Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
22-10-2024 20:29
General
-
Target
BFP-AH5112-1.21.14.0.exe
-
Size
1.2MB
-
MD5
11ed6a7cd05d047a446e4cdc5aec90dc
-
SHA1
c569ec9336e772705caa7020553cf1e6a18c083c
-
SHA256
ef8e7bf8960b76f6dd31ff6b0cca88e6f24e7a8d415639cf1aa3a558efba1d73
-
SHA512
a39fe8643274fe7f8cc2b17c750366a96bc7721a075cb0f89d9e029c20d2b2446394e73dee77753cb4190f1b529a040c94a0d00cdda93a5a4820c810207e7dfa
-
SSDEEP
24576:F86glZF4Iflxe2nBUf32CtPd4LibDwQ0lJ/kD91BoQ9uZUR+zZdQ:hKZxoUBq3PPd0QDMapV9u1O
Malware Config
Signatures
-
Detect ZGRat V2 1 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 5 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 8 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\BFP-AH5112-1.21.14.0.exe"C:\Users\Admin\AppData\Local\Temp\BFP-AH5112-1.21.14.0.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-0S2EA.tmp\BFP-AH5112-1.21.14.0.tmp"C:\Users\Admin\AppData\Local\Temp\is-0S2EA.tmp\BFP-AH5112-1.21.14.0.tmp" /SL5="$4010A,839104,121344,C:\Users\Admin\AppData\Local\Temp\BFP-AH5112-1.21.14.0.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD5c76fcd0975a281141d629d07ab9baf7e
SHA19e66dbebe28e86e92933f1ec12cacc30950276e7
SHA2568339ee4145324c9e0d85585a18b01d3d7af819ef45201232663ce8dae5bde823
SHA5122da611cefe68011bed3a549dbb4e708fd9a5bd42feaa02c683c2263719df3b03c0360aa5a6ea8cfccd14cb9cbd4286aff3229b27d6ff47a0cea6e1994ba87aff
-
Filesize
1.2MB
MD568f115b526a84948c1fec83b7a0a1ad0
SHA194a1c0b8622d2e3293a7091cc81f4f2bbb9728bd
SHA25654f1571d6930cbc0c30e0ad44086fd7572288872ae8d4218c8bd814559a44f38
SHA51206bb2bf6fafd58a785c12331d6e5d35bac0b044180aed43805e9d4e2727c49b800c0b2f88146e71ee1eb507602206bb886a6f400c43972609834c1e328407b21
-
Filesize
1.1MB
MD534acc2bdb45a9c436181426828c4cb49
SHA15adaa1ac822e6128b8d4b59a54d19901880452ae
SHA2569c81817acd4982632d8c7f1df3898fca1477577738184265d735f49fc5480f07
SHA512134ff4022571efd46f7a62e99b857ebe834e9916c786345908010f9e1fb90be226b740ddee16ae9290fe45c86be7238c4555e422abe66a461d11545e19734beb
-
Filesize
121KB
MD548ad1a1c893ce7bf456277a0a085ed01
SHA1803997ef17eedf50969115c529a2bf8de585dc91
SHA256b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3
SHA5127c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4
-
Filesize
160KB
-
Filesize
68KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB