zgrat | d6b5a77e4a1a7d7447f8744cb83a5bb902eb7dc03ff3a99674e20528482f9df4

Analysis

max time kernel
121s
max time network
140s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
07/12/2023, 05:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
39bd5ab4d43919fd00a1a576a770a0f9.exe
Size 1.9MB
Sample231207-freh8aahf5
SHA256 d6b5a77e4a1a7d7447f8744cb83a5bb902eb7dc03ff3a99674e20528482f9df4
MD5 39bd5ab4d43919fd00a1a576a770a0f9
SHA1 d620bd7855ece438aa70568101a2287a4b61702d
SHA512 f0dfe7507fa7b25e01df4ed30e85267e5bf7febac6c880030c37222b5fd6ac5873fbf9923f6f0e915cc16205fd033b6409c484ca209a04b8ad13b7a3c6b3f436
SSDEEP 24576:2TbBv5rUyXVr4umwRu7h+VovPu6GgG7LJM1sl248kdiYzMT+cSxXge3akEKhZtKE:IBJrMwRiYNgCL+yg48k8T+hX87KtKly
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

zgrat evasion rat

Malware Config

Signatures

Detect ZGRat V1 9 IoCs

resource	yara_rule
behavioral1/files/0x000e00000001342b-9.dat	family_zgrat_v1
behavioral1/files/0x000e00000001342b-10.dat	family_zgrat_v1
behavioral1/files/0x000e00000001342b-11.dat	family_zgrat_v1
behavioral1/files/0x000e00000001342b-12.dat	family_zgrat_v1
behavioral1/memory/2656-13-0x0000000000C60000-0x0000000000DFA000-memory.dmp	family_zgrat_v1
behavioral1/files/0x000a0000000143ec-21.dat	family_zgrat_v1
behavioral1/files/0x000700000001448a-33.dat	family_zgrat_v1
behavioral1/files/0x000700000001448a-34.dat	family_zgrat_v1
behavioral1/memory/2456-35-0x0000000000AC0000-0x0000000000C5A000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Disables Task Manager via registry modification
evasion

Executes dropped EXE 2 IoCs

pid	Process
2656	HyperProviderdriverruntimemonitor.exe
2456	wininit.exe

Loads dropped DLL 2 IoCs

pid	Process
2068	cmd.exe
2068	cmd.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Photo Viewer\en-US\lsass.exe	HyperProviderdriverruntimemonitor.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\en-US\lsass.exe	HyperProviderdriverruntimemonitor.exe
File created	C:\Program Files\Windows Photo Viewer\en-US\6203df4a6bafc7	HyperProviderdriverruntimemonitor.exe
File created	C:\Program Files (x86)\Windows Media Player\HyperProviderdriverruntimemonitor.exe	HyperProviderdriverruntimemonitor.exe
File created	C:\Program Files (x86)\Windows Media Player\cf7b9f940e06ae	HyperProviderdriverruntimemonitor.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\wininit.exe	HyperProviderdriverruntimemonitor.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\56085415360792	HyperProviderdriverruntimemonitor.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\tracing\56085415360792	HyperProviderdriverruntimemonitor.exe
File created	C:\Windows\tracing\wininit.exe	HyperProviderdriverruntimemonitor.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2652	reg.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2656	HyperProviderdriverruntimemonitor.exe
2656	HyperProviderdriverruntimemonitor.exe
2656	HyperProviderdriverruntimemonitor.exe
2656	HyperProviderdriverruntimemonitor.exe
2656	HyperProviderdriverruntimemonitor.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2656	HyperProviderdriverruntimemonitor.exe
Token: SeDebugPrivilege	2456	wininit.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2868	2416	39bd5ab4d43919fd00a1a576a770a0f9.exe	28
PID 2416 wrote to memory of 2868	2416	39bd5ab4d43919fd00a1a576a770a0f9.exe	28
PID 2416 wrote to memory of 2868	2416	39bd5ab4d43919fd00a1a576a770a0f9.exe	28
PID 2416 wrote to memory of 2868	2416	39bd5ab4d43919fd00a1a576a770a0f9.exe	28
PID 2868 wrote to memory of 2068	2868	WScript.exe	29
PID 2868 wrote to memory of 2068	2868	WScript.exe	29
PID 2868 wrote to memory of 2068	2868	WScript.exe	29
PID 2868 wrote to memory of 2068	2868	WScript.exe	29
PID 2068 wrote to memory of 2652	2068	cmd.exe	31
PID 2068 wrote to memory of 2652	2068	cmd.exe	31
PID 2068 wrote to memory of 2652	2068	cmd.exe	31
PID 2068 wrote to memory of 2652	2068	cmd.exe	31
PID 2068 wrote to memory of 2656	2068	cmd.exe	32
PID 2068 wrote to memory of 2656	2068	cmd.exe	32
PID 2068 wrote to memory of 2656	2068	cmd.exe	32
PID 2068 wrote to memory of 2656	2068	cmd.exe	32
PID 2656 wrote to memory of 2480	2656	HyperProviderdriverruntimemonitor.exe	34
PID 2656 wrote to memory of 2480	2656	HyperProviderdriverruntimemonitor.exe	34
PID 2656 wrote to memory of 2480	2656	HyperProviderdriverruntimemonitor.exe	34
PID 2480 wrote to memory of 2704	2480	cmd.exe	35
PID 2480 wrote to memory of 2704	2480	cmd.exe	35
PID 2480 wrote to memory of 2704	2480	cmd.exe	35
PID 2480 wrote to memory of 2508	2480	cmd.exe	36
PID 2480 wrote to memory of 2508	2480	cmd.exe	36
PID 2480 wrote to memory of 2508	2480	cmd.exe	36
PID 2480 wrote to memory of 2456	2480	cmd.exe	37
PID 2480 wrote to memory of 2456	2480	cmd.exe	37
PID 2480 wrote to memory of 2456	2480	cmd.exe	37
PID 2456 wrote to memory of 3012	2456	wininit.exe	38
PID 2456 wrote to memory of 3012	2456	wininit.exe	38
PID 2456 wrote to memory of 3012	2456	wininit.exe	38

C:\Users\Admin\AppData\Local\Temp\39bd5ab4d43919fd00a1a576a770a0f9.exe
"C:\Users\Admin\AppData\Local\Temp\39bd5ab4d43919fd00a1a576a770a0f9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\blockComComponentWebnet\h0JGs7Fx4iJmxYp13yQyvI2ScGBzRed3aou.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\blockComComponentWebnet\ZJzjTL8OuuimJJ76jQkBGmnyVy4me.bat" "
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2068
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:2652
  - - C:\Users\Admin\AppData\Local\Temp\blockComComponentWebnet\HyperProviderdriverruntimemonitor.exe
      "C:\Users\Admin\AppData\Local\Temp\blockComComponentWebnet/HyperProviderdriverruntimemonitor.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2656
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JpE5QlccAl.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2480
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:2704
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2508
      - C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\wininit.exe
        
        "C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\wininit.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2456
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2456 -s 1116
        7⤵
        
        PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wininit.exe

Path C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\wininit.exe
Size 1.6MB
SHA256 9588821e13f4ab4e5383e3ad0e0fa3363139698efda61cf6058656f5999f4c7a
MD5 db1dbf017a0e3c4af281f5d07b0b95c3
SHA1 89bf9051d05d185a0dfd1dbf5e40fde8f3787f92
SHA512 10ba683ab56349de1735d025e04453f3049f02ed955afb07385d1548c4be0b889134d6d7b19cc5afdaa8a802f7d1934ee5b5f7c87fb53b3f56443e49193093ee
SSDEEP 24576:B4umwRu7h+VovPu6GgG7LJM1sl248kdiYzMT+cSxXge3akEKhZtK2mwb:BMwRiYNgCL+yg48k8T+hX87KtKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

wininit.exe

Path C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\wininit.exe
Size 1.6MB
SHA256 9588821e13f4ab4e5383e3ad0e0fa3363139698efda61cf6058656f5999f4c7a
MD5 db1dbf017a0e3c4af281f5d07b0b95c3
SHA1 89bf9051d05d185a0dfd1dbf5e40fde8f3787f92
SHA512 10ba683ab56349de1735d025e04453f3049f02ed955afb07385d1548c4be0b889134d6d7b19cc5afdaa8a802f7d1934ee5b5f7c87fb53b3f56443e49193093ee
SSDEEP 24576:B4umwRu7h+VovPu6GgG7LJM1sl248kdiYzMT+cSxXge3akEKhZtK2mwb:BMwRiYNgCL+yg48k8T+hX87KtKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

JpE5QlccAl.bat

Path C:\Users\Admin\AppData\Local\Temp\JpE5QlccAl.bat
Size 258B
SHA256 e2cf6c870caf97008a5429855252e7f97107e1571c1689415651fb7ed9eb716a
MD5 fd27d3e06f132f2c3f641369f07f50d9
SHA1 0c22a5d6e34fda3507e0b10f3b4de5c10bce2d2d
SHA512 45b3f05dd7bb25022851aa0ef657d0cb6ab1c49dc1cc5812c60a1a6cc65466f29fa8d3a326d1c3c8fc5da653c9db518eb4ceca50e75a72f548e5cf070869ec69
MD5 SHA1 SHA512

Submit Download

HyperProviderdriverruntimemonitor.exe

Path C:\Users\Admin\AppData\Local\Temp\blockComComponentWebnet\HyperProviderdriverruntimemonitor.exe
Size 1.6MB
SHA256 9588821e13f4ab4e5383e3ad0e0fa3363139698efda61cf6058656f5999f4c7a
MD5 db1dbf017a0e3c4af281f5d07b0b95c3
SHA1 89bf9051d05d185a0dfd1dbf5e40fde8f3787f92
SHA512 10ba683ab56349de1735d025e04453f3049f02ed955afb07385d1548c4be0b889134d6d7b19cc5afdaa8a802f7d1934ee5b5f7c87fb53b3f56443e49193093ee
SSDEEP 24576:B4umwRu7h+VovPu6GgG7LJM1sl248kdiYzMT+cSxXge3akEKhZtK2mwb:BMwRiYNgCL+yg48k8T+hX87KtKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

HyperProviderdriverruntimemonitor.exe

Path C:\Users\Admin\AppData\Local\Temp\blockComComponentWebnet\HyperProviderdriverruntimemonitor.exe
Size 1.6MB
SHA256 9588821e13f4ab4e5383e3ad0e0fa3363139698efda61cf6058656f5999f4c7a
MD5 db1dbf017a0e3c4af281f5d07b0b95c3
SHA1 89bf9051d05d185a0dfd1dbf5e40fde8f3787f92
SHA512 10ba683ab56349de1735d025e04453f3049f02ed955afb07385d1548c4be0b889134d6d7b19cc5afdaa8a802f7d1934ee5b5f7c87fb53b3f56443e49193093ee
SSDEEP 24576:B4umwRu7h+VovPu6GgG7LJM1sl248kdiYzMT+cSxXge3akEKhZtK2mwb:BMwRiYNgCL+yg48k8T+hX87KtKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZJzjTL8OuuimJJ76jQkBGmnyVy4me.bat

Path C:\Users\Admin\AppData\Local\Temp\blockComComponentWebnet\ZJzjTL8OuuimJJ76jQkBGmnyVy4me.bat
Size 236B
SHA256 8b94261bc3b8a6d6a7fcb4fe9bf01455c47b7cd705fbc70235112519b6385f89
MD5 0840a7da6d30da573f1ad62d59b9892d
SHA1 8599194280e505b7b8d3fe6b2288b3f98c1a30e3
SHA512 c0f0adf79467d9458c9634187f367e1bb6d07561b76b1fd5d5582713cf61193421487e992e4a03d0ea0bdd2846f01c66a214383967745f7a9fcf1fa61494183b
MD5 SHA1 SHA512

Submit Download

h0JGs7Fx4iJmxYp13yQyvI2ScGBzRed3aou.vbe

Path C:\Users\Admin\AppData\Local\Temp\blockComComponentWebnet\h0JGs7Fx4iJmxYp13yQyvI2ScGBzRed3aou.vbe
Size 235B
SHA256 468448f8b6d31490bde611c4afa65f56aeb78307b86cf1ac9b2611dbf3103afb
MD5 abdc6570f7e7ff7cc6047e516096612d
SHA1 ee4577e1775c2f504d4c74a5e047044b877a17f3
SHA512 a86baf6592c72684b6f7a6d9b75d12af2c3b6e381709c7f461ea4ff270fc71c85036ad7accd61b34ec5efb4c203cb60562a29a44c236f11673689ab00f69bb3a
MD5 SHA1 SHA512

Submit Download

wininit.exe

Path C:\Windows\tracing\wininit.exe
Size 1.6MB
SHA256 9588821e13f4ab4e5383e3ad0e0fa3363139698efda61cf6058656f5999f4c7a
MD5 db1dbf017a0e3c4af281f5d07b0b95c3
SHA1 89bf9051d05d185a0dfd1dbf5e40fde8f3787f92
SHA512 10ba683ab56349de1735d025e04453f3049f02ed955afb07385d1548c4be0b889134d6d7b19cc5afdaa8a802f7d1934ee5b5f7c87fb53b3f56443e49193093ee
SSDEEP 24576:B4umwRu7h+VovPu6GgG7LJM1sl248kdiYzMT+cSxXge3akEKhZtK2mwb:BMwRiYNgCL+yg48k8T+hX87KtKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

HyperProviderdriverruntimemonitor.exe

Path \Users\Admin\AppData\Local\Temp\blockComComponentWebnet\HyperProviderdriverruntimemonitor.exe
Size 1.6MB
SHA256 9588821e13f4ab4e5383e3ad0e0fa3363139698efda61cf6058656f5999f4c7a
MD5 db1dbf017a0e3c4af281f5d07b0b95c3
SHA1 89bf9051d05d185a0dfd1dbf5e40fde8f3787f92
SHA512 10ba683ab56349de1735d025e04453f3049f02ed955afb07385d1548c4be0b889134d6d7b19cc5afdaa8a802f7d1934ee5b5f7c87fb53b3f56443e49193093ee
SSDEEP 24576:B4umwRu7h+VovPu6GgG7LJM1sl248kdiYzMT+cSxXge3akEKhZtK2mwb:BMwRiYNgCL+yg48k8T+hX87KtKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

HyperProviderdriverruntimemonitor.exe

Path \Users\Admin\AppData\Local\Temp\blockComComponentWebnet\HyperProviderdriverruntimemonitor.exe
Size 1.6MB
SHA256 9588821e13f4ab4e5383e3ad0e0fa3363139698efda61cf6058656f5999f4c7a
MD5 db1dbf017a0e3c4af281f5d07b0b95c3
SHA1 89bf9051d05d185a0dfd1dbf5e40fde8f3787f92
SHA512 10ba683ab56349de1735d025e04453f3049f02ed955afb07385d1548c4be0b889134d6d7b19cc5afdaa8a802f7d1934ee5b5f7c87fb53b3f56443e49193093ee
SSDEEP 24576:B4umwRu7h+VovPu6GgG7LJM1sl248kdiYzMT+cSxXge3akEKhZtK2mwb:BMwRiYNgCL+yg48k8T+hX87KtKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2456-37-0x0000000000140000-0x0000000000141000-memory.dmp

Download

memory/2456-36-0x000007FEF5090000-0x000007FEF5A7C000-memory.dmp

Download

memory/2456-35-0x0000000000AC0000-0x0000000000C5A000-memory.dmp

Download

memory/2456-38-0x000000001B340000-0x000000001B3C0000-memory.dmp

Download

memory/2456-39-0x000007FEF5090000-0x000007FEF5A7C000-memory.dmp

Download

memory/2456-40-0x000000001B340000-0x000000001B3C0000-memory.dmp

Download

memory/2456-41-0x000000001B340000-0x000000001B3C0000-memory.dmp

Download

memory/2656-32-0x000007FEF5A80000-0x000007FEF646C000-memory.dmp

Download

memory/2656-13-0x0000000000C60000-0x0000000000DFA000-memory.dmp

Download

memory/2656-14-0x000007FEF5A80000-0x000007FEF646C000-memory.dmp

Download

memory/2656-16-0x00000000003B0000-0x00000000003B1000-memory.dmp

Download

memory/2656-15-0x000000001B280000-0x000000001B300000-memory.dmp

Download