Analysis
-
max time kernel
145s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
24/11/2023, 13:36
General
-
Target
88CC26F5D63AF5FCFDC36ACCAE0DB04F.exe
-
Size
20.4MB
-
MD5
88cc26f5d63af5fcfdc36accae0db04f
-
SHA1
46d7627f0a00cd378684555e30d7bfbe78687143
-
SHA256
ee2f4598d9f48283bdd46bb0c9bd70f250a257e89bcfc2fc03275b913230d358
-
SHA512
3cd33e09524223a1baf882671eacb8033b354a03993c2d2ed7a4ba04796f9b518b5d5b92c93210492f0228bbbb057538bbf23507d10fd8112dce38b359f92cb5
-
SSDEEP
393216:WDfxovk0AJIh+vncZ9YvMQRVbjUU+5+NBoTRdDzWjWl2xEIYYOoq:WVovkNJIh+vXMwVb3+5+Xo1dva9FYYFq
Malware Config
Signatures
-
Detect ZGRat V1 10 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 3 IoCs
-
Drops file in Program Files directory 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 19 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\88CC26F5D63AF5FCFDC36ACCAE0DB04F.exe"C:\Users\Admin\AppData\Local\Temp\88CC26F5D63AF5FCFDC36ACCAE0DB04F.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Nursultan.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\ComponentSavesmonitordll\4R9Rg51iS3uwufB6AmlFTJfH4UnV5i8D9fFIGn1EV7sKuTgZgKEMxEZz4Pb.vbe"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\ComponentSavesmonitordll\UEE5DygFrJCmvXGMhlwQJ.bat" "4⤵
- Suspicious use of WriteProcessMemory
-
C:\ComponentSavesmonitordll\HyperDriverIntocrtDll.exe"C:\ComponentSavesmonitordll/HyperDriverIntocrtDll.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\g2o01mrQ46.bat"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650017⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost7⤵
- Runs ping.exe
-
-
C:\Program Files (x86)\Windows NT\Accessories\en-US\MoUsoCoreWorker.exe"C:\Program Files (x86)\Windows NT\Accessories\en-US\MoUsoCoreWorker.exe"7⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
223B
MD5f8a786f4c014917d7813e05e5a8dcdf0
SHA1e136d8e4d9ac5223810dab7b51937266647ca104
SHA256f90b392e0e4fec9e3a7993d75aca2919e04d294347957452f1196a04a738bdb7
SHA5122cb0be5d04d002aabcddd3d9794f13b264ea852e0c800e3ddc5f9992552cc5b2c718d0d34023ae1285df2e65801f4cc7adc005a41d9ca03f114ffc7a2a1056ab
-
Filesize
3.5MB
MD50f9b1f324db2774c14c2257eeed247fe
SHA152dcd3675150cf90e2ebc27bf745f700f747b758
SHA256d89ca804c1df9ae20c5ca623469b736e10f8bc649ffc4de9fa7929448d04fc08
SHA5127563c259bef09530c3b7c57ff885ddfba1a4aa05a33e54abd789b75aed25afa1fa5c7c22e99da21806dc8a09797dd106f80306ae665c81d8e21e7bbb3b651187
-
Filesize
3.5MB
MD50f9b1f324db2774c14c2257eeed247fe
SHA152dcd3675150cf90e2ebc27bf745f700f747b758
SHA256d89ca804c1df9ae20c5ca623469b736e10f8bc649ffc4de9fa7929448d04fc08
SHA5127563c259bef09530c3b7c57ff885ddfba1a4aa05a33e54abd789b75aed25afa1fa5c7c22e99da21806dc8a09797dd106f80306ae665c81d8e21e7bbb3b651187
-
Filesize
101B
MD58ac9a3a332f136cefbe9c27eab65a4c7
SHA18aef4996baf542b09f11692cc91c3aa9a6d85bbe
SHA2563a9ed449a604fded1dbbef4ff997dc7ed5d9366c262eaf6c687d2c0dffbaa1b3
SHA5124928cb40bc3ebdcbf4b1d155d6581eaafdd2f37c2029bb8a7c35302ba6da6bbd414d3d7ec43b7b120874dcd7c0e168573c055be111663626998960a335d7afe7
-
Filesize
3.5MB
MD50f9b1f324db2774c14c2257eeed247fe
SHA152dcd3675150cf90e2ebc27bf745f700f747b758
SHA256d89ca804c1df9ae20c5ca623469b736e10f8bc649ffc4de9fa7929448d04fc08
SHA5127563c259bef09530c3b7c57ff885ddfba1a4aa05a33e54abd789b75aed25afa1fa5c7c22e99da21806dc8a09797dd106f80306ae665c81d8e21e7bbb3b651187
-
Filesize
3.5MB
MD50f9b1f324db2774c14c2257eeed247fe
SHA152dcd3675150cf90e2ebc27bf745f700f747b758
SHA256d89ca804c1df9ae20c5ca623469b736e10f8bc649ffc4de9fa7929448d04fc08
SHA5127563c259bef09530c3b7c57ff885ddfba1a4aa05a33e54abd789b75aed25afa1fa5c7c22e99da21806dc8a09797dd106f80306ae665c81d8e21e7bbb3b651187
-
Filesize
3.5MB
MD50f9b1f324db2774c14c2257eeed247fe
SHA152dcd3675150cf90e2ebc27bf745f700f747b758
SHA256d89ca804c1df9ae20c5ca623469b736e10f8bc649ffc4de9fa7929448d04fc08
SHA5127563c259bef09530c3b7c57ff885ddfba1a4aa05a33e54abd789b75aed25afa1fa5c7c22e99da21806dc8a09797dd106f80306ae665c81d8e21e7bbb3b651187
-
Filesize
4.0MB
MD510ac3ea14e236503bc422f963d20d510
SHA1bdde4479f4fd0c87e918a71a42138aa2811e6f1a
SHA256339078555e679d49401fbd5cd170a5418f8d7899d0d2fe277b456062f11aa4d2
SHA51281831fec1e2fdbe1abd27d378a6db11725e97b52051b11c200c80f4dd8bdea8ff797e7eac32e1356f2f0912bb585e3b36c000959fa9a26cb0f8c5ea702a4f6f2
-
Filesize
4.0MB
MD510ac3ea14e236503bc422f963d20d510
SHA1bdde4479f4fd0c87e918a71a42138aa2811e6f1a
SHA256339078555e679d49401fbd5cd170a5418f8d7899d0d2fe277b456062f11aa4d2
SHA51281831fec1e2fdbe1abd27d378a6db11725e97b52051b11c200c80f4dd8bdea8ff797e7eac32e1356f2f0912bb585e3b36c000959fa9a26cb0f8c5ea702a4f6f2
-
Filesize
4.0MB
MD510ac3ea14e236503bc422f963d20d510
SHA1bdde4479f4fd0c87e918a71a42138aa2811e6f1a
SHA256339078555e679d49401fbd5cd170a5418f8d7899d0d2fe277b456062f11aa4d2
SHA51281831fec1e2fdbe1abd27d378a6db11725e97b52051b11c200c80f4dd8bdea8ff797e7eac32e1356f2f0912bb585e3b36c000959fa9a26cb0f8c5ea702a4f6f2
-
Filesize
199B
MD59da83e9792d06e1783df2afedff23e5c
SHA16521e6d26ef4d30dcad41a2e1fc11735ff525d9b
SHA256186632ed2ce6a6ab05cdc3ccae3023c47513357a881beeb64c32940a804422ea
SHA512a3e9cec7dfcf7c45f6b4dad21274e5c0c16eca1b0312e8f830aac2449019a5a10147e72d0159a5ba29ff5a3d95d2ffc227c1156364b0b57f07e9d900b0905fb1
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
760KB
-
Filesize
152KB
-
Filesize
760KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
64KB
-
Filesize
56KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
48KB
-
Filesize
56KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
4KB
-
Filesize
48KB
-
Filesize
760KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
760KB
-
Filesize
4KB
-
Filesize
88KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
5.2MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
56KB
-
Filesize
48KB
-
Filesize
4KB
-
Filesize
48KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
360KB
-
Filesize
56KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
4KB
-
Filesize
96KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
48KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
312KB
-
Filesize
64KB
-
Filesize
3.5MB
-
Filesize
10.8MB
-
Filesize
20.4MB
-
Filesize
312KB