zgrat | d6b5a77e4a1a7d7447f8744cb83a5bb902eb7dc03ff3a99674e20528482f9df4

Analysis

max time kernel
137s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
07/12/2023, 05:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
39bd5ab4d43919fd00a1a576a770a0f9.exe
Size 1.9MB
Sample231207-freh8aahf5
SHA256 d6b5a77e4a1a7d7447f8744cb83a5bb902eb7dc03ff3a99674e20528482f9df4
MD5 39bd5ab4d43919fd00a1a576a770a0f9
SHA1 d620bd7855ece438aa70568101a2287a4b61702d
SHA512 f0dfe7507fa7b25e01df4ed30e85267e5bf7febac6c880030c37222b5fd6ac5873fbf9923f6f0e915cc16205fd033b6409c484ca209a04b8ad13b7a3c6b3f436
SSDEEP 24576:2TbBv5rUyXVr4umwRu7h+VovPu6GgG7LJM1sl248kdiYzMT+cSxXge3akEKhZtKE:IBJrMwRiYNgCL+yg48k8T+hX87KtKly
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

zgrat evasion rat

Malware Config

Signatures

Detect ZGRat V1 6 IoCs

resource	yara_rule
behavioral2/files/0x00070000000231f8-10.dat	family_zgrat_v1
behavioral2/files/0x00070000000231f8-11.dat	family_zgrat_v1
behavioral2/memory/380-12-0x0000000000D80000-0x0000000000F1A000-memory.dmp	family_zgrat_v1
behavioral2/files/0x000600000002320d-18.dat	family_zgrat_v1
behavioral2/files/0x0006000000023213-33.dat	family_zgrat_v1
behavioral2/files/0x0006000000023213-35.dat	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Disables Task Manager via registry modification
evasion

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1067295379-1486014338-1703171060-1000\Control Panel\International\Geo\Nation	39bd5ab4d43919fd00a1a576a770a0f9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1067295379-1486014338-1703171060-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1067295379-1486014338-1703171060-1000\Control Panel\International\Geo\Nation	HyperProviderdriverruntimemonitor.exe

Executes dropped EXE 2 IoCs

pid	Process
380	HyperProviderdriverruntimemonitor.exe
4124	backgroundTaskHost.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\RuntimeBroker.exe	HyperProviderdriverruntimemonitor.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\9e8d7a4ca61bd9	HyperProviderdriverruntimemonitor.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\INF\UGTHRSVC\0409\e6c9b481da804f	HyperProviderdriverruntimemonitor.exe
File created	C:\Windows\Branding\shellbrd\conhost.exe	HyperProviderdriverruntimemonitor.exe
File created	C:\Windows\Branding\shellbrd\088424020bedd6	HyperProviderdriverruntimemonitor.exe
File created	C:\Windows\INF\UGTHRSVC\0409\OfficeClickToRun.exe	HyperProviderdriverruntimemonitor.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1067295379-1486014338-1703171060-1000_Classes\Local Settings	39bd5ab4d43919fd00a1a576a770a0f9.exe
Key created	\REGISTRY\USER\S-1-5-21-1067295379-1486014338-1703171060-1000_Classes\Local Settings	HyperProviderdriverruntimemonitor.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
3184	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
808	PING.EXE

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
380	HyperProviderdriverruntimemonitor.exe
380	HyperProviderdriverruntimemonitor.exe
380	HyperProviderdriverruntimemonitor.exe
380	HyperProviderdriverruntimemonitor.exe
380	HyperProviderdriverruntimemonitor.exe
380	HyperProviderdriverruntimemonitor.exe
380	HyperProviderdriverruntimemonitor.exe
4124	backgroundTaskHost.exe
4124	backgroundTaskHost.exe
4124	backgroundTaskHost.exe
4124	backgroundTaskHost.exe
4124	backgroundTaskHost.exe
4124	backgroundTaskHost.exe
4124	backgroundTaskHost.exe
4124	backgroundTaskHost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4124	backgroundTaskHost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	380	HyperProviderdriverruntimemonitor.exe
Token: SeDebugPrivilege	4124	backgroundTaskHost.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 5116 wrote to memory of 4640	5116	39bd5ab4d43919fd00a1a576a770a0f9.exe	88
PID 5116 wrote to memory of 4640	5116	39bd5ab4d43919fd00a1a576a770a0f9.exe	88
PID 5116 wrote to memory of 4640	5116	39bd5ab4d43919fd00a1a576a770a0f9.exe	88
PID 4640 wrote to memory of 1260	4640	WScript.exe	100
PID 4640 wrote to memory of 1260	4640	WScript.exe	100
PID 4640 wrote to memory of 1260	4640	WScript.exe	100
PID 1260 wrote to memory of 3184	1260	cmd.exe	102
PID 1260 wrote to memory of 3184	1260	cmd.exe	102
PID 1260 wrote to memory of 3184	1260	cmd.exe	102
PID 1260 wrote to memory of 380	1260	cmd.exe	103
PID 1260 wrote to memory of 380	1260	cmd.exe	103
PID 380 wrote to memory of 3748	380	HyperProviderdriverruntimemonitor.exe	106
PID 380 wrote to memory of 3748	380	HyperProviderdriverruntimemonitor.exe	106
PID 3748 wrote to memory of 4620	3748	cmd.exe	107
PID 3748 wrote to memory of 4620	3748	cmd.exe	107
PID 3748 wrote to memory of 808	3748	cmd.exe	108
PID 3748 wrote to memory of 808	3748	cmd.exe	108
PID 3748 wrote to memory of 4124	3748	cmd.exe	109
PID 3748 wrote to memory of 4124	3748	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\39bd5ab4d43919fd00a1a576a770a0f9.exe
"C:\Users\Admin\AppData\Local\Temp\39bd5ab4d43919fd00a1a576a770a0f9.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\blockComComponentWebnet\h0JGs7Fx4iJmxYp13yQyvI2ScGBzRed3aou.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\blockComComponentWebnet\ZJzjTL8OuuimJJ76jQkBGmnyVy4me.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1260
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:3184
  - - C:\Users\Admin\AppData\Local\Temp\blockComComponentWebnet\HyperProviderdriverruntimemonitor.exe
      "C:\Users\Admin\AppData\Local\Temp\blockComComponentWebnet/HyperProviderdriverruntimemonitor.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:380
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iQBZXlNNoI.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3748
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:4620
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        Runs ping.exe
        
        PID:808
      - C:\odt\backgroundTaskHost.exe
        
        "C:\odt\backgroundTaskHost.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:4124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HyperProviderdriverruntimemonitor.exe

Path C:\Users\Admin\AppData\Local\Temp\blockComComponentWebnet\HyperProviderdriverruntimemonitor.exe
Size 1.6MB
SHA256 9588821e13f4ab4e5383e3ad0e0fa3363139698efda61cf6058656f5999f4c7a
MD5 db1dbf017a0e3c4af281f5d07b0b95c3
SHA1 89bf9051d05d185a0dfd1dbf5e40fde8f3787f92
SHA512 10ba683ab56349de1735d025e04453f3049f02ed955afb07385d1548c4be0b889134d6d7b19cc5afdaa8a802f7d1934ee5b5f7c87fb53b3f56443e49193093ee
SSDEEP 24576:B4umwRu7h+VovPu6GgG7LJM1sl248kdiYzMT+cSxXge3akEKhZtK2mwb:BMwRiYNgCL+yg48k8T+hX87KtKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

HyperProviderdriverruntimemonitor.exe

Path C:\Users\Admin\AppData\Local\Temp\blockComComponentWebnet\HyperProviderdriverruntimemonitor.exe
Size 1.6MB
SHA256 9588821e13f4ab4e5383e3ad0e0fa3363139698efda61cf6058656f5999f4c7a
MD5 db1dbf017a0e3c4af281f5d07b0b95c3
SHA1 89bf9051d05d185a0dfd1dbf5e40fde8f3787f92
SHA512 10ba683ab56349de1735d025e04453f3049f02ed955afb07385d1548c4be0b889134d6d7b19cc5afdaa8a802f7d1934ee5b5f7c87fb53b3f56443e49193093ee
SSDEEP 24576:B4umwRu7h+VovPu6GgG7LJM1sl248kdiYzMT+cSxXge3akEKhZtK2mwb:BMwRiYNgCL+yg48k8T+hX87KtKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZJzjTL8OuuimJJ76jQkBGmnyVy4me.bat

Path C:\Users\Admin\AppData\Local\Temp\blockComComponentWebnet\ZJzjTL8OuuimJJ76jQkBGmnyVy4me.bat
Size 236B
SHA256 8b94261bc3b8a6d6a7fcb4fe9bf01455c47b7cd705fbc70235112519b6385f89
MD5 0840a7da6d30da573f1ad62d59b9892d
SHA1 8599194280e505b7b8d3fe6b2288b3f98c1a30e3
SHA512 c0f0adf79467d9458c9634187f367e1bb6d07561b76b1fd5d5582713cf61193421487e992e4a03d0ea0bdd2846f01c66a214383967745f7a9fcf1fa61494183b
MD5 SHA1 SHA512

Submit Download

h0JGs7Fx4iJmxYp13yQyvI2ScGBzRed3aou.vbe

Path C:\Users\Admin\AppData\Local\Temp\blockComComponentWebnet\h0JGs7Fx4iJmxYp13yQyvI2ScGBzRed3aou.vbe
Size 235B
SHA256 468448f8b6d31490bde611c4afa65f56aeb78307b86cf1ac9b2611dbf3103afb
MD5 abdc6570f7e7ff7cc6047e516096612d
SHA1 ee4577e1775c2f504d4c74a5e047044b877a17f3
SHA512 a86baf6592c72684b6f7a6d9b75d12af2c3b6e381709c7f461ea4ff270fc71c85036ad7accd61b34ec5efb4c203cb60562a29a44c236f11673689ab00f69bb3a
MD5 SHA1 SHA512

Submit Download

iQBZXlNNoI.bat

Path C:\Users\Admin\AppData\Local\Temp\iQBZXlNNoI.bat
Size 157B
SHA256 6a65a867fb5f5f2a72646a69660b5c13962ba83bb677fa8f0dd00cbb482e3fdb
MD5 dae8f5e1d2a1dd8ea3f14df99408ec99
SHA1 e7f0ab77fb7d74cab5a27fdb4998dd5bdc9dac3c
SHA512 fb43af3a75cf985fb8cce538ece9e0c59c9e549f0e815cc19be3f25ff029da5951f95c85e7c0ad9c3858475bb16f95c3a8a4d3d629b5b9afba9df8959fb06251
MD5 SHA1 SHA512

Submit Download

OfficeClickToRun.exe

Path C:\Windows\INF\UGTHRSVC\0409\OfficeClickToRun.exe
Size 1.6MB
SHA256 9588821e13f4ab4e5383e3ad0e0fa3363139698efda61cf6058656f5999f4c7a
MD5 db1dbf017a0e3c4af281f5d07b0b95c3
SHA1 89bf9051d05d185a0dfd1dbf5e40fde8f3787f92
SHA512 10ba683ab56349de1735d025e04453f3049f02ed955afb07385d1548c4be0b889134d6d7b19cc5afdaa8a802f7d1934ee5b5f7c87fb53b3f56443e49193093ee
SSDEEP 24576:B4umwRu7h+VovPu6GgG7LJM1sl248kdiYzMT+cSxXge3akEKhZtK2mwb:BMwRiYNgCL+yg48k8T+hX87KtKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

backgroundTaskHost.exe

Path C:\odt\backgroundTaskHost.exe
Size 1.6MB
SHA256 9588821e13f4ab4e5383e3ad0e0fa3363139698efda61cf6058656f5999f4c7a
MD5 db1dbf017a0e3c4af281f5d07b0b95c3
SHA1 89bf9051d05d185a0dfd1dbf5e40fde8f3787f92
SHA512 10ba683ab56349de1735d025e04453f3049f02ed955afb07385d1548c4be0b889134d6d7b19cc5afdaa8a802f7d1934ee5b5f7c87fb53b3f56443e49193093ee
SSDEEP 24576:B4umwRu7h+VovPu6GgG7LJM1sl248kdiYzMT+cSxXge3akEKhZtK2mwb:BMwRiYNgCL+yg48k8T+hX87KtKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

backgroundTaskHost.exe

Path C:\odt\backgroundTaskHost.exe
Size 1.6MB
SHA256 9588821e13f4ab4e5383e3ad0e0fa3363139698efda61cf6058656f5999f4c7a
MD5 db1dbf017a0e3c4af281f5d07b0b95c3
SHA1 89bf9051d05d185a0dfd1dbf5e40fde8f3787f92
SHA512 10ba683ab56349de1735d025e04453f3049f02ed955afb07385d1548c4be0b889134d6d7b19cc5afdaa8a802f7d1934ee5b5f7c87fb53b3f56443e49193093ee
SSDEEP 24576:B4umwRu7h+VovPu6GgG7LJM1sl248kdiYzMT+cSxXge3akEKhZtK2mwb:BMwRiYNgCL+yg48k8T+hX87KtKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/380-13-0x00007FFCC1F70000-0x00007FFCC2A31000-memory.dmp

Download

memory/380-31-0x00007FFCC1F70000-0x00007FFCC2A31000-memory.dmp

Download

memory/380-15-0x000000001BC00000-0x000000001BC10000-memory.dmp

Download

memory/380-14-0x00000000015B0000-0x00000000015B1000-memory.dmp

Download

memory/380-12-0x0000000000D80000-0x0000000000F1A000-memory.dmp

Download

memory/4124-38-0x0000000002D00000-0x0000000002D01000-memory.dmp

Download

memory/4124-37-0x000000001B7D0000-0x000000001B7E0000-memory.dmp

Download

memory/4124-36-0x00007FFCC1F70000-0x00007FFCC2A31000-memory.dmp

Download

memory/4124-39-0x000000001B7D0000-0x000000001B7E0000-memory.dmp

Download

memory/4124-40-0x00007FFCC1F70000-0x00007FFCC2A31000-memory.dmp

Download

memory/4124-41-0x000000001B7D0000-0x000000001B7E0000-memory.dmp

Download

memory/4124-42-0x000000001B7D0000-0x000000001B7E0000-memory.dmp

Download

memory/4124-43-0x000000001B7D0000-0x000000001B7E0000-memory.dmp

Download

memory/4124-44-0x000000001B7D0000-0x000000001B7E0000-memory.dmp

Download