zgrat | 0537c1263ee662b719101b91b8f8ce37fa4e55caea8e8f6acc00e314d32a13f0

Analysis

max time kernel
138s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
15/01/2024, 14:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2fb25c136261c4785b6cc4ca93dadab2.exe
Size 1.7MB
Sample240115-sa1fkshhen
SHA256 0537c1263ee662b719101b91b8f8ce37fa4e55caea8e8f6acc00e314d32a13f0
MD5 2fb25c136261c4785b6cc4ca93dadab2
SHA1 054212279cecc5898723c53a3e11cd87bfbefb43
SHA512 e8f475ea422a7572ac5836973cd207a3e5720d2eee79c3238e4f38f7215a1bb2c14cf7abdb443e27fa223a3a517a936a8805d93e11742f93543622e381c8ed41
SSDEEP 24576:zTbBv5rUyz9+tuIs6dkiwncg1DkESA43PJoGHrvQbd5EtsFwN9/CXOk994cYA6:tBL9+zdFwcgF5WuGHrYwrOVYA6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

zgrat rat

Malware Config

Signatures

Detect ZGRat V1 6 IoCs

resource	yara_rule
behavioral2/files/0x000800000002322f-10.dat	family_zgrat_v1
behavioral2/files/0x000800000002322f-11.dat	family_zgrat_v1
behavioral2/memory/4940-12-0x0000000000C90000-0x0000000000E28000-memory.dmp	family_zgrat_v1
behavioral2/files/0x0006000000023259-19.dat	family_zgrat_v1
behavioral2/files/0x000600000002325d-36.dat	family_zgrat_v1
behavioral2/files/0x000600000002325d-35.dat	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	2fb25c136261c4785b6cc4ca93dadab2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	fontInto.exe

Executes dropped EXE 2 IoCs

pid	Process
4940	fontInto.exe
4816	backgroundTaskHost.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\backgroundTaskHost.exe	fontInto.exe
File created	C:\Program Files\7-Zip\Lang\eddb19405b7ce1	fontInto.exe
File created	C:\Program Files\Windows Media Player\Media Renderer\upfc.exe	fontInto.exe
File opened for modification	C:\Program Files\Windows Media Player\Media Renderer\upfc.exe	fontInto.exe
File created	C:\Program Files\Windows Media Player\Media Renderer\ea1d8f6d871115	fontInto.exe
File created	C:\Program Files\WindowsPowerShell\dwm.exe	fontInto.exe
File created	C:\Program Files\WindowsPowerShell\6cb0b6c459d5d3	fontInto.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Performance\WinSAT\DataStore\sppsvc.exe	fontInto.exe
File created	C:\Windows\Performance\WinSAT\DataStore\0a1fd5f707cd16	fontInto.exe
File created	C:\Windows\IdentityCRL\INT\Idle.exe	fontInto.exe
File created	C:\Windows\IdentityCRL\INT\6ccacd8608530f	fontInto.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings	2fb25c136261c4785b6cc4ca93dadab2.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings	fontInto.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1988	PING.EXE

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
4940	fontInto.exe
4940	fontInto.exe
4940	fontInto.exe
4940	fontInto.exe
4940	fontInto.exe
4940	fontInto.exe
4940	fontInto.exe
4940	fontInto.exe
4940	fontInto.exe
4940	fontInto.exe
4940	fontInto.exe
4940	fontInto.exe
4940	fontInto.exe
4940	fontInto.exe
4940	fontInto.exe
4940	fontInto.exe
4940	fontInto.exe
4940	fontInto.exe
4940	fontInto.exe
4940	fontInto.exe
4816	backgroundTaskHost.exe
4816	backgroundTaskHost.exe
4816	backgroundTaskHost.exe
4816	backgroundTaskHost.exe
4816	backgroundTaskHost.exe
4816	backgroundTaskHost.exe
4816	backgroundTaskHost.exe
4816	backgroundTaskHost.exe
4816	backgroundTaskHost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4940	fontInto.exe
Token: SeDebugPrivilege	4816	backgroundTaskHost.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 5072	4660	2fb25c136261c4785b6cc4ca93dadab2.exe	88
PID 4660 wrote to memory of 5072	4660	2fb25c136261c4785b6cc4ca93dadab2.exe	88
PID 4660 wrote to memory of 5072	4660	2fb25c136261c4785b6cc4ca93dadab2.exe	88
PID 5072 wrote to memory of 4520	5072	WScript.exe	100
PID 5072 wrote to memory of 4520	5072	WScript.exe	100
PID 5072 wrote to memory of 4520	5072	WScript.exe	100
PID 4520 wrote to memory of 4940	4520	cmd.exe	102
PID 4520 wrote to memory of 4940	4520	cmd.exe	102
PID 4940 wrote to memory of 5016	4940	fontInto.exe	104
PID 4940 wrote to memory of 5016	4940	fontInto.exe	104
PID 5016 wrote to memory of 4536	5016	cmd.exe	105
PID 5016 wrote to memory of 4536	5016	cmd.exe	105
PID 5016 wrote to memory of 1988	5016	cmd.exe	106
PID 5016 wrote to memory of 1988	5016	cmd.exe	106
PID 5016 wrote to memory of 4816	5016	cmd.exe	107
PID 5016 wrote to memory of 4816	5016	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2fb25c136261c4785b6cc4ca93dadab2.exe
"C:\Users\Admin\AppData\Local\Temp\2fb25c136261c4785b6cc4ca93dadab2.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\msref\NUTNlGpLhnDxeCWNDhJHypDdylMlB70N2cOgrpUIYdGzMbk.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:5072
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\msref\ggUB6TD6zOjnAo7alYVvlHtEGb7Rzo4gMUTladFqFUSDV3OPMqyrodaqH2n.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4520
  - - C:\msref\fontInto.exe
      "C:\msref/fontInto.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4940
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JQqFHKKy6v.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5016
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:4536
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        Runs ping.exe
        
        PID:1988
      - C:\Program Files\7-Zip\Lang\backgroundTaskHost.exe
        
        "C:\Program Files\7-Zip\Lang\backgroundTaskHost.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

backgroundTaskHost.exe

Path C:\Program Files\7-Zip\Lang\backgroundTaskHost.exe
Size 1.2MB
SHA256 54c47161688b849c2ee5478c9bf3bf59bf4e8cae3c499cb84a995d41953f5adf
MD5 ba803450db426f47ff501901518c32d8
SHA1 24184cdd5b672e8c64319215eca26056b87c19a4
SHA512 8840adbe1307c5119e0549ba4cc9694f958020a4c5c558795463cabf1e016b9cdb1bb904681b4a5cc66ab71b274785d2b801b2f312bb9f24e3581ddb3b5ab5cf
SSDEEP 24576:uVJ30NMHp7P2/LWDB8tq0Ot3Ugnubn5M8v0k:uTDVjDB8w6gn+5M8b
MD5 SHA1 SHA512 SSDEEP

Submit Download

backgroundTaskHost.exe

Path C:\Program Files\7-Zip\Lang\backgroundTaskHost.exe
Size 1023KB
SHA256 6c5436a9771b223ddd9f1620df270db768687b5b31e0bb9dbc664ff09bc62941
MD5 cfd75c2ddd7acf915b43714bff7f29e5
SHA1 09990ef69f4afffbc474575be9fae0fb9d946125
SHA512 4c0a6882493f0cb51615511767f3ef1b73737d8d5a7d647d2c57110bffbecfd5232dab3b6df382c741b8f4190ce9087378d983890bfb41a9dd8bd9b4bb7cd34e
SSDEEP 12288:uVJs60WSjNqVWsOJQp7PfuAucUgFf59B8oYq0d4pBl3xi1eAMXsW4jqVuJgHZ:uVJ30NMHp7P2/LWDB8tq0Ot3Ugnn
MD5 SHA1 SHA512 SSDEEP

Submit Download

JQqFHKKy6v.bat

Path C:\Users\Admin\AppData\Local\Temp\JQqFHKKy6v.bat
Size 178B
SHA256 23034f8cfc030f86690c37cc52728158b57bf062e272ff4d1e18248cec09ddc8
MD5 da61b309c7acac6c93660d6dfa8d06ae
SHA1 ddf2ee63fa4dedf1f9574f096e6aeb59e3470181
SHA512 9165b9b32e8e8696edc64cbeff2a55ae275167663df35ac0e6e4e17355d4bab279701857bbb349df7ec805966c7cda96cf503006b4722d459c8de6b501e300f1
MD5 SHA1 SHA512

Submit Download

sppsvc.exe

Path C:\Windows\Performance\WinSAT\DataStore\sppsvc.exe
Size 463KB
SHA256 ca8fb58a623b4643313b7128555077fad879bd12cbe9e5515d1844f60054da1e
MD5 7e485b2b81b1a9fe5ab248350e7f451f
SHA1 63b16edff48ce76764f5553a0dba049bcfdafea7
SHA512 4dd8cb757b45aea0802d293a52e1d0b66a502b58f45312f39e3a59f3f7d7aa85ad6466e7e6ecebb763b8721dbca5a7e35544e22a7bb6143fe3064e75f4ba7365
SSDEEP 6144:4pPki75Js6dJBQTqdqBrHkMqOkf01HglMGM6EJzWOA:uVJs60WSjNqVWsOA
MD5 SHA1 SHA512 SSDEEP

Submit Download

NUTNlGpLhnDxeCWNDhJHypDdylMlB70N2cOgrpUIYdGzMbk.vbe

Path C:\msref\NUTNlGpLhnDxeCWNDhJHypDdylMlB70N2cOgrpUIYdGzMbk.vbe
Size 243B
SHA256 b20077756ed88f0e7f1e08f122a8e0e4554caaa9a35e036c0543df270988eaf4
MD5 76430c7ee19050b8a66fe88a4049bb0a
SHA1 4991d247bf745c66633714cac56528708dafb352
SHA512 faa07826428e2d17b518e00f02a9442e50f6e64fba1a76f6f188402fcf29b1e4d62918ea757512ae3dc6a1f7ccc05a8456bb14b89f04f4ae532d39fdabf1c589
MD5 SHA1 SHA512

Submit Download

fontInto.exe

Path C:\msref\fontInto.exe
Size 1.0MB
SHA256 b1df77fd82c615eff21efa2afa0df7681723751c04f40c07625911d71ac0b480
MD5 8ebf6d6c7eb437dadabcc7e043bfc154
SHA1 edf732c151c7e9da94ab8335555a44d03c4452e0
SHA512 51834a18dee81bb39563cd89d1b6e88799d743f9304856f4b281672ad492775f054b9694f0e9dc3de54ff7b0bc09fc4032370a5117a0defd21e8c5ea9e664af1
SSDEEP 12288:uVJs60WSjNqVWsOJQp7PfuAucUgFf59B8oYq0d4pBl3xi1eAMXsW4jqVuJgH8aNR:uVJ30NMHp7P2/LWDB8tq0Ot3Ugnubno
MD5 SHA1 SHA512 SSDEEP

Submit Download

fontInto.exe

Path C:\msref\fontInto.exe
Size 1.3MB
SHA256 b3f995bd09f5328e4912929a21f39736ca8be56ce5059e2e2aafe559eb250619
MD5 79c0693899c617bf986025f928e7486b
SHA1 920db160187c31b1069fa9b82d94ceb0b38daf57
SHA512 0d3d7d3dc633b7cb23e65bade37ac38fe66a2c2de38bd28aaf3617aba9a347f56f9b92073f8639c627e1d9961627d52f7cfdf2f6bfd85e488e4f84b8ca3388bd
SSDEEP 24576:uVJ30NMHp7P2/LWDB8tq0Ot3Ugnubn5M8v0RRe1HGCk:uTDVjDB8w6gn+5M8x1HGCk
MD5 SHA1 SHA512 SSDEEP

Submit Download

ggUB6TD6zOjnAo7alYVvlHtEGb7Rzo4gMUTladFqFUSDV3OPMqyrodaqH2n.bat

Path C:\msref\ggUB6TD6zOjnAo7alYVvlHtEGb7Rzo4gMUTladFqFUSDV3OPMqyrodaqH2n.bat
Size 74B
SHA256 24435463fd0d7f718214d97c641280e44c7e642cc580e09b15f3273ffa2a7921
MD5 ff9b3f3a20397ac3994e84da2e9332ec
SHA1 509d870d06dc2e3b2dfd8d2d8043a3eafdd9f5cd
SHA512 2100861479bda42514e500af0f227689e546d2209378af8f80e6c82cf3b2d55d0ea559969fb906d5999f80544c318d7831cc720816f9d6cef532506a938233dc
MD5 SHA1 SHA512

Submit Download

memory/4816-38-0x000000001B8C0000-0x000000001B8D0000-memory.dmp

Download

memory/4816-37-0x00007FF817CA0000-0x00007FF818761000-memory.dmp

Download

memory/4816-39-0x0000000001730000-0x0000000001731000-memory.dmp

Download

memory/4816-40-0x000000001B8C0000-0x000000001B8D0000-memory.dmp

Download

memory/4816-41-0x00007FF817CA0000-0x00007FF818761000-memory.dmp

Download

memory/4816-42-0x000000001B8C0000-0x000000001B8D0000-memory.dmp

Download

memory/4816-43-0x000000001B8C0000-0x000000001B8D0000-memory.dmp

Download

memory/4940-33-0x00007FF817D10000-0x00007FF8187D1000-memory.dmp

Download

memory/4940-15-0x0000000003190000-0x0000000003191000-memory.dmp

Download

memory/4940-14-0x000000001BAE0000-0x000000001BAF0000-memory.dmp

Download

memory/4940-13-0x00007FF817D10000-0x00007FF8187D1000-memory.dmp

Download

memory/4940-12-0x0000000000C90000-0x0000000000E28000-memory.dmp

Download