zgrat | 871978fb97af5fca44a98714b79a3e86dfdb468eed6980dadc7f2bf7e5bf1aaa

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	wxcjedkcuxdmxaermwi.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	YKM.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	YKM.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	YKM.exe

Downloads MZ/PE file

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral11/memory/992-0-0x000001FC57700000-0x000001FC57E86000-memory.dmp	net_reactor

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	YKM.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	YKM.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	YKM.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	YKM.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	YKM.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	YKM.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wxcjedkcuxdmxaermwi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	wxcjedkcuxdmxaermwi.exe

Executes dropped EXE 4 IoCs

pid	Process
4044	wxcjedkcuxdmxaermwi.exe
3604	YKM.exe
4860	YKM.exe
1612	YKM.exe

Themida packer 38 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral11/files/0x000700000001ab7d-48.dat	themida
behavioral11/files/0x000700000001ab7d-49.dat	themida
behavioral11/memory/4044-50-0x0000000001290000-0x0000000001EE0000-memory.dmp	themida
behavioral11/memory/4044-51-0x0000000001290000-0x0000000001EE0000-memory.dmp	themida
behavioral11/memory/4044-56-0x0000000001290000-0x0000000001EE0000-memory.dmp	themida
behavioral11/memory/4044-57-0x0000000001290000-0x0000000001EE0000-memory.dmp	themida
behavioral11/memory/4044-58-0x0000000001290000-0x0000000001EE0000-memory.dmp	themida
behavioral11/memory/4044-59-0x0000000001290000-0x0000000001EE0000-memory.dmp	themida
behavioral11/memory/4044-60-0x0000000001290000-0x0000000001EE0000-memory.dmp	themida
behavioral11/memory/4044-66-0x0000000001290000-0x0000000001EE0000-memory.dmp	themida
behavioral11/files/0x000600000001abdc-68.dat	themida
behavioral11/files/0x000600000001abdc-69.dat	themida
behavioral11/files/0x000600000001abdc-70.dat	themida
behavioral11/memory/3604-71-0x0000000000260000-0x0000000000EB0000-memory.dmp	themida
behavioral11/memory/3604-72-0x0000000000260000-0x0000000000EB0000-memory.dmp	themida
behavioral11/memory/3604-76-0x0000000000260000-0x0000000000EB0000-memory.dmp	themida
behavioral11/memory/3604-77-0x0000000000260000-0x0000000000EB0000-memory.dmp	themida
behavioral11/memory/3604-78-0x0000000000260000-0x0000000000EB0000-memory.dmp	themida
behavioral11/memory/3604-79-0x0000000000260000-0x0000000000EB0000-memory.dmp	themida
behavioral11/memory/3604-80-0x0000000000260000-0x0000000000EB0000-memory.dmp	themida
behavioral11/memory/3604-81-0x0000000000260000-0x0000000000EB0000-memory.dmp	themida
behavioral11/files/0x000600000001abdc-82.dat	themida
behavioral11/memory/4860-83-0x0000000000260000-0x0000000000EB0000-memory.dmp	themida
behavioral11/memory/3604-87-0x0000000000260000-0x0000000000EB0000-memory.dmp	themida
behavioral11/memory/4860-88-0x0000000000260000-0x0000000000EB0000-memory.dmp	themida
behavioral11/memory/4860-89-0x0000000000260000-0x0000000000EB0000-memory.dmp	themida
behavioral11/memory/4860-90-0x0000000000260000-0x0000000000EB0000-memory.dmp	themida
behavioral11/memory/4860-91-0x0000000000260000-0x0000000000EB0000-memory.dmp	themida
behavioral11/memory/4860-92-0x0000000000260000-0x0000000000EB0000-memory.dmp	themida
behavioral11/memory/4860-93-0x0000000000260000-0x0000000000EB0000-memory.dmp	themida
behavioral11/files/0x000600000001abdc-99.dat	themida
behavioral11/memory/1612-100-0x0000000000260000-0x0000000000EB0000-memory.dmp	themida
behavioral11/memory/1612-104-0x0000000000260000-0x0000000000EB0000-memory.dmp	themida
behavioral11/memory/1612-105-0x0000000000260000-0x0000000000EB0000-memory.dmp	themida
behavioral11/memory/1612-106-0x0000000000260000-0x0000000000EB0000-memory.dmp	themida
behavioral11/memory/1612-108-0x0000000000260000-0x0000000000EB0000-memory.dmp	themida
behavioral11/memory/1612-109-0x0000000000260000-0x0000000000EB0000-memory.dmp	themida
behavioral11/memory/1612-110-0x0000000000260000-0x0000000000EB0000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wxcjedkcuxdmxaermwi.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	YKM.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	YKM.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	YKM.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\F:	1106-06-Zgrat.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
4044	wxcjedkcuxdmxaermwi.exe
3604	YKM.exe
4860	YKM.exe
1612	YKM.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 992 set thread context of 320	992	1106-06-Zgrat.exe	72

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
5092	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4960	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
992	1106-06-Zgrat.exe
992	1106-06-Zgrat.exe
992	1106-06-Zgrat.exe
992	1106-06-Zgrat.exe
992	1106-06-Zgrat.exe
992	1106-06-Zgrat.exe
992	1106-06-Zgrat.exe
992	1106-06-Zgrat.exe
992	1106-06-Zgrat.exe
992	1106-06-Zgrat.exe
4164	powershell.exe
4164	powershell.exe
4164	powershell.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe
320	AddInProcess32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4164	powershell.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 4164	992	1106-06-Zgrat.exe	70
PID 992 wrote to memory of 4164	992	1106-06-Zgrat.exe	70
PID 992 wrote to memory of 320	992	1106-06-Zgrat.exe	72
PID 992 wrote to memory of 320	992	1106-06-Zgrat.exe	72
PID 992 wrote to memory of 320	992	1106-06-Zgrat.exe	72
PID 992 wrote to memory of 320	992	1106-06-Zgrat.exe	72
PID 992 wrote to memory of 320	992	1106-06-Zgrat.exe	72
PID 992 wrote to memory of 320	992	1106-06-Zgrat.exe	72
PID 992 wrote to memory of 320	992	1106-06-Zgrat.exe	72
PID 992 wrote to memory of 320	992	1106-06-Zgrat.exe	72
PID 992 wrote to memory of 320	992	1106-06-Zgrat.exe	72
PID 320 wrote to memory of 4044	320	AddInProcess32.exe	75
PID 320 wrote to memory of 4044	320	AddInProcess32.exe	75
PID 320 wrote to memory of 4044	320	AddInProcess32.exe	75
PID 4044 wrote to memory of 4584	4044	wxcjedkcuxdmxaermwi.exe	76
PID 4044 wrote to memory of 4584	4044	wxcjedkcuxdmxaermwi.exe	76
PID 4044 wrote to memory of 4584	4044	wxcjedkcuxdmxaermwi.exe	76
PID 4584 wrote to memory of 4960	4584	cmd.exe	78
PID 4584 wrote to memory of 4960	4584	cmd.exe	78
PID 4584 wrote to memory of 4960	4584	cmd.exe	78
PID 4584 wrote to memory of 3604	4584	cmd.exe	79
PID 4584 wrote to memory of 3604	4584	cmd.exe	79
PID 4584 wrote to memory of 3604	4584	cmd.exe	79
PID 3604 wrote to memory of 5092	3604	YKM.exe	80
PID 3604 wrote to memory of 5092	3604	YKM.exe	80
PID 3604 wrote to memory of 5092	3604	YKM.exe	80

C:\Users\Admin\AppData\Local\Temp\1106-06-Zgrat.exe
"C:\Users\Admin\AppData\Local\Temp\1106-06-Zgrat.exe"
1⤵
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAwAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4164
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:320
- - C:\Users\Admin\AppData\Local\Temp\wxcjedkcuxdmxaermwi.exe
    "C:\Users\Admin\AppData\Local\Temp\wxcjedkcuxdmxaermwi.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of WriteProcessMemory
    PID:4044
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\s34c.0.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4584
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:4960
    - - C:\ProgramData\SMUCCI\YKM.exe
        
        "C:\ProgramData\SMUCCI\YKM.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of WriteProcessMemory
        
        PID:3604
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /RL HIGHEST /tn "YKM" /tr C:\ProgramData\SMUCCI\YKM.exe /f
        6⤵
        Creates scheduled task(s)
        
        PID:5092

C:\ProgramData\SMUCCI\YKM.exe
C:\ProgramData\SMUCCI\YKM.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4860

C:\ProgramData\SMUCCI\YKM.exe
C:\ProgramData\SMUCCI\YKM.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery