Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
15-05-2024 13:34
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240221-en
General
-
Target
file.exe
-
Size
3.7MB
-
MD5
e77976974a972c65cb25253540f47991
-
SHA1
186cc8aecf6d842617847664b7749cfa51a6670d
-
SHA256
9d7d0bf89ec473e919eb4c8de51b48f90e5afdc94fd99c09f94863f78086c432
-
SHA512
ee4e679e948e8d42a704df0e1dca106056da65c48e7ca97aec5c5c0720569be78027e72c57773f16b6bc1cbd1ba2cb0a04238c19e3116af7176f73bd8c9ecb17
-
SSDEEP
98304:QaSNSfTz9wabjIKXScmmZ6n205zg1FNd:QaSNSfTzCafV0Ay205E1F
Malware Config
Signatures
-
Detect ZGRat V1 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1116-1-0x00000000002D0000-0x0000000000688000-memory.dmp family_zgrat_v1 behavioral2/memory/4024-14-0x0000000000400000-0x0000000000490000-memory.dmp family_zgrat_v1 -
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
Processes:
resource yara_rule behavioral2/memory/1116-1-0x00000000002D0000-0x0000000000688000-memory.dmp net_reactor -
Loads dropped DLL 1 IoCs
Processes:
file.exepid process 1116 file.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
file.exedescription pid process target process PID 1116 set thread context of 4024 1116 file.exe MsBuild.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
MsBuild.exepid process 4024 MsBuild.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
MsBuild.exedescription pid process Token: SeDebugPrivilege 4024 MsBuild.exe Token: SeBackupPrivilege 4024 MsBuild.exe Token: SeSecurityPrivilege 4024 MsBuild.exe Token: SeSecurityPrivilege 4024 MsBuild.exe Token: SeSecurityPrivilege 4024 MsBuild.exe Token: SeSecurityPrivilege 4024 MsBuild.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
file.exedescription pid process target process PID 1116 wrote to memory of 4024 1116 file.exe MsBuild.exe PID 1116 wrote to memory of 4024 1116 file.exe MsBuild.exe PID 1116 wrote to memory of 4024 1116 file.exe MsBuild.exe PID 1116 wrote to memory of 4024 1116 file.exe MsBuild.exe PID 1116 wrote to memory of 4024 1116 file.exe MsBuild.exe PID 1116 wrote to memory of 4024 1116 file.exe MsBuild.exe PID 1116 wrote to memory of 4024 1116 file.exe MsBuild.exe PID 1116 wrote to memory of 4024 1116 file.exe MsBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Protect544cd51a.dllFilesize
742KB
MD5544cd51a596619b78e9b54b70088307d
SHA14769ddd2dbc1dc44b758964ed0bd231b85880b65
SHA256dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd
SHA512f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719
-
memory/1116-10-0x0000000005080000-0x0000000005090000-memory.dmpFilesize
64KB
-
memory/1116-2-0x00000000050A0000-0x000000000513C000-memory.dmpFilesize
624KB
-
memory/1116-3-0x0000000075280000-0x0000000075A30000-memory.dmpFilesize
7.7MB
-
memory/1116-4-0x00000000051F0000-0x0000000005382000-memory.dmpFilesize
1.6MB
-
memory/1116-1-0x00000000002D0000-0x0000000000688000-memory.dmpFilesize
3.7MB
-
memory/1116-17-0x00000000051EC000-0x00000000051EF000-memory.dmpFilesize
12KB
-
memory/1116-11-0x0000000075280000-0x0000000075A30000-memory.dmpFilesize
7.7MB
-
memory/1116-12-0x0000000075280000-0x0000000075A30000-memory.dmpFilesize
7.7MB
-
memory/1116-13-0x0000000075280000-0x0000000075A30000-memory.dmpFilesize
7.7MB
-
memory/1116-0-0x000000007528E000-0x000000007528F000-memory.dmpFilesize
4KB
-
memory/1116-16-0x0000000075280000-0x0000000075A30000-memory.dmpFilesize
7.7MB
-
memory/1116-18-0x0000000075280000-0x0000000075A30000-memory.dmpFilesize
7.7MB
-
memory/4024-19-0x0000000075280000-0x0000000075A30000-memory.dmpFilesize
7.7MB
-
memory/4024-27-0x0000000008390000-0x00000000083CC000-memory.dmpFilesize
240KB
-
memory/4024-20-0x00000000057A0000-0x0000000005D44000-memory.dmpFilesize
5.6MB
-
memory/4024-21-0x00000000051F0000-0x0000000005282000-memory.dmpFilesize
584KB
-
memory/4024-22-0x0000000075280000-0x0000000075A30000-memory.dmpFilesize
7.7MB
-
memory/4024-23-0x00000000051A0000-0x00000000051AA000-memory.dmpFilesize
40KB
-
memory/4024-24-0x0000000008880000-0x0000000008E98000-memory.dmpFilesize
6.1MB
-
memory/4024-25-0x00000000083F0000-0x00000000084FA000-memory.dmpFilesize
1.0MB
-
memory/4024-26-0x0000000008330000-0x0000000008342000-memory.dmpFilesize
72KB
-
memory/4024-14-0x0000000000400000-0x0000000000490000-memory.dmpFilesize
576KB
-
memory/4024-28-0x0000000008500000-0x000000000854C000-memory.dmpFilesize
304KB
-
memory/4024-29-0x0000000008680000-0x00000000086E6000-memory.dmpFilesize
408KB
-
memory/4024-30-0x0000000009120000-0x0000000009196000-memory.dmpFilesize
472KB
-
memory/4024-31-0x00000000090C0000-0x00000000090DE000-memory.dmpFilesize
120KB
-
memory/4024-32-0x0000000009E00000-0x0000000009FC2000-memory.dmpFilesize
1.8MB
-
memory/4024-33-0x000000000A500000-0x000000000AA2C000-memory.dmpFilesize
5.2MB
-
memory/4024-35-0x0000000075280000-0x0000000075A30000-memory.dmpFilesize
7.7MB