Analysis
- max time kernel
92s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
29/09/2024, 15:21
General
- Target Zorara.dll
- Size 14.2MB
- Sample240929-srfshazapq
- SHA256 439c9fc897dd7026df5b9579f45b712516b4b22f4ffe3324694202530e3ba23c
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Zorara.dll,#11⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1680-0-0x00007FFF9E2DD000-0x00007FFF9EB4E000-memory.dmp
memory/1680-2-0x00007FFFBD2C0000-0x00007FFFBD2C2000-memory.dmp
memory/1680-1-0x00007FFFBD2B0000-0x00007FFFBD2B2000-memory.dmp
memory/1680-3-0x00007FFFBD2D0000-0x00007FFFBD2D2000-memory.dmp
memory/1680-4-0x00007FFFBD2E0000-0x00007FFFBD2E2000-memory.dmp
memory/1680-5-0x00007FFFBC150000-0x00007FFFBC152000-memory.dmp
memory/1680-6-0x00007FFFBC160000-0x00007FFFBC162000-memory.dmp
memory/1680-7-0x00007FFF9E1B0000-0x00007FFF9F986000-memory.dmp
memory/1680-8-0x00007FFFBADD0000-0x00007FFFBADD2000-memory.dmp
memory/1680-9-0x00007FFFBADE0000-0x00007FFFBADE2000-memory.dmp
memory/1680-14-0x000001B913050000-0x000001B913165000-memory.dmp
memory/1680-15-0x00007FFF9E2DD000-0x00007FFF9EB4E000-memory.dmp
memory/1680-16-0x00007FFF9E1B0000-0x00007FFF9F986000-memory.dmp