zgrat | 871978fb97af5fca44a98714b79a3e86dfdb468eed6980dadc7f2bf7e5bf1aaa

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	srqevgqojjbncqqvamq.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	YKM.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	YKM.exe

Downloads MZ/PE file

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral12/memory/4884-0-0x000001FF11E90000-0x000001FF12616000-memory.dmp	net_reactor

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	YKM.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	srqevgqojjbncqqvamq.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	srqevgqojjbncqqvamq.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	YKM.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	YKM.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	YKM.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\Control Panel\International\Geo\Nation	1106-06-Zgrat.exe
Key value queried	\REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\Control Panel\International\Geo\Nation	srqevgqojjbncqqvamq.exe
Key value queried	\REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\Control Panel\International\Geo\Nation	YKM.exe

Executes dropped EXE 3 IoCs

pid	Process
2128	srqevgqojjbncqqvamq.exe
2412	YKM.exe
1368	YKM.exe

Themida packer 30 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral12/files/0x000d000000022e14-37.dat	themida
behavioral12/files/0x000d000000022e14-36.dat	themida
behavioral12/memory/2128-38-0x0000000000CB0000-0x0000000001900000-memory.dmp	themida
behavioral12/memory/2128-39-0x0000000000CB0000-0x0000000001900000-memory.dmp	themida
behavioral12/memory/2128-44-0x0000000000CB0000-0x0000000001900000-memory.dmp	themida
behavioral12/memory/2128-45-0x0000000000CB0000-0x0000000001900000-memory.dmp	themida
behavioral12/memory/2128-46-0x0000000000CB0000-0x0000000001900000-memory.dmp	themida
behavioral12/memory/2128-47-0x0000000000CB0000-0x0000000001900000-memory.dmp	themida
behavioral12/memory/2128-48-0x0000000000CB0000-0x0000000001900000-memory.dmp	themida
behavioral12/memory/2128-54-0x0000000000CB0000-0x0000000001900000-memory.dmp	themida
behavioral12/files/0x0008000000022e1d-56.dat	themida
behavioral12/files/0x0008000000022e1d-57.dat	themida
behavioral12/memory/2412-58-0x0000000000520000-0x0000000001170000-memory.dmp	themida
behavioral12/files/0x0008000000022e1d-59.dat	themida
behavioral12/memory/2412-60-0x0000000000520000-0x0000000001170000-memory.dmp	themida
behavioral12/memory/2412-64-0x0000000000520000-0x0000000001170000-memory.dmp	themida
behavioral12/memory/2412-65-0x0000000000520000-0x0000000001170000-memory.dmp	themida
behavioral12/memory/2412-66-0x0000000000520000-0x0000000001170000-memory.dmp	themida
behavioral12/memory/2412-67-0x0000000000520000-0x0000000001170000-memory.dmp	themida
behavioral12/memory/2412-68-0x0000000000520000-0x0000000001170000-memory.dmp	themida
behavioral12/memory/2412-69-0x0000000000520000-0x0000000001170000-memory.dmp	themida
behavioral12/files/0x0008000000022e1d-70.dat	themida
behavioral12/memory/1368-71-0x0000000000520000-0x0000000001170000-memory.dmp	themida
behavioral12/memory/1368-75-0x0000000000520000-0x0000000001170000-memory.dmp	themida
behavioral12/memory/1368-76-0x0000000000520000-0x0000000001170000-memory.dmp	themida
behavioral12/memory/1368-77-0x0000000000520000-0x0000000001170000-memory.dmp	themida
behavioral12/memory/1368-78-0x0000000000520000-0x0000000001170000-memory.dmp	themida
behavioral12/memory/1368-79-0x0000000000520000-0x0000000001170000-memory.dmp	themida
behavioral12/memory/1368-80-0x0000000000520000-0x0000000001170000-memory.dmp	themida
behavioral12/memory/2412-84-0x0000000000520000-0x0000000001170000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	srqevgqojjbncqqvamq.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	YKM.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	YKM.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\F:	1106-06-Zgrat.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
2128	srqevgqojjbncqqvamq.exe
2412	YKM.exe
1368	YKM.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4884 set thread context of 1532	4884	1106-06-Zgrat.exe	100

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
4888	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1608	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4884	1106-06-Zgrat.exe
4884	1106-06-Zgrat.exe
4884	1106-06-Zgrat.exe
4884	1106-06-Zgrat.exe
4884	1106-06-Zgrat.exe
4884	1106-06-Zgrat.exe
4884	1106-06-Zgrat.exe
4884	1106-06-Zgrat.exe
4884	1106-06-Zgrat.exe
4884	1106-06-Zgrat.exe
4536	powershell.exe
4536	powershell.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe
1532	AddInProcess32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4536	powershell.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 4536	4884	1106-06-Zgrat.exe	91
PID 4884 wrote to memory of 4536	4884	1106-06-Zgrat.exe	91
PID 4884 wrote to memory of 1532	4884	1106-06-Zgrat.exe	100
PID 4884 wrote to memory of 1532	4884	1106-06-Zgrat.exe	100
PID 4884 wrote to memory of 1532	4884	1106-06-Zgrat.exe	100
PID 4884 wrote to memory of 1532	4884	1106-06-Zgrat.exe	100
PID 4884 wrote to memory of 1532	4884	1106-06-Zgrat.exe	100
PID 4884 wrote to memory of 1532	4884	1106-06-Zgrat.exe	100
PID 4884 wrote to memory of 1532	4884	1106-06-Zgrat.exe	100
PID 4884 wrote to memory of 1532	4884	1106-06-Zgrat.exe	100
PID 4884 wrote to memory of 1532	4884	1106-06-Zgrat.exe	100
PID 1532 wrote to memory of 2128	1532	AddInProcess32.exe	111
PID 1532 wrote to memory of 2128	1532	AddInProcess32.exe	111
PID 1532 wrote to memory of 2128	1532	AddInProcess32.exe	111
PID 2128 wrote to memory of 2772	2128	srqevgqojjbncqqvamq.exe	113
PID 2128 wrote to memory of 2772	2128	srqevgqojjbncqqvamq.exe	113
PID 2128 wrote to memory of 2772	2128	srqevgqojjbncqqvamq.exe	113
PID 2772 wrote to memory of 1608	2772	cmd.exe	115
PID 2772 wrote to memory of 1608	2772	cmd.exe	115
PID 2772 wrote to memory of 1608	2772	cmd.exe	115
PID 2772 wrote to memory of 2412	2772	cmd.exe	116
PID 2772 wrote to memory of 2412	2772	cmd.exe	116
PID 2772 wrote to memory of 2412	2772	cmd.exe	116
PID 2412 wrote to memory of 4888	2412	YKM.exe	117
PID 2412 wrote to memory of 4888	2412	YKM.exe	117
PID 2412 wrote to memory of 4888	2412	YKM.exe	117

C:\Users\Admin\AppData\Local\Temp\1106-06-Zgrat.exe
"C:\Users\Admin\AppData\Local\Temp\1106-06-Zgrat.exe"
1⤵
- Checks computer location settings
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAwAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4536
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\Users\Admin\AppData\Local\Temp\srqevgqojjbncqqvamq.exe
    "C:\Users\Admin\AppData\Local\Temp\srqevgqojjbncqqvamq.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of WriteProcessMemory
    PID:2128
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\s1n4.0.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2772
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:1608
    - - C:\ProgramData\SMUCCI\YKM.exe
        
        "C:\ProgramData\SMUCCI\YKM.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of WriteProcessMemory
        
        PID:2412
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /RL HIGHEST /tn "YKM" /tr C:\ProgramData\SMUCCI\YKM.exe /f
        6⤵
        Creates scheduled task(s)
        
        PID:4888

C:\ProgramData\SMUCCI\YKM.exe
C:\ProgramData\SMUCCI\YKM.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery