Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
28-12-2023 07:27
Static task
static1
Behavioral task
behavioral1
Sample
cfbd28652bdc2f1c3a30d6ad3a77d408.exe
Resource
win7-20231215-en
General
-
Target
cfbd28652bdc2f1c3a30d6ad3a77d408.exe
-
Size
1.8MB
-
MD5
cfbd28652bdc2f1c3a30d6ad3a77d408
-
SHA1
846254a9fd531785ffa0cfc34b30a6b47c4603d6
-
SHA256
88a7e9929cb967f33475bc95d02e05449bcc7a04968777d5dffd3f33c8d1bad3
-
SHA512
268a0fed1f93ad29138a03654cc5282ed09f3d6d9930282df2cdc46fc5851cc14d56a9833d899ebd8d80d3f6b611f00dc062143bf08ebf73e8c3863ad2f85a86
-
SSDEEP
49152:JOxf2vTY5hgsgJ2a9N4FA3358pYwHvr/hou:pbEhda9N+A5UVhou
Malware Config
Extracted
bitrat
1.35
imen.ddns.net:1234
-
communication_password
fd1073eb898c17267347b0a3eb0d07b3
-
tor_process
tor
Signatures
-
Detect ZGRat V1 34 IoCs
Processes:
resource yara_rule behavioral2/memory/4496-10-0x0000000005570000-0x00000000055C8000-memory.dmp family_zgrat_v1 behavioral2/memory/4496-32-0x0000000005570000-0x00000000055C2000-memory.dmp family_zgrat_v1 behavioral2/memory/4496-44-0x0000000005570000-0x00000000055C2000-memory.dmp family_zgrat_v1 behavioral2/memory/4496-42-0x0000000005570000-0x00000000055C2000-memory.dmp family_zgrat_v1 behavioral2/memory/4496-46-0x0000000005570000-0x00000000055C2000-memory.dmp family_zgrat_v1 behavioral2/memory/4496-58-0x0000000005570000-0x00000000055C2000-memory.dmp family_zgrat_v1 behavioral2/memory/4496-74-0x0000000005570000-0x00000000055C2000-memory.dmp family_zgrat_v1 behavioral2/memory/4496-72-0x0000000005570000-0x00000000055C2000-memory.dmp family_zgrat_v1 behavioral2/memory/4496-70-0x0000000005570000-0x00000000055C2000-memory.dmp family_zgrat_v1 behavioral2/memory/4496-68-0x0000000005570000-0x00000000055C2000-memory.dmp family_zgrat_v1 behavioral2/memory/4496-66-0x0000000005570000-0x00000000055C2000-memory.dmp family_zgrat_v1 behavioral2/memory/4496-64-0x0000000005570000-0x00000000055C2000-memory.dmp family_zgrat_v1 behavioral2/memory/4496-62-0x0000000005570000-0x00000000055C2000-memory.dmp family_zgrat_v1 behavioral2/memory/4496-60-0x0000000005570000-0x00000000055C2000-memory.dmp family_zgrat_v1 behavioral2/memory/4496-56-0x0000000005570000-0x00000000055C2000-memory.dmp family_zgrat_v1 behavioral2/memory/4496-54-0x0000000005570000-0x00000000055C2000-memory.dmp family_zgrat_v1 behavioral2/memory/4496-52-0x0000000005570000-0x00000000055C2000-memory.dmp family_zgrat_v1 behavioral2/memory/4496-50-0x0000000005570000-0x00000000055C2000-memory.dmp family_zgrat_v1 behavioral2/memory/4496-48-0x0000000005570000-0x00000000055C2000-memory.dmp family_zgrat_v1 behavioral2/memory/4496-40-0x0000000005570000-0x00000000055C2000-memory.dmp family_zgrat_v1 behavioral2/memory/4496-38-0x0000000005570000-0x00000000055C2000-memory.dmp family_zgrat_v1 behavioral2/memory/4496-36-0x0000000005570000-0x00000000055C2000-memory.dmp family_zgrat_v1 behavioral2/memory/4496-34-0x0000000005570000-0x00000000055C2000-memory.dmp family_zgrat_v1 behavioral2/memory/4496-30-0x0000000005570000-0x00000000055C2000-memory.dmp family_zgrat_v1 behavioral2/memory/4496-28-0x0000000005570000-0x00000000055C2000-memory.dmp family_zgrat_v1 behavioral2/memory/4496-26-0x0000000005570000-0x00000000055C2000-memory.dmp family_zgrat_v1 behavioral2/memory/4496-24-0x0000000005570000-0x00000000055C2000-memory.dmp family_zgrat_v1 behavioral2/memory/4496-22-0x0000000005570000-0x00000000055C2000-memory.dmp family_zgrat_v1 behavioral2/memory/4496-20-0x0000000005570000-0x00000000055C2000-memory.dmp family_zgrat_v1 behavioral2/memory/4496-18-0x0000000005570000-0x00000000055C2000-memory.dmp family_zgrat_v1 behavioral2/memory/4496-16-0x0000000005570000-0x00000000055C2000-memory.dmp family_zgrat_v1 behavioral2/memory/4496-14-0x0000000005570000-0x00000000055C2000-memory.dmp family_zgrat_v1 behavioral2/memory/4496-12-0x0000000005570000-0x00000000055C2000-memory.dmp family_zgrat_v1 behavioral2/memory/4496-11-0x0000000005570000-0x00000000055C2000-memory.dmp family_zgrat_v1 -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cfbd28652bdc2f1c3a30d6ad3a77d408.exeWScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation cfbd28652bdc2f1c3a30d6ad3a77d408.exe Key value queried \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation WScript.exe -
Processes:
resource yara_rule behavioral2/memory/4904-1470-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4904-1529-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
cfbd28652bdc2f1c3a30d6ad3a77d408.exepid process 4904 cfbd28652bdc2f1c3a30d6ad3a77d408.exe 4904 cfbd28652bdc2f1c3a30d6ad3a77d408.exe 4904 cfbd28652bdc2f1c3a30d6ad3a77d408.exe 4904 cfbd28652bdc2f1c3a30d6ad3a77d408.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
cfbd28652bdc2f1c3a30d6ad3a77d408.exedescription pid process target process PID 4496 set thread context of 4904 4496 cfbd28652bdc2f1c3a30d6ad3a77d408.exe cfbd28652bdc2f1c3a30d6ad3a77d408.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
cfbd28652bdc2f1c3a30d6ad3a77d408.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings cfbd28652bdc2f1c3a30d6ad3a77d408.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
cfbd28652bdc2f1c3a30d6ad3a77d408.exepowershell.exepid process 4496 cfbd28652bdc2f1c3a30d6ad3a77d408.exe 4496 cfbd28652bdc2f1c3a30d6ad3a77d408.exe 4496 cfbd28652bdc2f1c3a30d6ad3a77d408.exe 4496 cfbd28652bdc2f1c3a30d6ad3a77d408.exe 4496 cfbd28652bdc2f1c3a30d6ad3a77d408.exe 4496 cfbd28652bdc2f1c3a30d6ad3a77d408.exe 4468 powershell.exe 4468 powershell.exe 4468 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
cfbd28652bdc2f1c3a30d6ad3a77d408.exepowershell.execfbd28652bdc2f1c3a30d6ad3a77d408.exedescription pid process Token: SeDebugPrivilege 4496 cfbd28652bdc2f1c3a30d6ad3a77d408.exe Token: SeDebugPrivilege 4468 powershell.exe Token: SeShutdownPrivilege 4904 cfbd28652bdc2f1c3a30d6ad3a77d408.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
cfbd28652bdc2f1c3a30d6ad3a77d408.exepid process 4904 cfbd28652bdc2f1c3a30d6ad3a77d408.exe 4904 cfbd28652bdc2f1c3a30d6ad3a77d408.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
cfbd28652bdc2f1c3a30d6ad3a77d408.exeWScript.exedescription pid process target process PID 4496 wrote to memory of 4424 4496 cfbd28652bdc2f1c3a30d6ad3a77d408.exe WScript.exe PID 4496 wrote to memory of 4424 4496 cfbd28652bdc2f1c3a30d6ad3a77d408.exe WScript.exe PID 4496 wrote to memory of 4424 4496 cfbd28652bdc2f1c3a30d6ad3a77d408.exe WScript.exe PID 4496 wrote to memory of 2944 4496 cfbd28652bdc2f1c3a30d6ad3a77d408.exe cfbd28652bdc2f1c3a30d6ad3a77d408.exe PID 4496 wrote to memory of 2944 4496 cfbd28652bdc2f1c3a30d6ad3a77d408.exe cfbd28652bdc2f1c3a30d6ad3a77d408.exe PID 4496 wrote to memory of 2944 4496 cfbd28652bdc2f1c3a30d6ad3a77d408.exe cfbd28652bdc2f1c3a30d6ad3a77d408.exe PID 4496 wrote to memory of 4904 4496 cfbd28652bdc2f1c3a30d6ad3a77d408.exe cfbd28652bdc2f1c3a30d6ad3a77d408.exe PID 4496 wrote to memory of 4904 4496 cfbd28652bdc2f1c3a30d6ad3a77d408.exe cfbd28652bdc2f1c3a30d6ad3a77d408.exe PID 4496 wrote to memory of 4904 4496 cfbd28652bdc2f1c3a30d6ad3a77d408.exe cfbd28652bdc2f1c3a30d6ad3a77d408.exe PID 4496 wrote to memory of 4904 4496 cfbd28652bdc2f1c3a30d6ad3a77d408.exe cfbd28652bdc2f1c3a30d6ad3a77d408.exe PID 4496 wrote to memory of 4904 4496 cfbd28652bdc2f1c3a30d6ad3a77d408.exe cfbd28652bdc2f1c3a30d6ad3a77d408.exe PID 4496 wrote to memory of 4904 4496 cfbd28652bdc2f1c3a30d6ad3a77d408.exe cfbd28652bdc2f1c3a30d6ad3a77d408.exe PID 4496 wrote to memory of 4904 4496 cfbd28652bdc2f1c3a30d6ad3a77d408.exe cfbd28652bdc2f1c3a30d6ad3a77d408.exe PID 4424 wrote to memory of 4468 4424 WScript.exe powershell.exe PID 4424 wrote to memory of 4468 4424 WScript.exe powershell.exe PID 4424 wrote to memory of 4468 4424 WScript.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cfbd28652bdc2f1c3a30d6ad3a77d408.exe"C:\Users\Admin\AppData\Local\Temp\cfbd28652bdc2f1c3a30d6ad3a77d408.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Ekleezyvovzpjcfscz.vbs"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\chrome\chrome\chrome\chrome.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\cfbd28652bdc2f1c3a30d6ad3a77d408.exeC:\Users\Admin\AppData\Local\Temp\cfbd28652bdc2f1c3a30d6ad3a77d408.exe2⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\cfbd28652bdc2f1c3a30d6ad3a77d408.exeC:\Users\Admin\AppData\Local\Temp\cfbd28652bdc2f1c3a30d6ad3a77d408.exe2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4904
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4468-1473-0x0000000002420000-0x0000000002430000-memory.dmpFilesize
64KB
-
memory/4468-1518-0x0000000074990000-0x0000000075140000-memory.dmpFilesize
7.7MB
-
memory/4468-1513-0x0000000007250000-0x0000000007264000-memory.dmpFilesize
80KB
-
memory/4468-1515-0x0000000007290000-0x0000000007298000-memory.dmpFilesize
32KB
-
memory/4468-1514-0x0000000007360000-0x000000000737A000-memory.dmpFilesize
104KB
-
memory/4468-1512-0x0000000007240000-0x000000000724E000-memory.dmpFilesize
56KB
-
memory/4468-1511-0x0000000007210000-0x0000000007221000-memory.dmpFilesize
68KB
-
memory/4468-1510-0x00000000072A0000-0x0000000007336000-memory.dmpFilesize
600KB
-
memory/4468-1509-0x0000000007080000-0x000000000708A000-memory.dmpFilesize
40KB
-
memory/4468-1507-0x0000000007660000-0x0000000007CDA000-memory.dmpFilesize
6.5MB
-
memory/4468-1508-0x0000000007010000-0x000000000702A000-memory.dmpFilesize
104KB
-
memory/4468-1491-0x000000007EF00000-0x000000007EF10000-memory.dmpFilesize
64KB
-
memory/4468-1492-0x00000000062B0000-0x00000000062E2000-memory.dmpFilesize
200KB
-
memory/4468-1493-0x00000000707B0000-0x00000000707FC000-memory.dmpFilesize
304KB
-
memory/4468-1503-0x0000000006300000-0x000000000631E000-memory.dmpFilesize
120KB
-
memory/4468-1504-0x0000000002420000-0x0000000002430000-memory.dmpFilesize
64KB
-
memory/4468-1505-0x0000000002420000-0x0000000002430000-memory.dmpFilesize
64KB
-
memory/4468-1506-0x0000000006EE0000-0x0000000006F83000-memory.dmpFilesize
652KB
-
memory/4468-1490-0x0000000005D30000-0x0000000005D7C000-memory.dmpFilesize
304KB
-
memory/4468-1489-0x0000000005CF0000-0x0000000005D0E000-memory.dmpFilesize
120KB
-
memory/4468-1471-0x00000000023E0000-0x0000000002416000-memory.dmpFilesize
216KB
-
memory/4468-1488-0x0000000005830000-0x0000000005B84000-memory.dmpFilesize
3.3MB
-
memory/4468-1477-0x0000000005640000-0x00000000056A6000-memory.dmpFilesize
408KB
-
memory/4468-1483-0x00000000056B0000-0x0000000005716000-memory.dmpFilesize
408KB
-
memory/4468-1472-0x0000000074990000-0x0000000075140000-memory.dmpFilesize
7.7MB
-
memory/4468-1474-0x0000000002420000-0x0000000002430000-memory.dmpFilesize
64KB
-
memory/4468-1476-0x0000000004E70000-0x0000000004E92000-memory.dmpFilesize
136KB
-
memory/4468-1475-0x0000000004EA0000-0x00000000054C8000-memory.dmpFilesize
6.2MB
-
memory/4496-66-0x0000000005570000-0x00000000055C2000-memory.dmpFilesize
328KB
-
memory/4496-64-0x0000000005570000-0x00000000055C2000-memory.dmpFilesize
328KB
-
memory/4496-38-0x0000000005570000-0x00000000055C2000-memory.dmpFilesize
328KB
-
memory/4496-36-0x0000000005570000-0x00000000055C2000-memory.dmpFilesize
328KB
-
memory/4496-34-0x0000000005570000-0x00000000055C2000-memory.dmpFilesize
328KB
-
memory/4496-30-0x0000000005570000-0x00000000055C2000-memory.dmpFilesize
328KB
-
memory/4496-28-0x0000000005570000-0x00000000055C2000-memory.dmpFilesize
328KB
-
memory/4496-26-0x0000000005570000-0x00000000055C2000-memory.dmpFilesize
328KB
-
memory/4496-24-0x0000000005570000-0x00000000055C2000-memory.dmpFilesize
328KB
-
memory/4496-22-0x0000000005570000-0x00000000055C2000-memory.dmpFilesize
328KB
-
memory/4496-20-0x0000000005570000-0x00000000055C2000-memory.dmpFilesize
328KB
-
memory/4496-18-0x0000000005570000-0x00000000055C2000-memory.dmpFilesize
328KB
-
memory/4496-16-0x0000000005570000-0x00000000055C2000-memory.dmpFilesize
328KB
-
memory/4496-14-0x0000000005570000-0x00000000055C2000-memory.dmpFilesize
328KB
-
memory/4496-12-0x0000000005570000-0x00000000055C2000-memory.dmpFilesize
328KB
-
memory/4496-11-0x0000000005570000-0x00000000055C2000-memory.dmpFilesize
328KB
-
memory/4496-0-0x0000000000F30000-0x000000000110E000-memory.dmpFilesize
1.9MB
-
memory/4496-1468-0x0000000074910000-0x00000000750C0000-memory.dmpFilesize
7.7MB
-
memory/4496-48-0x0000000005570000-0x00000000055C2000-memory.dmpFilesize
328KB
-
memory/4496-50-0x0000000005570000-0x00000000055C2000-memory.dmpFilesize
328KB
-
memory/4496-52-0x0000000005570000-0x00000000055C2000-memory.dmpFilesize
328KB
-
memory/4496-54-0x0000000005570000-0x00000000055C2000-memory.dmpFilesize
328KB
-
memory/4496-56-0x0000000005570000-0x00000000055C2000-memory.dmpFilesize
328KB
-
memory/4496-60-0x0000000005570000-0x00000000055C2000-memory.dmpFilesize
328KB
-
memory/4496-62-0x0000000005570000-0x00000000055C2000-memory.dmpFilesize
328KB
-
memory/4496-40-0x0000000005570000-0x00000000055C2000-memory.dmpFilesize
328KB
-
memory/4496-1-0x0000000074910000-0x00000000750C0000-memory.dmpFilesize
7.7MB
-
memory/4496-68-0x0000000005570000-0x00000000055C2000-memory.dmpFilesize
328KB
-
memory/4496-70-0x0000000005570000-0x00000000055C2000-memory.dmpFilesize
328KB
-
memory/4496-72-0x0000000005570000-0x00000000055C2000-memory.dmpFilesize
328KB
-
memory/4496-74-0x0000000005570000-0x00000000055C2000-memory.dmpFilesize
328KB
-
memory/4496-58-0x0000000005570000-0x00000000055C2000-memory.dmpFilesize
328KB
-
memory/4496-46-0x0000000005570000-0x00000000055C2000-memory.dmpFilesize
328KB
-
memory/4496-42-0x0000000005570000-0x00000000055C2000-memory.dmpFilesize
328KB
-
memory/4496-44-0x0000000005570000-0x00000000055C2000-memory.dmpFilesize
328KB
-
memory/4496-32-0x0000000005570000-0x00000000055C2000-memory.dmpFilesize
328KB
-
memory/4496-10-0x0000000005570000-0x00000000055C8000-memory.dmpFilesize
352KB
-
memory/4496-9-0x0000000007100000-0x00000000072A8000-memory.dmpFilesize
1.7MB
-
memory/4496-8-0x0000000005D90000-0x0000000005DA0000-memory.dmpFilesize
64KB
-
memory/4496-7-0x0000000005D90000-0x0000000005DA0000-memory.dmpFilesize
64KB
-
memory/4496-6-0x0000000074910000-0x00000000750C0000-memory.dmpFilesize
7.7MB
-
memory/4496-5-0x0000000005BA0000-0x0000000005BAA000-memory.dmpFilesize
40KB
-
memory/4496-4-0x0000000005D90000-0x0000000005DA0000-memory.dmpFilesize
64KB
-
memory/4496-3-0x0000000005AF0000-0x0000000005B82000-memory.dmpFilesize
584KB
-
memory/4496-2-0x00000000061B0000-0x0000000006754000-memory.dmpFilesize
5.6MB
-
memory/4904-1470-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4904-1520-0x0000000074820000-0x0000000074859000-memory.dmpFilesize
228KB
-
memory/4904-1528-0x0000000074BC0000-0x0000000074BF9000-memory.dmpFilesize
228KB
-
memory/4904-1529-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4904-1532-0x0000000074BC0000-0x0000000074BF9000-memory.dmpFilesize
228KB
-
memory/4904-1535-0x0000000074BC0000-0x0000000074BF9000-memory.dmpFilesize
228KB
-
memory/4904-1538-0x0000000074BC0000-0x0000000074BF9000-memory.dmpFilesize
228KB