Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19-11-2024 20:08
General
-
Target
BFP-AH860-1.21.25.0.exe
-
Size
1.2MB
-
MD5
b5e6f01303b2ee60a1b0ab075a07d352
-
SHA1
1ed0d38e0960aae2a63473ab8eacaf7a062e7ba8
-
SHA256
d24b60bc4292559c83febd7af9a0f04eebe9033cdc31397262b3a5d22ef21204
-
SHA512
423203b6dc46e335c58cd5d089c476197327aff5f4fcaa77ebb74ded7f546724d3c561f3d6631885572674a63db4f3c7837cb0f7fcaed9183090d0afb2d232b5
-
SSDEEP
24576:F86tlRuBZxstmMN4Lytziq14RyuOmBL91BoQ9uZUR+zZdQ:hRIZxs9SLycqeBLpV9u1O
Malware Config
Signatures
-
Detect ZGRat V2 1 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Zgrat family
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 5 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 8 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\BFP-AH860-1.21.25.0.exe"C:\Users\Admin\AppData\Local\Temp\BFP-AH860-1.21.25.0.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-JJ2RR.tmp\BFP-AH860-1.21.25.0.tmp"C:\Users\Admin\AppData\Local\Temp\is-JJ2RR.tmp\BFP-AH860-1.21.25.0.tmp" /SL5="$30148,839510,121344,C:\Users\Admin\AppData\Local\Temp\BFP-AH860-1.21.25.0.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD534acc2bdb45a9c436181426828c4cb49
SHA15adaa1ac822e6128b8d4b59a54d19901880452ae
SHA2569c81817acd4982632d8c7f1df3898fca1477577738184265d735f49fc5480f07
SHA512134ff4022571efd46f7a62e99b857ebe834e9916c786345908010f9e1fb90be226b740ddee16ae9290fe45c86be7238c4555e422abe66a461d11545e19734beb
-
Filesize
1.8MB
MD56048880cb20cb19da24ba9d9f888bfc5
SHA157c54ca8d4950a25fe1941bd78e0c0fb9cf7f7a5
SHA256b735c8431604f929b7968b7a675e0935bbbf9a0e054a7d5eef26fc6affab8aba
SHA51240d768bbf0c3aac01c550ad72d4b85857fba59a51f0de3c5f1b094704ef60f5ea0ddead24794e6863a10fffaf80337fea7d45c0078a143ad8431cf817e2cc6f7
-
Filesize
1.2MB
MD5be545d1b25028c5e9f861633546146cc
SHA1e02b58cdf6bb28ea8761c70b22ef2baa327dabcc
SHA256e81c4fcf045ed5588c45ba455903e5449c9d24518dfc0d7cfcc5efc02ea9f27f
SHA51250a772f82d1ee0176d0d3bef87a98eb88ab5497478bc9ab63113c7483d676a04b720d31b68fd90e6d68477c4982f9139b92fe21ea615bb6f6f3ded13f4ec3155
-
Filesize
121KB
MD548ad1a1c893ce7bf456277a0a085ed01
SHA1803997ef17eedf50969115c529a2bf8de585dc91
SHA256b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3
SHA5127c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
68KB
-
Filesize
160KB