zgrat | 8252f99b0f6c26c5c6360c896b26d2acf273ec3c68cf2d883fce4727fe926237

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231130-en
resource tags

arch:x64arch:x86image:win7-20231130-enlocale:en-usos:windows7-x64system
submitted
10/12/2023, 16:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ab0443c4b5ae89cd913377183852ecb3.exe
Size

1.2MB
MD5

ab0443c4b5ae89cd913377183852ecb3
SHA1

23cf5fb65377cfe0af63adede50c50fb24dc32ab
SHA256

8252f99b0f6c26c5c6360c896b26d2acf273ec3c68cf2d883fce4727fe926237
SHA512

149ef11f5b394b29310bb43bac8dc7356fe08c8916359b85de8b05b6033c76cb3e230fcd7098bba9acaf7dfc4570aba479b6e9b05369043f1d24a7f5d78e7d7b
SSDEEP

24576:vhH733J6mChDoplHDnS5DYL65kXy2eO9S0Q2eFctQU:JDMCljnK2ok9l9SX2L

Score

10^/10

zgrat rat

Malware Config

Signatures

Detect ZGRat V1 37 IoCs

resource	yara_rule
behavioral1/memory/1820-1-0x000000001AFE0000-0x000000001B110000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-8-0x000000001AFE0000-0x000000001B10A000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-24-0x000000001AFE0000-0x000000001B10A000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-30-0x000000001AFE0000-0x000000001B10A000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-34-0x000000001AFE0000-0x000000001B10A000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-40-0x000000001AFE0000-0x000000001B10A000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-50-0x000000001AFE0000-0x000000001B10A000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-56-0x000000001AFE0000-0x000000001B10A000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-58-0x000000001AFE0000-0x000000001B10A000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-54-0x000000001AFE0000-0x000000001B10A000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-62-0x000000001AFE0000-0x000000001B10A000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-66-0x000000001AFE0000-0x000000001B10A000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-64-0x000000001AFE0000-0x000000001B10A000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-60-0x000000001AFE0000-0x000000001B10A000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-52-0x000000001AFE0000-0x000000001B10A000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-48-0x000000001AFE0000-0x000000001B10A000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-46-0x000000001AFE0000-0x000000001B10A000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-44-0x000000001AFE0000-0x000000001B10A000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-42-0x000000001AFE0000-0x000000001B10A000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-38-0x000000001AFE0000-0x000000001B10A000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-36-0x000000001AFE0000-0x000000001B10A000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-32-0x000000001AFE0000-0x000000001B10A000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-28-0x000000001AFE0000-0x000000001B10A000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-26-0x000000001AFE0000-0x000000001B10A000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-22-0x000000001AFE0000-0x000000001B10A000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-20-0x000000001AFE0000-0x000000001B10A000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-18-0x000000001AFE0000-0x000000001B10A000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-16-0x000000001AFE0000-0x000000001B10A000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-14-0x000000001AFE0000-0x000000001B10A000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-12-0x000000001AFE0000-0x000000001B10A000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-10-0x000000001AFE0000-0x000000001B10A000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-6-0x000000001AFE0000-0x000000001B10A000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-4-0x000000001AFE0000-0x000000001B10A000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-3-0x000000001AFE0000-0x000000001B10A000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-925-0x000000001AF60000-0x000000001AFE0000-memory.dmp	family_zgrat_v1
behavioral1/memory/2468-941-0x000000001AA90000-0x000000001AB74000-memory.dmp	family_zgrat_v1
behavioral1/memory/1868-4090-0x00000000004B0000-0x0000000000594000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Executes dropped EXE 2 IoCs

pid	Process
3008	ContextProperties.exe
1868	ContextProperties.exe

Loads dropped DLL 1 IoCs

pid	Process
2992	taskeng.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1820 set thread context of 2468	1820	ab0443c4b5ae89cd913377183852ecb3.exe	28
PID 3008 set thread context of 1868	3008	ContextProperties.exe	32

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
1868	ContextProperties.exe
1868	ContextProperties.exe
1868	ContextProperties.exe
1868	ContextProperties.exe
1868	ContextProperties.exe
1868	ContextProperties.exe
1868	ContextProperties.exe
1868	ContextProperties.exe
1868	ContextProperties.exe
1868	ContextProperties.exe
1868	ContextProperties.exe
1868	ContextProperties.exe
1868	ContextProperties.exe
1868	ContextProperties.exe
1868	ContextProperties.exe
1868	ContextProperties.exe
1868	ContextProperties.exe
1868	ContextProperties.exe
1868	ContextProperties.exe
1868	ContextProperties.exe
1868	ContextProperties.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1820	ab0443c4b5ae89cd913377183852ecb3.exe
Token: SeDebugPrivilege	2468	ab0443c4b5ae89cd913377183852ecb3.exe
Token: SeDebugPrivilege	3008	ContextProperties.exe
Token: SeDebugPrivilege	1868	ContextProperties.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 2468	1820	ab0443c4b5ae89cd913377183852ecb3.exe	28
PID 1820 wrote to memory of 2468	1820	ab0443c4b5ae89cd913377183852ecb3.exe	28
PID 1820 wrote to memory of 2468	1820	ab0443c4b5ae89cd913377183852ecb3.exe	28
PID 1820 wrote to memory of 2468	1820	ab0443c4b5ae89cd913377183852ecb3.exe	28
PID 1820 wrote to memory of 2468	1820	ab0443c4b5ae89cd913377183852ecb3.exe	28
PID 1820 wrote to memory of 2468	1820	ab0443c4b5ae89cd913377183852ecb3.exe	28
PID 1820 wrote to memory of 2468	1820	ab0443c4b5ae89cd913377183852ecb3.exe	28
PID 2992 wrote to memory of 3008	2992	taskeng.exe	31
PID 2992 wrote to memory of 3008	2992	taskeng.exe	31
PID 2992 wrote to memory of 3008	2992	taskeng.exe	31
PID 3008 wrote to memory of 1868	3008	ContextProperties.exe	32
PID 3008 wrote to memory of 1868	3008	ContextProperties.exe	32
PID 3008 wrote to memory of 1868	3008	ContextProperties.exe	32
PID 3008 wrote to memory of 1868	3008	ContextProperties.exe	32
PID 3008 wrote to memory of 1868	3008	ContextProperties.exe	32
PID 3008 wrote to memory of 1868	3008	ContextProperties.exe	32
PID 3008 wrote to memory of 1868	3008	ContextProperties.exe	32
PID 1868 wrote to memory of 2348	1868	ContextProperties.exe	35
PID 1868 wrote to memory of 2348	1868	ContextProperties.exe	35
PID 1868 wrote to memory of 2348	1868	ContextProperties.exe	35
PID 1868 wrote to memory of 2408	1868	ContextProperties.exe	36
PID 1868 wrote to memory of 2408	1868	ContextProperties.exe	36
PID 1868 wrote to memory of 2408	1868	ContextProperties.exe	36
PID 1868 wrote to memory of 668	1868	ContextProperties.exe	37
PID 1868 wrote to memory of 668	1868	ContextProperties.exe	37
PID 1868 wrote to memory of 668	1868	ContextProperties.exe	37
PID 1868 wrote to memory of 932	1868	ContextProperties.exe	38
PID 1868 wrote to memory of 932	1868	ContextProperties.exe	38
PID 1868 wrote to memory of 932	1868	ContextProperties.exe	38
PID 1868 wrote to memory of 836	1868	ContextProperties.exe	39
PID 1868 wrote to memory of 836	1868	ContextProperties.exe	39
PID 1868 wrote to memory of 836	1868	ContextProperties.exe	39
PID 1868 wrote to memory of 796	1868	ContextProperties.exe	40
PID 1868 wrote to memory of 796	1868	ContextProperties.exe	40
PID 1868 wrote to memory of 796	1868	ContextProperties.exe	40
PID 1868 wrote to memory of 2448	1868	ContextProperties.exe	41
PID 1868 wrote to memory of 2448	1868	ContextProperties.exe	41
PID 1868 wrote to memory of 2448	1868	ContextProperties.exe	41
PID 1868 wrote to memory of 2452	1868	ContextProperties.exe	42
PID 1868 wrote to memory of 2452	1868	ContextProperties.exe	42
PID 1868 wrote to memory of 2452	1868	ContextProperties.exe	42
PID 1868 wrote to memory of 1032	1868	ContextProperties.exe	43
PID 1868 wrote to memory of 1032	1868	ContextProperties.exe	43
PID 1868 wrote to memory of 1032	1868	ContextProperties.exe	43
PID 1868 wrote to memory of 2248	1868	ContextProperties.exe	44
PID 1868 wrote to memory of 2248	1868	ContextProperties.exe	44
PID 1868 wrote to memory of 2248	1868	ContextProperties.exe	44

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ab0443c4b5ae89cd913377183852ecb3.exe
"C:\Users\Admin\AppData\Local\Temp\ab0443c4b5ae89cd913377183852ecb3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Users\Admin\AppData\Local\Temp\ab0443c4b5ae89cd913377183852ecb3.exe
  C:\Users\Admin\AppData\Local\Temp\ab0443c4b5ae89cd913377183852ecb3.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2468

C:\Windows\system32\taskeng.exe
taskeng.exe {7690D575-1AD8-4A27-8D9F-390161C04B08} S-1-5-21-2058106572-1146578376-825901627-1000:LPKQNNGV\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Users\Admin\AppData\Local\AceFlags\cxwmvf\ContextProperties.exe
  C:\Users\Admin\AppData\Local\AceFlags\cxwmvf\ContextProperties.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3008
- - C:\Users\Admin\AppData\Local\AceFlags\cxwmvf\ContextProperties.exe
    C:\Users\Admin\AppData\Local\AceFlags\cxwmvf\ContextProperties.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1868
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
      4⤵
      PID:2348
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
      4⤵
      PID:2408
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
      4⤵
      PID:668
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
      4⤵
      PID:932
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
      4⤵
      PID:836
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
      4⤵
      PID:796
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
      4⤵
      PID:2448
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
      4⤵
      PID:2452
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
      4⤵
      PID:1032
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
      4⤵
      PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\AceFlags\cxwmvf\ContextProperties.exe

Filesize
1.2MB

MD5
ab0443c4b5ae89cd913377183852ecb3

SHA1
23cf5fb65377cfe0af63adede50c50fb24dc32ab

SHA256
8252f99b0f6c26c5c6360c896b26d2acf273ec3c68cf2d883fce4727fe926237

SHA512
149ef11f5b394b29310bb43bac8dc7356fe08c8916359b85de8b05b6033c76cb3e230fcd7098bba9acaf7dfc4570aba479b6e9b05369043f1d24a7f5d78e7d7b

Download Submit
memory/1820-20-0x000000001AFE0000-0x000000001B10A000-memory.dmp

Filesize
1.2MB

Download
memory/1820-928-0x0000000000B10000-0x0000000000B5C000-memory.dmp

Filesize
304KB

Download
memory/1820-2-0x000007FEF5610000-0x000007FEF5FFC000-memory.dmp

Filesize
9.9MB

Download
memory/1820-8-0x000000001AFE0000-0x000000001B10A000-memory.dmp

Filesize
1.2MB

Download
memory/1820-24-0x000000001AFE0000-0x000000001B10A000-memory.dmp

Filesize
1.2MB

Download
memory/1820-30-0x000000001AFE0000-0x000000001B10A000-memory.dmp

Filesize
1.2MB

Download
memory/1820-34-0x000000001AFE0000-0x000000001B10A000-memory.dmp

Filesize
1.2MB

Download
memory/1820-40-0x000000001AFE0000-0x000000001B10A000-memory.dmp

Filesize
1.2MB

Download
memory/1820-50-0x000000001AFE0000-0x000000001B10A000-memory.dmp

Filesize
1.2MB

Download
memory/1820-56-0x000000001AFE0000-0x000000001B10A000-memory.dmp

Filesize
1.2MB

Download
memory/1820-58-0x000000001AFE0000-0x000000001B10A000-memory.dmp

Filesize
1.2MB

Download
memory/1820-54-0x000000001AFE0000-0x000000001B10A000-memory.dmp

Filesize
1.2MB

Download
memory/1820-62-0x000000001AFE0000-0x000000001B10A000-memory.dmp

Filesize
1.2MB

Download
memory/1820-66-0x000000001AFE0000-0x000000001B10A000-memory.dmp

Filesize
1.2MB

Download
memory/1820-64-0x000000001AFE0000-0x000000001B10A000-memory.dmp

Filesize
1.2MB

Download
memory/1820-60-0x000000001AFE0000-0x000000001B10A000-memory.dmp

Filesize
1.2MB

Download
memory/1820-52-0x000000001AFE0000-0x000000001B10A000-memory.dmp

Filesize
1.2MB

Download
memory/1820-48-0x000000001AFE0000-0x000000001B10A000-memory.dmp

Filesize
1.2MB

Download
memory/1820-14-0x000000001AFE0000-0x000000001B10A000-memory.dmp

Filesize
1.2MB

Download
memory/1820-44-0x000000001AFE0000-0x000000001B10A000-memory.dmp

Filesize
1.2MB

Download
memory/1820-42-0x000000001AFE0000-0x000000001B10A000-memory.dmp

Filesize
1.2MB

Download
memory/1820-38-0x000000001AFE0000-0x000000001B10A000-memory.dmp

Filesize
1.2MB

Download
memory/1820-36-0x000000001AFE0000-0x000000001B10A000-memory.dmp

Filesize
1.2MB

Download
memory/1820-32-0x000000001AFE0000-0x000000001B10A000-memory.dmp

Filesize
1.2MB

Download
memory/1820-28-0x000000001AFE0000-0x000000001B10A000-memory.dmp

Filesize
1.2MB

Download
memory/1820-26-0x000000001AFE0000-0x000000001B10A000-memory.dmp

Filesize
1.2MB

Download
memory/1820-22-0x000000001AFE0000-0x000000001B10A000-memory.dmp

Filesize
1.2MB

Download
memory/1820-0-0x0000000001000000-0x000000000113A000-memory.dmp

Filesize
1.2MB

Download
memory/1820-1-0x000000001AFE0000-0x000000001B110000-memory.dmp

Filesize
1.2MB

Download
memory/1820-18-0x000000001AFE0000-0x000000001B10A000-memory.dmp

Filesize
1.2MB

Download
memory/1820-46-0x000000001AFE0000-0x000000001B10A000-memory.dmp

Filesize
1.2MB

Download
memory/1820-12-0x000000001AFE0000-0x000000001B10A000-memory.dmp

Filesize
1.2MB

Download
memory/1820-10-0x000000001AFE0000-0x000000001B10A000-memory.dmp

Filesize
1.2MB

Download
memory/1820-6-0x000000001AFE0000-0x000000001B10A000-memory.dmp

Filesize
1.2MB

Download
memory/1820-4-0x000000001AFE0000-0x000000001B10A000-memory.dmp

Filesize
1.2MB

Download
memory/1820-3-0x000000001AFE0000-0x000000001B10A000-memory.dmp

Filesize
1.2MB

Download
memory/1820-926-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/1820-925-0x000000001AF60000-0x000000001AFE0000-memory.dmp

Filesize
512KB

Download
memory/1820-16-0x000000001AFE0000-0x000000001B10A000-memory.dmp

Filesize
1.2MB

Download
memory/1820-927-0x000000001A8C0000-0x000000001A98A000-memory.dmp

Filesize
808KB

Download
memory/1820-938-0x000007FEF5610000-0x000007FEF5FFC000-memory.dmp

Filesize
9.9MB

Download
memory/1868-4091-0x000007FEF4C20000-0x000007FEF560C000-memory.dmp

Filesize
9.9MB

Download
memory/1868-4090-0x00000000004B0000-0x0000000000594000-memory.dmp

Filesize
912KB

Download
memory/1868-6290-0x000000001B0B0000-0x000000001B130000-memory.dmp

Filesize
512KB

Download
memory/1868-6291-0x000007FEF4C20000-0x000007FEF560C000-memory.dmp

Filesize
9.9MB

Download
memory/2468-3144-0x000000001A8C0000-0x000000001A914000-memory.dmp

Filesize
336KB

Download
memory/2468-943-0x000000001B150000-0x000000001B1D0000-memory.dmp

Filesize
512KB

Download
memory/2468-941-0x000000001AA90000-0x000000001AB74000-memory.dmp

Filesize
912KB

Download
memory/2468-942-0x000007FEF4C20000-0x000007FEF560C000-memory.dmp

Filesize
9.9MB

Download
memory/2468-3142-0x00000000003D0000-0x00000000003D8000-memory.dmp

Filesize
32KB

Download
memory/2468-3143-0x00000000005E0000-0x0000000000636000-memory.dmp

Filesize
344KB

Download
memory/2468-3146-0x000007FEF4C20000-0x000007FEF560C000-memory.dmp

Filesize
9.9MB

Download
memory/2468-940-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/3008-3152-0x000007FEF5610000-0x000007FEF5FFC000-memory.dmp

Filesize
9.9MB

Download
memory/3008-3151-0x00000000008F0000-0x0000000000A2A000-memory.dmp

Filesize
1.2MB

Download
memory/3008-4075-0x000000001A680000-0x000000001A700000-memory.dmp

Filesize
512KB

Download
memory/3008-4076-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/3008-4088-0x000007FEF5610000-0x000007FEF5FFC000-memory.dmp

Filesize
9.9MB

Download