zgrat | 776f5f4b3705685232f19d3bc76bc34af07ee2f230b9f4e16e56475dc7318603

Analysis

max time kernel
91s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 15:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PURCHASE ORDER 6523027_1.scr.exe
Size

9KB
MD5

fa17ada82de6fd6c7b93ec054ce3f085
SHA1

9db9954948de1c720ad28bf41b5e10c3588d9c21
SHA256

776f5f4b3705685232f19d3bc76bc34af07ee2f230b9f4e16e56475dc7318603
SHA512

0495c2479f5d7fd47bdcd5a5a098fca2c05c50f2c851540da138f0f280ba944eb4f8cdb9241d54faf829f217b7d2f82d394cc84feb1536f2a96664e49234323e
SSDEEP

96:WAfyA0Qts/4gb1f4JaYogNJVMps3PH7C64ln+flCnWiYNYNaRzNt:z0Q6/4gkT2ps+6unyBakz

Score

10^/10

zgrat persistence rat

Malware Config

Signatures

Detect ZGRat V1 34 IoCs

resource	yara_rule
behavioral2/memory/3480-5-0x000001F7B5260000-0x000001F7B53C0000-memory.dmp	family_zgrat_v1
behavioral2/memory/3480-6-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp	family_zgrat_v1
behavioral2/memory/3480-13-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp	family_zgrat_v1
behavioral2/memory/3480-23-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp	family_zgrat_v1
behavioral2/memory/3480-31-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp	family_zgrat_v1
behavioral2/memory/3480-41-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp	family_zgrat_v1
behavioral2/memory/3480-49-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp	family_zgrat_v1
behavioral2/memory/3480-59-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp	family_zgrat_v1
behavioral2/memory/3480-63-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp	family_zgrat_v1
behavioral2/memory/3480-61-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp	family_zgrat_v1
behavioral2/memory/3480-67-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp	family_zgrat_v1
behavioral2/memory/3480-69-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp	family_zgrat_v1
behavioral2/memory/3480-65-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp	family_zgrat_v1
behavioral2/memory/3480-57-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp	family_zgrat_v1
behavioral2/memory/3480-55-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp	family_zgrat_v1
behavioral2/memory/3480-53-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp	family_zgrat_v1
behavioral2/memory/3480-51-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp	family_zgrat_v1
behavioral2/memory/3480-47-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp	family_zgrat_v1
behavioral2/memory/3480-45-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp	family_zgrat_v1
behavioral2/memory/3480-43-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp	family_zgrat_v1
behavioral2/memory/3480-39-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp	family_zgrat_v1
behavioral2/memory/3480-37-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp	family_zgrat_v1
behavioral2/memory/3480-35-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp	family_zgrat_v1
behavioral2/memory/3480-33-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp	family_zgrat_v1
behavioral2/memory/3480-29-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp	family_zgrat_v1
behavioral2/memory/3480-27-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp	family_zgrat_v1
behavioral2/memory/3480-25-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp	family_zgrat_v1
behavioral2/memory/3480-21-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp	family_zgrat_v1
behavioral2/memory/3480-19-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp	family_zgrat_v1
behavioral2/memory/3480-17-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp	family_zgrat_v1
behavioral2/memory/3480-15-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp	family_zgrat_v1
behavioral2/memory/3480-11-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp	family_zgrat_v1
behavioral2/memory/3480-9-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp	family_zgrat_v1
behavioral2/memory/3480-7-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ljfwqmdkju = "C:\\Users\\Admin\\AppData\\Roaming\\Ljfwqmdkju.exe"	PURCHASE ORDER 6523027_1.scr.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3480 set thread context of 4204	3480	PURCHASE ORDER 6523027_1.scr.exe	105

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3480	PURCHASE ORDER 6523027_1.scr.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3480	PURCHASE ORDER 6523027_1.scr.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 4204	3480	PURCHASE ORDER 6523027_1.scr.exe	105
PID 3480 wrote to memory of 4204	3480	PURCHASE ORDER 6523027_1.scr.exe	105
PID 3480 wrote to memory of 4204	3480	PURCHASE ORDER 6523027_1.scr.exe	105
PID 3480 wrote to memory of 4204	3480	PURCHASE ORDER 6523027_1.scr.exe	105
PID 3480 wrote to memory of 4204	3480	PURCHASE ORDER 6523027_1.scr.exe	105
PID 3480 wrote to memory of 4204	3480	PURCHASE ORDER 6523027_1.scr.exe	105

C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER 6523027_1.scr.exe
"C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER 6523027_1.scr.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER 6523027_1.scr.exe
  "C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER 6523027_1.scr.exe"
  2⤵
  PID:4204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\PURCHASE ORDER 6523027_1.scr.exe.log

Filesize
1KB

MD5
613cb5d019ab441a116f4eef391473c5

SHA1
f5b5ee69ffed1572a4dfeb057ff7d8497ca26b7e

SHA256
fdee314b0607958df9c21a1c3ecad8149a243e0a6fe15002ff0fcc3435a9f1e6

SHA512
2dfb09adac2591594932cbf634ed54b52336150e5c1b9ae8ed09a2a61035296c02cc4d22bb515c88b36bacd26271048fa99d2044242631ecd9cf6a724fb8809f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Costura\1485B29524EF63EB83DF771D39CCA767\64\sqlite.interop.dll

Filesize
93KB

MD5
cec8f07a1c23dce387645b9e745127ee

SHA1
cb64176863e8d907d166b33b8092954b72ba9e98

SHA256
48e16e2bea4474f7ddf0c21f01d542dd002c58020e28283a0c97be373d286fc2

SHA512
48f8ed9e75981e655b03cce6a654a49511d4c20dae38c21d0695d145261a998c1fc4bcfedae94148ffbcd0dede52894c9edc64af0fab19d528fac30b9ea5d41c

Download Submit
memory/3480-33-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp

Filesize
1.4MB

Download
memory/3480-1-0x00007FFEA6D30000-0x00007FFEA77F1000-memory.dmp

Filesize
10.8MB

Download
memory/3480-4-0x000001F79C7E0000-0x000001F79C7F0000-memory.dmp

Filesize
64KB

Download
memory/3480-5-0x000001F7B5260000-0x000001F7B53C0000-memory.dmp

Filesize
1.4MB

Download
memory/3480-6-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp

Filesize
1.4MB

Download
memory/3480-13-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp

Filesize
1.4MB

Download
memory/3480-23-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp

Filesize
1.4MB

Download
memory/3480-31-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp

Filesize
1.4MB

Download
memory/3480-41-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp

Filesize
1.4MB

Download
memory/3480-49-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp

Filesize
1.4MB

Download
memory/3480-59-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp

Filesize
1.4MB

Download
memory/3480-63-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp

Filesize
1.4MB

Download
memory/3480-61-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp

Filesize
1.4MB

Download
memory/3480-67-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp

Filesize
1.4MB

Download
memory/3480-69-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp

Filesize
1.4MB

Download
memory/3480-65-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp

Filesize
1.4MB

Download
memory/3480-57-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp

Filesize
1.4MB

Download
memory/3480-55-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp

Filesize
1.4MB

Download
memory/3480-53-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp

Filesize
1.4MB

Download
memory/3480-51-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp

Filesize
1.4MB

Download
memory/3480-47-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp

Filesize
1.4MB

Download
memory/3480-45-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp

Filesize
1.4MB

Download
memory/3480-43-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp

Filesize
1.4MB

Download
memory/3480-39-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp

Filesize
1.4MB

Download
memory/3480-37-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp

Filesize
1.4MB

Download
memory/3480-35-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp

Filesize
1.4MB

Download
memory/3480-3-0x00007FFEA6D30000-0x00007FFEA77F1000-memory.dmp

Filesize
10.8MB

Download
memory/3480-27-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp

Filesize
1.4MB

Download
memory/3480-2-0x000001F79C7E0000-0x000001F79C7F0000-memory.dmp

Filesize
64KB

Download
memory/3480-25-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp

Filesize
1.4MB

Download
memory/3480-21-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp

Filesize
1.4MB

Download
memory/3480-19-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp

Filesize
1.4MB

Download
memory/3480-17-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp

Filesize
1.4MB

Download
memory/3480-15-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp

Filesize
1.4MB

Download
memory/3480-11-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp

Filesize
1.4MB

Download
memory/3480-9-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp

Filesize
1.4MB

Download
memory/3480-7-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp

Filesize
1.4MB

Download
memory/3480-938-0x000001F79C7D0000-0x000001F79C7D1000-memory.dmp

Filesize
4KB

Download
memory/3480-940-0x000001F79C7F0000-0x000001F79C83C000-memory.dmp

Filesize
304KB

Download
memory/3480-939-0x000001F7B5430000-0x000001F7B5528000-memory.dmp

Filesize
992KB

Download
memory/3480-0-0x000001F79AC30000-0x000001F79AC38000-memory.dmp

Filesize
32KB

Download
memory/3480-946-0x00007FFEA6D30000-0x00007FFEA77F1000-memory.dmp

Filesize
10.8MB

Download
memory/3480-29-0x000001F7B5260000-0x000001F7B53BB000-memory.dmp

Filesize
1.4MB

Download
memory/4204-3160-0x00000174650D0000-0x000001746510A000-memory.dmp

Filesize
232KB

Download
memory/4204-949-0x0000017464A30000-0x0000017464A40000-memory.dmp

Filesize
64KB

Download
memory/4204-947-0x00007FFEA6D30000-0x00007FFEA77F1000-memory.dmp

Filesize
10.8MB

Download
memory/4204-3148-0x000001744BFA0000-0x000001744C03E000-memory.dmp

Filesize
632KB

Download
memory/4204-3149-0x0000017464B40000-0x0000017464D50000-memory.dmp

Filesize
2.1MB

Download
memory/4204-3155-0x0000017464A30000-0x0000017464A40000-memory.dmp

Filesize
64KB

Download
memory/4204-948-0x00000174648B0000-0x00000174649BA000-memory.dmp

Filesize
1.0MB

Download
memory/4204-945-0x0000000140000000-0x00000001400D0000-memory.dmp

Filesize
832KB

Download
memory/4204-3157-0x00000174649C0000-0x0000017464A2C000-memory.dmp

Filesize
432KB

Download
memory/4204-3156-0x0000017464DD0000-0x0000017464E4A000-memory.dmp

Filesize
488KB

Download
memory/4204-3161-0x0000017464D90000-0x0000017464DB6000-memory.dmp

Filesize
152KB

Download
memory/4204-3154-0x00007FFEA6D30000-0x00007FFEA77F1000-memory.dmp

Filesize
10.8MB

Download
memory/4204-3202-0x00007FFEA6D30000-0x00007FFEA77F1000-memory.dmp

Filesize
10.8MB

Download