Analysis
-
max time kernel
135s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-10-2024 20:29
General
-
Target
BFP-AH5112-1.21.14.0.exe
-
Size
1.2MB
-
MD5
11ed6a7cd05d047a446e4cdc5aec90dc
-
SHA1
c569ec9336e772705caa7020553cf1e6a18c083c
-
SHA256
ef8e7bf8960b76f6dd31ff6b0cca88e6f24e7a8d415639cf1aa3a558efba1d73
-
SHA512
a39fe8643274fe7f8cc2b17c750366a96bc7721a075cb0f89d9e029c20d2b2446394e73dee77753cb4190f1b529a040c94a0d00cdda93a5a4820c810207e7dfa
-
SSDEEP
24576:F86glZF4Iflxe2nBUf32CtPd4LibDwQ0lJ/kD91BoQ9uZUR+zZdQ:hKZxoUBq3PPd0QDMapV9u1O
Malware Config
Signatures
-
Detect ZGRat V2 1 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 8 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\BFP-AH5112-1.21.14.0.exe"C:\Users\Admin\AppData\Local\Temp\BFP-AH5112-1.21.14.0.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-QOR9A.tmp\BFP-AH5112-1.21.14.0.tmp"C:\Users\Admin\AppData\Local\Temp\is-QOR9A.tmp\BFP-AH5112-1.21.14.0.tmp" /SL5="$601F6,839104,121344,C:\Users\Admin\AppData\Local\Temp\BFP-AH5112-1.21.14.0.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD5c76fcd0975a281141d629d07ab9baf7e
SHA19e66dbebe28e86e92933f1ec12cacc30950276e7
SHA2568339ee4145324c9e0d85585a18b01d3d7af819ef45201232663ce8dae5bde823
SHA5122da611cefe68011bed3a549dbb4e708fd9a5bd42feaa02c683c2263719df3b03c0360aa5a6ea8cfccd14cb9cbd4286aff3229b27d6ff47a0cea6e1994ba87aff
-
Filesize
1.1MB
MD534acc2bdb45a9c436181426828c4cb49
SHA15adaa1ac822e6128b8d4b59a54d19901880452ae
SHA2569c81817acd4982632d8c7f1df3898fca1477577738184265d735f49fc5480f07
SHA512134ff4022571efd46f7a62e99b857ebe834e9916c786345908010f9e1fb90be226b740ddee16ae9290fe45c86be7238c4555e422abe66a461d11545e19734beb
-
Filesize
121KB
MD548ad1a1c893ce7bf456277a0a085ed01
SHA1803997ef17eedf50969115c529a2bf8de585dc91
SHA256b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3
SHA5127c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
160KB
-
Filesize
68KB
-
Filesize
160KB
-
Filesize
160KB