965f9fdc3b7cb4c532831c0b38f24df90

  • SHA256

    132ef1a933f9d26fb0bb46b0a970dbfe05ad8fe0859ece8eb973b5584a580cc3

  • SHA512

    14625c8fe238a41c0a45579731a15a705f153681a0f4e212b8315e3f5643542c57e17f82c247552b21417aa92dce36fd40fbcaaf85b4fb462182c2814f4f8077

  • SSDEEP

    49152:Til/s9YkCKuT/s9YEQtQRTMYIMi7ztf33cSywWyFoEgn9u:OVsGkClzsG1tQRjdih8rwc

Score
10/10
zgratransomwareratspywarestealer

Malware Config

Signatures

  • Detect ZGRat V1 1 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • .NET Reactor proctector 1 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\132ef1a933f9d26fb0bb46b0a970dbfe05ad8fe0859ece8eb973b5584a580cc3.exe
    "C:\Users\Admin\AppData\Local\Temp\132ef1a933f9d26fb0bb46b0a970dbfe05ad8fe0859ece8eb973b5584a580cc3.exe"
    1⤵
    • Sets desktop wallpaper using registry
    • Suspicious use of AdjustPrivilegeToken
    PID:3308

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Defacement

1
T1491

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3308-1-0x00007FFD9E693000-0x00007FFD9E695000-memory.dmp
    Filesize

    8KB

    Download
  • memory/3308-0-0x0000014521360000-0x00000145215FA000-memory.dmp
    Filesize

    2.6MB

    Download
  • memory/3308-2-0x00007FFD9E690000-0x00007FFD9F151000-memory.dmp
    Filesize

    10.8MB

    Download
  • memory/3308-8-0x00007FFD9E690000-0x00007FFD9F151000-memory.dmp
    Filesize

    10.8MB

    Download
  • memory/3308-9-0x00007FFD9E690000-0x00007FFD9F151000-memory.dmp
    Filesize

    10.8MB

    Download
  • memory/3308-10-0x00007FFD9E690000-0x00007FFD9F151000-memory.dmp
    Filesize

    10.8MB

    Download