zgrat | 0537c1263ee662b719101b91b8f8ce37fa4e55caea8e8f6acc00e314d32a13f0

Analysis

max time kernel
148s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
15/01/2024, 14:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2fb25c136261c4785b6cc4ca93dadab2.exe
Size 1.7MB
Sample240115-sa1fkshhen
SHA256 0537c1263ee662b719101b91b8f8ce37fa4e55caea8e8f6acc00e314d32a13f0
MD5 2fb25c136261c4785b6cc4ca93dadab2
SHA1 054212279cecc5898723c53a3e11cd87bfbefb43
SHA512 e8f475ea422a7572ac5836973cd207a3e5720d2eee79c3238e4f38f7215a1bb2c14cf7abdb443e27fa223a3a517a936a8805d93e11742f93543622e381c8ed41
SSDEEP 24576:zTbBv5rUyz9+tuIs6dkiwncg1DkESA43PJoGHrvQbd5EtsFwN9/CXOk994cYA6:tBL9+zdFwcgF5WuGHrYwrOVYA6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

zgrat rat

Malware Config

Signatures

Detect ZGRat V1 7 IoCs

resource	yara_rule
behavioral1/files/0x0009000000012287-10.dat	family_zgrat_v1
behavioral1/files/0x0009000000012287-9.dat	family_zgrat_v1
behavioral1/files/0x0009000000012287-12.dat	family_zgrat_v1
behavioral1/files/0x0009000000012287-11.dat	family_zgrat_v1
behavioral1/memory/2688-13-0x00000000013E0000-0x0000000001578000-memory.dmp	family_zgrat_v1
behavioral1/files/0x0006000000015dc1-22.dat	family_zgrat_v1
behavioral1/memory/2792-36-0x0000000000B60000-0x0000000000CF8000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Executes dropped EXE 2 IoCs

pid	Process
2688	fontInto.exe
2792	audiodg.exe

Loads dropped DLL 2 IoCs

pid	Process
2860	cmd.exe
2860	cmd.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\wininit.exe	fontInto.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\56085415360792	fontInto.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\debug\WIA\wininit.exe	fontInto.exe
File created	C:\Windows\debug\WIA\56085415360792	fontInto.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1192	PING.EXE

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
2688	fontInto.exe
2688	fontInto.exe
2688	fontInto.exe
2688	fontInto.exe
2688	fontInto.exe
2688	fontInto.exe
2688	fontInto.exe
2688	fontInto.exe
2688	fontInto.exe
2688	fontInto.exe
2688	fontInto.exe
2688	fontInto.exe
2688	fontInto.exe
2688	fontInto.exe
2688	fontInto.exe
2688	fontInto.exe
2688	fontInto.exe
2688	fontInto.exe
2688	fontInto.exe
2688	fontInto.exe
2688	fontInto.exe
2688	fontInto.exe
2688	fontInto.exe
2688	fontInto.exe
2792	audiodg.exe
2792	audiodg.exe
2792	audiodg.exe
2792	audiodg.exe
2792	audiodg.exe
2792	audiodg.exe
2792	audiodg.exe
2792	audiodg.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2792	audiodg.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2688	fontInto.exe
Token: SeDebugPrivilege	2792	audiodg.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 2324	3060	2fb25c136261c4785b6cc4ca93dadab2.exe	28
PID 3060 wrote to memory of 2324	3060	2fb25c136261c4785b6cc4ca93dadab2.exe	28
PID 3060 wrote to memory of 2324	3060	2fb25c136261c4785b6cc4ca93dadab2.exe	28
PID 3060 wrote to memory of 2324	3060	2fb25c136261c4785b6cc4ca93dadab2.exe	28
PID 2324 wrote to memory of 2860	2324	WScript.exe	29
PID 2324 wrote to memory of 2860	2324	WScript.exe	29
PID 2324 wrote to memory of 2860	2324	WScript.exe	29
PID 2324 wrote to memory of 2860	2324	WScript.exe	29
PID 2860 wrote to memory of 2688	2860	cmd.exe	31
PID 2860 wrote to memory of 2688	2860	cmd.exe	31
PID 2860 wrote to memory of 2688	2860	cmd.exe	31
PID 2860 wrote to memory of 2688	2860	cmd.exe	31
PID 2688 wrote to memory of 2612	2688	fontInto.exe	32
PID 2688 wrote to memory of 2612	2688	fontInto.exe	32
PID 2688 wrote to memory of 2612	2688	fontInto.exe	32
PID 2612 wrote to memory of 2604	2612	cmd.exe	34
PID 2612 wrote to memory of 2604	2612	cmd.exe	34
PID 2612 wrote to memory of 2604	2612	cmd.exe	34
PID 2612 wrote to memory of 1192	2612	cmd.exe	35
PID 2612 wrote to memory of 1192	2612	cmd.exe	35
PID 2612 wrote to memory of 1192	2612	cmd.exe	35
PID 2612 wrote to memory of 2792	2612	cmd.exe	36
PID 2612 wrote to memory of 2792	2612	cmd.exe	36
PID 2612 wrote to memory of 2792	2612	cmd.exe	36

C:\Users\Admin\AppData\Local\Temp\2fb25c136261c4785b6cc4ca93dadab2.exe
"C:\Users\Admin\AppData\Local\Temp\2fb25c136261c4785b6cc4ca93dadab2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\msref\NUTNlGpLhnDxeCWNDhJHypDdylMlB70N2cOgrpUIYdGzMbk.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\msref\ggUB6TD6zOjnAo7alYVvlHtEGb7Rzo4gMUTladFqFUSDV3OPMqyrodaqH2n.bat" "
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2860
  - - C:\msref\fontInto.exe
      "C:\msref/fontInto.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2688
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IMVGpf014F.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2612
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:2604
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        Runs ping.exe
        
        PID:1192
      - C:\msref\audiodg.exe
        
        "C:\msref\audiodg.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dwm.exe

Path C:\Recovery\9064cc02-9ba8-11ee-8a7b-e6b52eba4e86\dwm.exe
Size 1.6MB
SHA256 5c2b19bc1cdb46e6e719ae1c591c02390aaed8ef5fc2b22cca04d25def0893f3
MD5 df1673a0438804dc080778c42b5eccb7
SHA1 3fc47d58c61da459823593cf514cf68c628161ed
SHA512 8ba9cebf6451da8c1f1e283fb09fb7d698910e7713603688c189cc99b2ff2fe451fba00d1296075512895805a314b42d6ea4bf64e04287da9cb4d4f3a3a5f3a4
SSDEEP 24576:uVJ30NMHp7P2/LWDB8tq0Ot3Ugnubn5M8v0RRe1HGC+h+A9Y86uHfJLJ:uTDVjDB8w6gn+5M8x1HGCfAy6/J
MD5 SHA1 SHA512 SSDEEP

Submit Download

IMVGpf014F.bat

Path C:\Users\Admin\AppData\Local\Temp\IMVGpf014F.bat
Size 148B
SHA256 ef686cbcff377860b82d8ba79c003ba3d3d6bec7cc594c0dabb70a8d522f40b0
MD5 0feb968e63f74df776ed892f0a95af6a
SHA1 33fbbcf8092269d42cce128c2bee3dcacd515625
SHA512 36926c1367aede015fa427fb828d5d5d9b4c7e8a4bfea1f04922b3a57bf0e7b4c55969452d5465c4ce47baf9dbc4f2b8c7ce635eed9b72e4b9e205e4d102b853
MD5 SHA1 SHA512

Submit Download

NUTNlGpLhnDxeCWNDhJHypDdylMlB70N2cOgrpUIYdGzMbk.vbe

Path C:\msref\NUTNlGpLhnDxeCWNDhJHypDdylMlB70N2cOgrpUIYdGzMbk.vbe
Size 243B
SHA256 b20077756ed88f0e7f1e08f122a8e0e4554caaa9a35e036c0543df270988eaf4
MD5 76430c7ee19050b8a66fe88a4049bb0a
SHA1 4991d247bf745c66633714cac56528708dafb352
SHA512 faa07826428e2d17b518e00f02a9442e50f6e64fba1a76f6f188402fcf29b1e4d62918ea757512ae3dc6a1f7ccc05a8456bb14b89f04f4ae532d39fdabf1c589
MD5 SHA1 SHA512

Submit Download

fontInto.exe

Path C:\msref\fontInto.exe
Size 192KB
SHA256 10ec943de3ce23df6f0382c6484065617584f91473d8da822f3cd495d87bcae5
MD5 a6964cb80d6be8dfd60616098af4a3e3
SHA1 7b42fd76cb213d403713fa19b12df866a0da5cbd
SHA512 fa6263e0665f5907a17f82bac34bbccd6749e267ca74e24fa8e73cf5690efdac899f46a98c9cb9bbaf6ef92c2702135b30087db10027043b3c8902c92ca5f359
SSDEEP 1536:3CkVzoIF157k1MIcoXr8eZUDUpRyE0V3n5kjR1x7hkZj/xwnVWs3aEuOPJzFS/dg:ycSvpP0RoOjGHbL
MD5 SHA1 SHA512 SSDEEP

Submit Download

fontInto.exe

Path C:\msref\fontInto.exe
Size 449KB
SHA256 4e12507e70928028ae5acf0243bf7519dd67c53ff8600c3ce77b9bfde73c2aca
MD5 0ae39fbb412ab7c4bd1e9ab16c6e6507
SHA1 07ee61d5b9900e921a19017dcc8359d73b50f3e7
SHA512 85156c25d8b3ac6c0c692567aa2065d4861407f113f7a1649ddb5f37ca63ae82afaaf794b7ecdeb5c0ba6b5ded2d74101f78c4d87717e8229b145d98e4f3b65a
SSDEEP 6144:4pPki75Js6dJBQTqdqBrHkMqOkf01HglMGM6EJzWZ:uVJs60WSjNqVWsZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

ggUB6TD6zOjnAo7alYVvlHtEGb7Rzo4gMUTladFqFUSDV3OPMqyrodaqH2n.bat

Path C:\msref\ggUB6TD6zOjnAo7alYVvlHtEGb7Rzo4gMUTladFqFUSDV3OPMqyrodaqH2n.bat
Size 74B
SHA256 24435463fd0d7f718214d97c641280e44c7e642cc580e09b15f3273ffa2a7921
MD5 ff9b3f3a20397ac3994e84da2e9332ec
SHA1 509d870d06dc2e3b2dfd8d2d8043a3eafdd9f5cd
SHA512 2100861479bda42514e500af0f227689e546d2209378af8f80e6c82cf3b2d55d0ea559969fb906d5999f80544c318d7831cc720816f9d6cef532506a938233dc
MD5 SHA1 SHA512

Submit Download

fontInto.exe

Path \msref\fontInto.exe
Size 677KB
SHA256 b05d3b1747050cc061516b9f0f644af20fbbb219ebdee2a4ca5e71ec1a082b65
MD5 8e77762a4c4aa7d0efb22997e872a78a
SHA1 535a447ae10fa31d6c9dc1583f3af7ad3882504d
SHA512 bc12bd8096765e86c8229a8f4d8e836a929701f9aa142465b39d2d813b7841d634001cc257d230e4b01f276bdb70f219bb8022f0286d0ed956c7aad216f68b84
SSDEEP 6144:4pPki75Js6dJBQTqdqBrHkMqOkf01HglMGM6EJzWOukQYWr7SWh9huAdMZa/blHW:uVJs60WSjNqVWsOJQp7PfuAucUgs
MD5 SHA1 SHA512 SSDEEP

Submit Download

fontInto.exe

Path \msref\fontInto.exe
Size 448KB
SHA256 1e9caa7d0ac151f29423f04cc305390a508fad7277d06e3e4ddd737ac6833329
MD5 925db5a5f64bd06dc30bc378616c3d2a
SHA1 c064117c5c7b5bac1e4b628e40e817232d4e6060
SHA512 a87049e2e14cbf6d33e16e0b81bf772ed79e9939f79a2fd5c10f1a797de6b1b8eeaeb14e6a84892906c2b849a3f4ba7e4b9fee866cfc774ce077fb011730c8d8
SSDEEP 6144:4pPki75Js6dJBQTqdqBrHkMqOkf01HglMGM6EJzWu:uVJs60WSjNqVWsu
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2688-14-0x000007FEF57A0000-0x000007FEF618C000-memory.dmp

Download

memory/2688-15-0x000000001B5A0000-0x000000001B620000-memory.dmp

Download

memory/2688-16-0x0000000000140000-0x0000000000141000-memory.dmp

Download

memory/2688-13-0x00000000013E0000-0x0000000001578000-memory.dmp

Download

memory/2688-33-0x000007FEF57A0000-0x000007FEF618C000-memory.dmp

Download

memory/2792-38-0x000000001AEA0000-0x000000001AF20000-memory.dmp

Download

memory/2792-36-0x0000000000B60000-0x0000000000CF8000-memory.dmp

Download

memory/2792-37-0x000007FEF4DB0000-0x000007FEF579C000-memory.dmp

Download

memory/2792-39-0x0000000000230000-0x0000000000231000-memory.dmp

Download

memory/2792-40-0x000000001AEA0000-0x000000001AF20000-memory.dmp

Download

memory/2792-41-0x000000001AEA0000-0x000000001AF20000-memory.dmp

Download

memory/2792-42-0x000007FEF4DB0000-0x000007FEF579C000-memory.dmp

Download

memory/2792-43-0x000000001AEA0000-0x000000001AF20000-memory.dmp

Download

memory/2792-44-0x000000001AEA0000-0x000000001AF20000-memory.dmp

Download

memory/2792-45-0x000000001AEA0000-0x000000001AF20000-memory.dmp

Download