Analysis
- max time kernel
0s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
02/01/2024, 13:52
General
- Target EGN RU1.exe
- Size 4.5MB
- Sample240102-q6dkksfdcr
- SHA256 8d4d7a9744daead89a8e5af92249aa6d709e4f91ff33c774ba6e8c8289ec2020
Malware Config
Signatures
- Detect ZGRat V1 1 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Opens file in notepad (likely ransom note) 1 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\EGN RU1.exe"C:\Users\Admin\AppData\Local\Temp\EGN RU1.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\EGN RU.exe"C:\Users\Admin\AppData\Local\Temp\EGN RU.exe"2⤵
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" C:\hwid.ini3⤵
- Opens file in notepad (likely ransom note)
-
-
-
C:\Users\Admin\AppData\Local\Temp\sustem32.exe"C:\Users\Admin\AppData\Local\Temp\sustem32.exe"2⤵
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hyperwebfont\JNbMKTHQeeisaNE5gWwcccFtQuC.vbe"1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hyperwebfont\yIgYU9c1z9H1xn6Tye0KRsv0DdNxWg4dhb8r4Zd.bat" "2⤵
-
-
C:\hyperwebfont\portWebsavesRuntimeSvc.exe"C:\hyperwebfont/portWebsavesRuntimeSvc.exe"1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ua5aRG1p5r.bat"2⤵
-
C:\Program Files\Windows Portable Devices\explorer.exe"C:\Program Files\Windows Portable Devices\explorer.exe"3⤵
-
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost1⤵
- Runs ping.exe
-
C:\Windows\system32\chcp.comchcp 650011⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
EGN RU.exe
sustem32.exe
memory/660-97-0x000000001B7D0000-0x000000001B7E0000-memory.dmp
memory/660-72-0x000000001B5C0000-0x000000001B5D0000-memory.dmp
memory/660-93-0x00007FF88A220000-0x00007FF88A221000-memory.dmp
memory/660-36-0x0000000000EA0000-0x0000000000EA1000-memory.dmp
memory/660-34-0x00007FF86BFA0000-0x00007FF86CA61000-memory.dmp
memory/660-37-0x000000001B5E0000-0x000000001B5F0000-memory.dmp
memory/660-42-0x00007FF88A330000-0x00007FF88A3EE000-memory.dmp
memory/660-41-0x000000001B550000-0x000000001B576000-memory.dmp
memory/660-39-0x00007FF88A320000-0x00007FF88A321000-memory.dmp
memory/660-47-0x0000000002950000-0x000000000296C000-memory.dmp
memory/660-53-0x0000000002930000-0x0000000002940000-memory.dmp
memory/660-60-0x0000000002940000-0x0000000002950000-memory.dmp
memory/660-63-0x00007FF88A2C0000-0x00007FF88A2C1000-memory.dmp
memory/660-66-0x000000001B590000-0x000000001B59E000-memory.dmp
memory/660-70-0x00007FF88A2A0000-0x00007FF88A2A1000-memory.dmp
memory/660-73-0x00007FF88A290000-0x00007FF88A291000-memory.dmp
memory/660-76-0x00007FF88A280000-0x00007FF88A281000-memory.dmp
memory/660-79-0x00007FF88A270000-0x00007FF88A271000-memory.dmp
memory/660-83-0x00007FF88A260000-0x00007FF88A261000-memory.dmp
memory/660-86-0x00007FF88A250000-0x00007FF88A251000-memory.dmp
memory/660-91-0x000000001B820000-0x000000001B87A000-memory.dmp
memory/660-95-0x000000001B7C0000-0x000000001B7CE000-memory.dmp
memory/660-98-0x00007FF88A210000-0x00007FF88A211000-memory.dmp
memory/660-104-0x00007FF88A1F0000-0x00007FF88A1F1000-memory.dmp
memory/660-107-0x00007FF88A1E0000-0x00007FF88A1E1000-memory.dmp
memory/660-106-0x000000001B8F0000-0x000000001B93E000-memory.dmp
memory/660-103-0x000000001B880000-0x000000001B898000-memory.dmp
memory/660-101-0x000000001B7E0000-0x000000001B7EE000-memory.dmp
memory/660-125-0x00007FF88A330000-0x00007FF88A3EE000-memory.dmp
memory/660-124-0x00007FF86BFA0000-0x00007FF86CA61000-memory.dmp
memory/660-99-0x00007FF88A200000-0x00007FF88A201000-memory.dmp
memory/660-33-0x0000000000480000-0x0000000000808000-memory.dmp
memory/660-38-0x00007FF88A330000-0x00007FF88A3EE000-memory.dmp
memory/660-89-0x000000001B770000-0x000000001B780000-memory.dmp
memory/660-35-0x000000001B5E0000-0x000000001B5F0000-memory.dmp
memory/660-87-0x00007FF88A240000-0x00007FF88A241000-memory.dmp
memory/660-85-0x000000001B760000-0x000000001B770000-memory.dmp
memory/660-82-0x000000001B5D0000-0x000000001B5DE000-memory.dmp
memory/660-80-0x000000001BCF0000-0x000000001C218000-memory.dmp
memory/660-78-0x000000001B7A0000-0x000000001B7B2000-memory.dmp
memory/660-75-0x000000001B780000-0x000000001B796000-memory.dmp
memory/660-92-0x00007FF88A230000-0x00007FF88A231000-memory.dmp
memory/660-69-0x000000001B5E0000-0x000000001B5F0000-memory.dmp
memory/660-68-0x000000001B740000-0x000000001B752000-memory.dmp
memory/660-64-0x00007FF88A2B0000-0x00007FF88A2B1000-memory.dmp
memory/660-62-0x000000001B580000-0x000000001B590000-memory.dmp
memory/660-58-0x00007FF88A2D0000-0x00007FF88A2D1000-memory.dmp
memory/660-57-0x000000001B5E0000-0x000000001B5F0000-memory.dmp
memory/660-56-0x00007FF88A2E0000-0x00007FF88A2E1000-memory.dmp
memory/660-55-0x000000001B5A0000-0x000000001B5B8000-memory.dmp
memory/660-51-0x00007FF88A2F0000-0x00007FF88A2F1000-memory.dmp
memory/660-50-0x00007FF88A300000-0x00007FF88A301000-memory.dmp
memory/660-49-0x00007FF86BFA0000-0x00007FF86CA61000-memory.dmp
memory/660-48-0x000000001B6F0000-0x000000001B740000-memory.dmp
memory/660-44-0x0000000000EF0000-0x0000000000EFE000-memory.dmp
memory/660-45-0x00007FF88A310000-0x00007FF88A311000-memory.dmp
memory/1528-14-0x0000000000400000-0x000000000088A000-memory.dmp
memory/2576-16-0x0000000000AF0000-0x0000000000DDD000-memory.dmp
memory/2576-27-0x0000000000AF0000-0x0000000000DDD000-memory.dmp
memory/4744-129-0x00007FF86BD60000-0x00007FF86C821000-memory.dmp
memory/4744-131-0x00000000010D0000-0x00000000010D1000-memory.dmp
memory/4744-130-0x000000001B6F0000-0x000000001B700000-memory.dmp
memory/4744-132-0x000000001B6F0000-0x000000001B700000-memory.dmp
memory/4744-136-0x00007FF88A330000-0x00007FF88A3EE000-memory.dmp
memory/4744-134-0x00007FF88A320000-0x00007FF88A321000-memory.dmp
memory/4744-133-0x00007FF88A330000-0x00007FF88A3EE000-memory.dmp