Overview

overview

10

Static

static

3

BlackBullet2.exe

windows7-x64

10

BlackBullet2.exe

windows10-2004-x64

10

Data/BB2.exe

windows7-x64

10

Data/BB2.exe

windows10-2004-x64

10

Data/BlackBullet2.exe

windows7-x64

10

Data/BlackBullet2.exe

windows10-2004-x64

10

Data/Docum...5).pdf

windows7-x64

3

Data/Docum...5).pdf

windows10-2004-x64

3

Data/Docum...OK.pdf

windows7-x64

3

Data/Docum...OK.pdf

windows10-2004-x64

3

Data/DotNetZip.dll

windows7-x64

1

Data/DotNetZip.dll

windows10-2004-x64

1

Data/bin/A...rp.dll

windows7-x64

1

Data/bin/A...rp.dll

windows10-2004-x64

1

Data/bin/A...ry.dll

windows7-x64

1

Data/bin/A...ry.dll

windows10-2004-x64

1

Data/bin/D...ry.dll

windows7-x64

1

Data/bin/D...ry.dll

windows10-2004-x64

1

Data/bin/D...ha.dll

windows7-x64

1

Data/bin/D...ha.dll

windows10-2004-x64

1

Data/bin/E...et.dll

windows7-x64

1

Data/bin/E...et.dll

windows10-2004-x64

1

Data/bin/I...it.dll

windows7-x64

1

Data/bin/I...it.dll

windows10-2004-x64

1

Data/bin/I...rs.dll

windows7-x64

1

Data/bin/I...rs.dll

windows10-2004-x64

1

Data/bin/I...es.dll

windows7-x64

1

Data/bin/I...es.dll

windows10-2004-x64

1

Data/bin/I...te.dll

windows7-x64

1

Data/bin/I...te.dll

windows10-2004-x64

1

Data/bin/I...pf.dll

windows7-x64

1

Data/bin/I...pf.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-10-2024 21:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Data/BlackBullet2.exe

  • Size

    6.6MB

  • MD5

    65b716d641a1a0f1d4652d4201bde84e

  • SHA1

    39b49bb45ad3204daf92fa9d5545a2e8a5f083d9

  • SHA256

    934d3d466a25472f639188ea088a2c01198bdcbe418841cfa65b85cf97f100d5

  • SHA512

    95f37ba7612650b331802cf7a14dfcc544f7d18d479067e156652fd428ce72fe6cdfd41f22dd5a8c81828e182156b34f85f15f31bb587b18633a9ae97bfb75e7

  • SSDEEP

    98304:uhRqWnKpGc6sz3vNJzQLJco5h7D4TEBRmwf76t:cApGc6ojz6TDEaV+t

Score
10/10
zgratdiscoveryrat

Malware Config

Signatures

  • Detect ZGRat V2 1 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Zgrat family
    zgrat
  • Loads dropped DLL 6 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\Data\BlackBullet2.exe
    "C:\Users\Admin\AppData\Local\Temp\Data\BlackBullet2.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:540

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\evb781F.tmp
    Filesize

    1KB

    MD5

    ffce54e20826d374ab5e2ee01b4cb247

    SHA1

    ec13d3732150aec775d71d9d3d97f25995a1eb88

    SHA256

    d5aada4701f8cf3cb22fa5092c98e784741dbf84d9905daf0928b9270a0ec11a

    SHA512

    266673cc361747987ac5ca1b3a0c136f8812405a4646b5be7df18639ee6b893eb26429a41c2fa0b7ddb250289af86fbb7893dce4ddf5b37cd22fa7aace2e2d3d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\evb7850.tmp
    Filesize

    1KB

    MD5

    0ce4834f5cba48c98b0956c0de6d9169

    SHA1

    53e862ef50a712a43ebb11edbabe85edbc9011b9

    SHA256

    cd27cf9a36d0f791925d581b4f107536428026e5ec67ac8ec064cfb855d1c135

    SHA512

    3be3497f811339c6ce2f3d16d43e97d7b83da40ae1c54b6ac53e7dee23d71439318111a7967e16131eb46b62aae84ce54ee5a819cdeece6a9576df5595b3dbd0

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\evb7881.tmp
    Filesize

    1KB

    MD5

    992f3b6741f74aeba23a38aa61665501

    SHA1

    ea1dc14e3dbfd10e5b78e0c5c66b99c90bff507d

    SHA256

    6acbecfd4644be3ab04625dc517d812abdd0437d68980d55dcbda319f6e184c1

    SHA512

    32c6151a270aa32317fc2878ca216fd512379b48238448da383e68168e527265d234d7e63ae3603fb09929282b62c5fae0539222814f25d3e0268bac0b6c6d37

    Download Submit

  • memory/540-4-0x0000000000400000-0x00000000008FA000-memory.dmp

    Filesize

    5.0MB

    Download

  • memory/540-2-0x0000000077523000-0x0000000077524000-memory.dmp

    Filesize

    4KB

    Download

  • memory/540-5-0x00000000743A0000-0x0000000074B50000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/540-9-0x0000000000D80000-0x0000000000DA0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/540-3-0x00000000743AE000-0x00000000743AF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/540-1-0x0000000077522000-0x0000000077523000-memory.dmp

    Filesize

    4KB

    Download

  • memory/540-22-0x0000000003180000-0x000000000319C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/540-0-0x0000000000400000-0x0000000000940000-memory.dmp

    Filesize

    5.2MB

    Download

  • memory/540-31-0x0000000005EC0000-0x0000000005F2A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/540-33-0x0000000005840000-0x00000000058AA000-memory.dmp

    Filesize

    424KB

    Download

  • memory/540-32-0x0000000000400000-0x0000000000940000-memory.dmp

    Filesize

    5.2MB

    Download

  • memory/540-34-0x00000000743A0000-0x0000000074B50000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/540-35-0x00000000743AE000-0x00000000743AF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/540-36-0x0000000000D80000-0x0000000000DA0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/540-42-0x0000000005840000-0x0000000005846000-memory.dmp

    Filesize

    24KB

    Download

  • memory/540-43-0x00000000743A0000-0x0000000074B50000-memory.dmp

    Filesize

    7.7MB

    Download