zgrat | 871978fb97af5fca44a98714b79a3e86dfdb468eed6980dadc7f2bf7e5bf1aaa

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	bxtpnkjcadgjmisp.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	YKM.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	YKM.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	YKM.exe

Downloads MZ/PE file

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral12/memory/3908-0-0x0000012DAE8B0000-0x0000012DAF036000-memory.dmp	net_reactor

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	bxtpnkjcadgjmisp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	bxtpnkjcadgjmisp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	YKM.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	YKM.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	YKM.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	YKM.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	YKM.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	YKM.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	1106-06-Zgrat.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	bxtpnkjcadgjmisp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	YKM.exe

Executes dropped EXE 4 IoCs

pid	Process
3776	bxtpnkjcadgjmisp.exe
1980	YKM.exe
1264	YKM.exe
1504	YKM.exe

Themida packer 38 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral12/files/0x000d000000022d50-35.dat	themida
behavioral12/files/0x000d000000022d50-36.dat	themida
behavioral12/memory/3776-37-0x0000000000C50000-0x00000000018A0000-memory.dmp	themida
behavioral12/memory/3776-38-0x0000000000C50000-0x00000000018A0000-memory.dmp	themida
behavioral12/memory/3776-43-0x0000000000C50000-0x00000000018A0000-memory.dmp	themida
behavioral12/memory/3776-44-0x0000000000C50000-0x00000000018A0000-memory.dmp	themida
behavioral12/memory/3776-45-0x0000000000C50000-0x00000000018A0000-memory.dmp	themida
behavioral12/memory/3776-46-0x0000000000C50000-0x00000000018A0000-memory.dmp	themida
behavioral12/memory/3776-47-0x0000000000C50000-0x00000000018A0000-memory.dmp	themida
behavioral12/memory/3776-53-0x0000000000C50000-0x00000000018A0000-memory.dmp	themida
behavioral12/files/0x0007000000022e77-55.dat	themida
behavioral12/files/0x0007000000022e77-56.dat	themida
behavioral12/files/0x0007000000022e77-57.dat	themida
behavioral12/memory/1980-58-0x00000000005B0000-0x0000000001200000-memory.dmp	themida
behavioral12/memory/1980-59-0x00000000005B0000-0x0000000001200000-memory.dmp	themida
behavioral12/memory/1980-63-0x00000000005B0000-0x0000000001200000-memory.dmp	themida
behavioral12/memory/1980-64-0x00000000005B0000-0x0000000001200000-memory.dmp	themida
behavioral12/memory/1980-65-0x00000000005B0000-0x0000000001200000-memory.dmp	themida
behavioral12/memory/1980-66-0x00000000005B0000-0x0000000001200000-memory.dmp	themida
behavioral12/memory/1980-67-0x00000000005B0000-0x0000000001200000-memory.dmp	themida
behavioral12/memory/1980-68-0x00000000005B0000-0x0000000001200000-memory.dmp	themida
behavioral12/files/0x0007000000022e77-70.dat	themida
behavioral12/memory/1264-71-0x00000000005B0000-0x0000000001200000-memory.dmp	themida
behavioral12/memory/1264-75-0x00000000005B0000-0x0000000001200000-memory.dmp	themida
behavioral12/memory/1264-76-0x00000000005B0000-0x0000000001200000-memory.dmp	themida
behavioral12/memory/1264-77-0x00000000005B0000-0x0000000001200000-memory.dmp	themida
behavioral12/memory/1264-78-0x00000000005B0000-0x0000000001200000-memory.dmp	themida
behavioral12/memory/1264-79-0x00000000005B0000-0x0000000001200000-memory.dmp	themida
behavioral12/memory/1264-80-0x00000000005B0000-0x0000000001200000-memory.dmp	themida
behavioral12/memory/1980-83-0x00000000005B0000-0x0000000001200000-memory.dmp	themida
behavioral12/files/0x0007000000022e77-87.dat	themida
behavioral12/memory/1504-88-0x00000000005B0000-0x0000000001200000-memory.dmp	themida
behavioral12/memory/1504-92-0x00000000005B0000-0x0000000001200000-memory.dmp	themida
behavioral12/memory/1504-93-0x00000000005B0000-0x0000000001200000-memory.dmp	themida
behavioral12/memory/1504-94-0x00000000005B0000-0x0000000001200000-memory.dmp	themida
behavioral12/memory/1504-95-0x00000000005B0000-0x0000000001200000-memory.dmp	themida
behavioral12/memory/1504-96-0x00000000005B0000-0x0000000001200000-memory.dmp	themida
behavioral12/memory/1504-97-0x00000000005B0000-0x0000000001200000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	YKM.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	YKM.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	bxtpnkjcadgjmisp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	YKM.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\F:	1106-06-Zgrat.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
3776	bxtpnkjcadgjmisp.exe
1980	YKM.exe
1264	YKM.exe
1504	YKM.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3908 set thread context of 4336	3908	1106-06-Zgrat.exe	102

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
4496	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2756	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3908	1106-06-Zgrat.exe
3908	1106-06-Zgrat.exe
3908	1106-06-Zgrat.exe
3908	1106-06-Zgrat.exe
3908	1106-06-Zgrat.exe
3908	1106-06-Zgrat.exe
3908	1106-06-Zgrat.exe
3908	1106-06-Zgrat.exe
3908	1106-06-Zgrat.exe
3908	1106-06-Zgrat.exe
5100	powershell.exe
5100	powershell.exe
5100	powershell.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe
4336	AddInProcess32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5100	powershell.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 5100	3908	1106-06-Zgrat.exe	97
PID 3908 wrote to memory of 5100	3908	1106-06-Zgrat.exe	97
PID 3908 wrote to memory of 3804	3908	1106-06-Zgrat.exe	101
PID 3908 wrote to memory of 3804	3908	1106-06-Zgrat.exe	101
PID 3908 wrote to memory of 3804	3908	1106-06-Zgrat.exe	101
PID 3908 wrote to memory of 4336	3908	1106-06-Zgrat.exe	102
PID 3908 wrote to memory of 4336	3908	1106-06-Zgrat.exe	102
PID 3908 wrote to memory of 4336	3908	1106-06-Zgrat.exe	102
PID 3908 wrote to memory of 4336	3908	1106-06-Zgrat.exe	102
PID 3908 wrote to memory of 4336	3908	1106-06-Zgrat.exe	102
PID 3908 wrote to memory of 4336	3908	1106-06-Zgrat.exe	102
PID 3908 wrote to memory of 4336	3908	1106-06-Zgrat.exe	102
PID 3908 wrote to memory of 4336	3908	1106-06-Zgrat.exe	102
PID 3908 wrote to memory of 4336	3908	1106-06-Zgrat.exe	102
PID 4336 wrote to memory of 3776	4336	AddInProcess32.exe	113
PID 4336 wrote to memory of 3776	4336	AddInProcess32.exe	113
PID 4336 wrote to memory of 3776	4336	AddInProcess32.exe	113
PID 3776 wrote to memory of 1768	3776	bxtpnkjcadgjmisp.exe	115
PID 3776 wrote to memory of 1768	3776	bxtpnkjcadgjmisp.exe	115
PID 3776 wrote to memory of 1768	3776	bxtpnkjcadgjmisp.exe	115
PID 1768 wrote to memory of 2756	1768	cmd.exe	116
PID 1768 wrote to memory of 2756	1768	cmd.exe	116
PID 1768 wrote to memory of 2756	1768	cmd.exe	116
PID 1768 wrote to memory of 1980	1768	cmd.exe	117
PID 1768 wrote to memory of 1980	1768	cmd.exe	117
PID 1768 wrote to memory of 1980	1768	cmd.exe	117
PID 1980 wrote to memory of 4496	1980	YKM.exe	119
PID 1980 wrote to memory of 4496	1980	YKM.exe	119
PID 1980 wrote to memory of 4496	1980	YKM.exe	119

C:\Users\Admin\AppData\Local\Temp\1106-06-Zgrat.exe
"C:\Users\Admin\AppData\Local\Temp\1106-06-Zgrat.exe"
1⤵
- Checks computer location settings
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAwAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5100
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:3804
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4336
- - C:\Users\Admin\AppData\Local\Temp\bxtpnkjcadgjmisp.exe
    "C:\Users\Admin\AppData\Local\Temp\bxtpnkjcadgjmisp.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of WriteProcessMemory
    PID:3776
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\s2ww.0.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1768
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:2756
    - - C:\ProgramData\SMUCCI\YKM.exe
        
        "C:\ProgramData\SMUCCI\YKM.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of WriteProcessMemory
        
        PID:1980
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /RL HIGHEST /tn "YKM" /tr C:\ProgramData\SMUCCI\YKM.exe /f
        6⤵
        Creates scheduled task(s)
        
        PID:4496

C:\ProgramData\SMUCCI\YKM.exe
C:\ProgramData\SMUCCI\YKM.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1264

C:\ProgramData\SMUCCI\YKM.exe
C:\ProgramData\SMUCCI\YKM.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery