zgrat | a057dce421f954cd0f7a88bb09a9475526290d702f62fe137a4e07bbc1385592

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2024, 07:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

A27231C997680ED04BD67255DF13A244.exe
Size

1.7MB
MD5

a27231c997680ed04bd67255df13a244
SHA1

735e6ceaeb3c60ed2c840322c14f681b5fa51b08
SHA256

a057dce421f954cd0f7a88bb09a9475526290d702f62fe137a4e07bbc1385592
SHA512

85e5cc5fb95791e559af320c1909e3a1737dea9d624f8d87ef6ab8d06f19dd997a39eb144470098672f57ad6df849f242f90ab9f55a8b92c6f8f70e2a12b064d
SSDEEP

24576:rQa+rRep38knZGbO4oFya8ZbRxaiXvnEc3Suvb7sNPwEFfTPCRi4Vz:rZ+rRe3zn4ioa8ZbRMiXO07sNPwERWV

Score

10^/10

zgrat rat

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral2/memory/3828-0-0x0000000000630000-0x00000000007F0000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	A27231C997680ED04BD67255DF13A244.exe

Executes dropped EXE 1 IoCs

pid	Process
4360	smss.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\RuntimeBroker.exe	A27231C997680ED04BD67255DF13A244.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\9e8d7a4ca61bd9	A27231C997680ED04BD67255DF13A244.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Migration\WTR\System.exe	A27231C997680ED04BD67255DF13A244.exe
File created	C:\Windows\Migration\WTR\27d1bcfc3c54e0	A27231C997680ED04BD67255DF13A244.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000_Classes\Local Settings	A27231C997680ED04BD67255DF13A244.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
3828	A27231C997680ED04BD67255DF13A244.exe
2148	powershell.exe
2148	powershell.exe
4748	powershell.exe
4748	powershell.exe
3972	powershell.exe
3972	powershell.exe
4808	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3828	A27231C997680ED04BD67255DF13A244.exe
Token: SeDebugPrivilege	4808	powershell.exe
Token: SeDebugPrivilege	2148	powershell.exe
Token: SeDebugPrivilege	4748	powershell.exe
Token: SeDebugPrivilege	3972	powershell.exe
Token: SeDebugPrivilege	2768	powershell.exe
Token: SeDebugPrivilege	4360	smss.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 2768	3828	A27231C997680ED04BD67255DF13A244.exe	42
PID 3828 wrote to memory of 2768	3828	A27231C997680ED04BD67255DF13A244.exe	42
PID 3828 wrote to memory of 4808	3828	A27231C997680ED04BD67255DF13A244.exe	41
PID 3828 wrote to memory of 4808	3828	A27231C997680ED04BD67255DF13A244.exe	41
PID 3828 wrote to memory of 3972	3828	A27231C997680ED04BD67255DF13A244.exe	40
PID 3828 wrote to memory of 3972	3828	A27231C997680ED04BD67255DF13A244.exe	40
PID 3828 wrote to memory of 2148	3828	A27231C997680ED04BD67255DF13A244.exe	39
PID 3828 wrote to memory of 2148	3828	A27231C997680ED04BD67255DF13A244.exe	39
PID 3828 wrote to memory of 4748	3828	A27231C997680ED04BD67255DF13A244.exe	38
PID 3828 wrote to memory of 4748	3828	A27231C997680ED04BD67255DF13A244.exe	38
PID 3828 wrote to memory of 1696	3828	A27231C997680ED04BD67255DF13A244.exe	34
PID 3828 wrote to memory of 1696	3828	A27231C997680ED04BD67255DF13A244.exe	34
PID 1696 wrote to memory of 2596	1696	cmd.exe	31
PID 1696 wrote to memory of 2596	1696	cmd.exe	31
PID 1696 wrote to memory of 4772	1696	cmd.exe	32
PID 1696 wrote to memory of 4772	1696	cmd.exe	32
PID 1696 wrote to memory of 4360	1696	cmd.exe	109
PID 1696 wrote to memory of 4360	1696	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\A27231C997680ED04BD67255DF13A244.exe
"C:\Users\Admin\AppData\Local\Temp\A27231C997680ED04BD67255DF13A244.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Q1b3f7hVJu.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Recovery\WindowsRE\smss.exe
    "C:\Recovery\WindowsRE\smss.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\WmiPrvSE.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\smss.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Migration\WTR\System.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\RuntimeBroker.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Application Data\Registry.exe'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2768

C:\Windows\system32\chcp.com
chcp 65001
1⤵
PID:2596

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
1⤵
PID:4772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2148-42-0x00007FFF5A9E0000-0x00007FFF5B4A1000-memory.dmp

Filesize
10.8MB

Download
memory/2148-99-0x00007FFF5A9E0000-0x00007FFF5B4A1000-memory.dmp

Filesize
10.8MB

Download
memory/2148-63-0x0000023E8FF20000-0x0000023E8FF30000-memory.dmp

Filesize
64KB

Download
memory/2148-53-0x0000023E8FF20000-0x0000023E8FF30000-memory.dmp

Filesize
64KB

Download
memory/2768-106-0x00007FFF5A9E0000-0x00007FFF5B4A1000-memory.dmp

Filesize
10.8MB

Download
memory/2768-95-0x00007FFF5A9E0000-0x00007FFF5B4A1000-memory.dmp

Filesize
10.8MB

Download
memory/3828-6-0x00007FFF778C0000-0x00007FFF778C1000-memory.dmp

Filesize
4KB

Download
memory/3828-37-0x00007FFF778D0000-0x00007FFF7798E000-memory.dmp

Filesize
760KB

Download
memory/3828-18-0x0000000002A30000-0x0000000002A3C000-memory.dmp

Filesize
48KB

Download
memory/3828-20-0x00007FFF77890000-0x00007FFF77891000-memory.dmp

Filesize
4KB

Download
memory/3828-0-0x0000000000630000-0x00000000007F0000-memory.dmp

Filesize
1.8MB

Download
memory/3828-8-0x00000000028B0000-0x00000000028BE000-memory.dmp

Filesize
56KB

Download
memory/3828-41-0x00007FFF5A9E0000-0x00007FFF5B4A1000-memory.dmp

Filesize
10.8MB

Download
memory/3828-9-0x000000001B4A0000-0x000000001B4B0000-memory.dmp

Filesize
64KB

Download
memory/3828-5-0x00007FFF778D0000-0x00007FFF7798E000-memory.dmp

Filesize
760KB

Download
memory/3828-4-0x000000001B4A0000-0x000000001B4B0000-memory.dmp

Filesize
64KB

Download
memory/3828-10-0x00007FFF778D0000-0x00007FFF7798E000-memory.dmp

Filesize
760KB

Download
memory/3828-1-0x00007FFF5A9E0000-0x00007FFF5B4A1000-memory.dmp

Filesize
10.8MB

Download
memory/3828-11-0x00007FFF778B0000-0x00007FFF778B1000-memory.dmp

Filesize
4KB

Download
memory/3828-13-0x0000000002900000-0x000000000290E000-memory.dmp

Filesize
56KB

Download
memory/3828-14-0x00007FFF778A0000-0x00007FFF778A1000-memory.dmp

Filesize
4KB

Download
memory/3828-19-0x00007FFF5A9E0000-0x00007FFF5B4A1000-memory.dmp

Filesize
10.8MB

Download
memory/3828-3-0x000000001B4A0000-0x000000001B4B0000-memory.dmp

Filesize
64KB

Download
memory/3828-16-0x0000000002910000-0x000000000291C000-memory.dmp

Filesize
48KB

Download
memory/3828-2-0x0000000002830000-0x0000000002831000-memory.dmp

Filesize
4KB

Download
memory/3972-91-0x00007FFF5A9E0000-0x00007FFF5B4A1000-memory.dmp

Filesize
10.8MB

Download
memory/3972-110-0x00007FFF5A9E0000-0x00007FFF5B4A1000-memory.dmp

Filesize
10.8MB

Download
memory/3972-93-0x00000245F6CF0000-0x00000245F6D00000-memory.dmp

Filesize
64KB

Download
memory/3972-92-0x00000245F6CF0000-0x00000245F6D00000-memory.dmp

Filesize
64KB

Download
memory/4360-126-0x000000001BAC0000-0x000000001BAC8000-memory.dmp

Filesize
32KB

Download
memory/4360-117-0x00007FFF778D0000-0x00007FFF7798E000-memory.dmp

Filesize
760KB

Download
memory/4360-118-0x00007FFF778C0000-0x00007FFF778C1000-memory.dmp

Filesize
4KB

Download
memory/4360-125-0x00007FFF77890000-0x00007FFF77891000-memory.dmp

Filesize
4KB

Download
memory/4360-127-0x00007FFF59AE0000-0x00007FFF5A5A1000-memory.dmp

Filesize
10.8MB

Download
memory/4360-123-0x00007FFF778A0000-0x00007FFF778A1000-memory.dmp

Filesize
4KB

Download
memory/4360-128-0x00007FFF778D0000-0x00007FFF7798E000-memory.dmp

Filesize
760KB

Download
memory/4360-121-0x00007FFF778B0000-0x00007FFF778B1000-memory.dmp

Filesize
4KB

Download
memory/4360-114-0x00007FFF59AE0000-0x00007FFF5A5A1000-memory.dmp

Filesize
10.8MB

Download
memory/4360-115-0x000000001BA90000-0x000000001BA91000-memory.dmp

Filesize
4KB

Download
memory/4360-119-0x00007FFF778D0000-0x00007FFF7798E000-memory.dmp

Filesize
760KB

Download
memory/4748-40-0x0000016C841C0000-0x0000016C841D0000-memory.dmp

Filesize
64KB

Download
memory/4748-105-0x00007FFF5A9E0000-0x00007FFF5B4A1000-memory.dmp

Filesize
10.8MB

Download
memory/4748-96-0x00007FFF5A9E0000-0x00007FFF5B4A1000-memory.dmp

Filesize
10.8MB

Download
memory/4808-39-0x000001B639260000-0x000001B639270000-memory.dmp

Filesize
64KB

Download
memory/4808-48-0x000001B639370000-0x000001B639392000-memory.dmp

Filesize
136KB

Download
memory/4808-36-0x00007FFF5A9E0000-0x00007FFF5B4A1000-memory.dmp

Filesize
10.8MB

Download
memory/4808-38-0x000001B639260000-0x000001B639270000-memory.dmp

Filesize
64KB

Download
memory/4808-109-0x00007FFF5A9E0000-0x00007FFF5B4A1000-memory.dmp

Filesize
10.8MB

Download