Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/01/2024, 16:28

General

  • Target

    68192cd81726cf9ea4a4187ec0111113.exe

  • Size

    6.5MB

  • MD5

    68192cd81726cf9ea4a4187ec0111113

  • SHA1

    46d0eb7842be68a5f625ed927fa6a91715af416b

  • SHA256

    fec4a46308f73f3e49401fa24256a58fdd596f57eee6f29d3336c2b072abda6d

  • SHA512

    bb176584a61b334673e457a1b5c598149ead38785e827d4b2f0348c8f4138a60dceeb9e4a7f7724a50fd32a3440e49e80d97575d091cfb9c991bf8bca576e156

  • SSDEEP

    196608:LoWCHVU8Bi7PPbLAi80f/TiCjPTpPF2bzH0D1:Mz2Pgipr8bQp

Score
10/10

Malware Config

Signatures

  • Detect ZGRat V1 35 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\68192cd81726cf9ea4a4187ec0111113.exe
    "C:\Users\Admin\AppData\Local\Temp\68192cd81726cf9ea4a4187ec0111113.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4616
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Tahnlcisc.vbs"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:2992
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Adobe\Photoshop.exe'
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4932
    • C:\Users\Admin\AppData\Local\Temp\68192cd81726cf9ea4a4187ec0111113.exe
      C:\Users\Admin\AppData\Local\Temp\68192cd81726cf9ea4a4187ec0111113.exe
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:3624
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com -Count 2 -BufferSize 128 -Delay 1
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4064
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com -Count 2 -BufferSize 128 -Delay 1
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2608
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com -Count 2 -BufferSize 128 -Delay 1
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:5748
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com -Count 2 -BufferSize 128 -Delay 1
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:5380

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\68192cd81726cf9ea4a4187ec0111113.exe.log

    Filesize

    1KB

    MD5

    baf55b95da4a601229647f25dad12878

    SHA1

    abc16954ebfd213733c4493fc1910164d825cac8

    SHA256

    ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

    SHA512

    24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    d85ba6ff808d9e5444a4b369f5bc2730

    SHA1

    31aa9d96590fff6981b315e0b391b575e4c0804a

    SHA256

    84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

    SHA512

    8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    77d622bb1a5b250869a3238b9bc1402b

    SHA1

    d47f4003c2554b9dfc4c16f22460b331886b191b

    SHA256

    f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

    SHA512

    d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    001b5ca3131838b946bf3b18f9a37fc6

    SHA1

    2cdc06a3072cbd8b16d1e2419badef6e2ee9ef13

    SHA256

    3288a17c0827bcd300cd704130ff72c56d31a23d1759eeebe2f1139425fe747a

    SHA512

    8985764d7a99d7fe87ca34623debe5772c25df0cb3b19be0a484864dddd816d940e90f15d35bcaa79abe23bc6bf88f23ed3fadd816091a9f0f4389dc56c885af

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    d096831023867930e62e6d8b3d4d8ca6

    SHA1

    404a1e73dc1590f1c8b9327c396591567dac7365

    SHA256

    167f75b42ae614a8d6b0497779ff12f09605328533487f235b029e0db03ad23b

    SHA512

    31333100ddd8e04bf730118ea800843720c0f3fb69e27b89dda7fa4d717d25e838ad55a0919d47a44dd8a78d724ef8c105cfa230987cc46ba94a2b790ff91b75

  • C:\Users\Admin\AppData\Local\Temp\_Tahnlcisc.vbs

    Filesize

    183B

    MD5

    596240d6e4b9636d4ff251f7d88d2fbc

    SHA1

    33a51f0eaed1b0ab24463d88a32a44bb343eea92

    SHA256

    ac3eca9ee79b5494e2099ac1f7a6e6d018352c615a871aa1ff43d0ace2c1dad9

    SHA512

    87a8313d20cbc9b5cff506d260c718fec9586f4f9d4ed421058cb3d386fe6e28b52fc106717d1afc0306bf4f2d2ee763fe461121f62d70213b30b08016610ce6

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dp2wlabv.cyh.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/2608-2148-0x00007FFD02390000-0x00007FFD02E51000-memory.dmp

    Filesize

    10.8MB

  • memory/2608-2149-0x0000027D44650000-0x0000027D44660000-memory.dmp

    Filesize

    64KB

  • memory/2608-2151-0x00007FFD02390000-0x00007FFD02E51000-memory.dmp

    Filesize

    10.8MB

  • memory/3624-2152-0x00007FFD02390000-0x00007FFD02E51000-memory.dmp

    Filesize

    10.8MB

  • memory/3624-2183-0x000000001C3C0000-0x000000001C3D0000-memory.dmp

    Filesize

    64KB

  • memory/3624-2184-0x000000001E350000-0x000000001E990000-memory.dmp

    Filesize

    6.2MB

  • memory/3624-2106-0x0000000140000000-0x000000014062A000-memory.dmp

    Filesize

    6.2MB

  • memory/3624-2105-0x00007FFD02390000-0x00007FFD02E51000-memory.dmp

    Filesize

    10.8MB

  • memory/3624-2825-0x000000001C3C0000-0x000000001C3D0000-memory.dmp

    Filesize

    64KB

  • memory/4064-2137-0x00007FFD02390000-0x00007FFD02E51000-memory.dmp

    Filesize

    10.8MB

  • memory/4064-2134-0x00007FFD02390000-0x00007FFD02E51000-memory.dmp

    Filesize

    10.8MB

  • memory/4064-2135-0x000001F1B0900000-0x000001F1B0910000-memory.dmp

    Filesize

    64KB

  • memory/4616-55-0x000000001DE20000-0x000000001DE8C000-memory.dmp

    Filesize

    432KB

  • memory/4616-5-0x000000001DE20000-0x000000001DE92000-memory.dmp

    Filesize

    456KB

  • memory/4616-49-0x000000001DE20000-0x000000001DE8C000-memory.dmp

    Filesize

    432KB

  • memory/4616-47-0x000000001DE20000-0x000000001DE8C000-memory.dmp

    Filesize

    432KB

  • memory/4616-45-0x000000001DE20000-0x000000001DE8C000-memory.dmp

    Filesize

    432KB

  • memory/4616-39-0x000000001DE20000-0x000000001DE8C000-memory.dmp

    Filesize

    432KB

  • memory/4616-37-0x000000001DE20000-0x000000001DE8C000-memory.dmp

    Filesize

    432KB

  • memory/4616-35-0x000000001DE20000-0x000000001DE8C000-memory.dmp

    Filesize

    432KB

  • memory/4616-31-0x000000001DE20000-0x000000001DE8C000-memory.dmp

    Filesize

    432KB

  • memory/4616-29-0x000000001DE20000-0x000000001DE8C000-memory.dmp

    Filesize

    432KB

  • memory/4616-27-0x000000001DE20000-0x000000001DE8C000-memory.dmp

    Filesize

    432KB

  • memory/4616-25-0x000000001DE20000-0x000000001DE8C000-memory.dmp

    Filesize

    432KB

  • memory/4616-23-0x000000001DE20000-0x000000001DE8C000-memory.dmp

    Filesize

    432KB

  • memory/4616-21-0x000000001DE20000-0x000000001DE8C000-memory.dmp

    Filesize

    432KB

  • memory/4616-19-0x000000001DE20000-0x000000001DE8C000-memory.dmp

    Filesize

    432KB

  • memory/4616-15-0x000000001DE20000-0x000000001DE8C000-memory.dmp

    Filesize

    432KB

  • memory/4616-13-0x000000001DE20000-0x000000001DE8C000-memory.dmp

    Filesize

    432KB

  • memory/4616-11-0x000000001DE20000-0x000000001DE8C000-memory.dmp

    Filesize

    432KB

  • memory/4616-9-0x000000001DE20000-0x000000001DE8C000-memory.dmp

    Filesize

    432KB

  • memory/4616-6-0x000000001DE20000-0x000000001DE8C000-memory.dmp

    Filesize

    432KB

  • memory/4616-53-0x000000001DE20000-0x000000001DE8C000-memory.dmp

    Filesize

    432KB

  • memory/4616-2104-0x00007FFD02390000-0x00007FFD02E51000-memory.dmp

    Filesize

    10.8MB

  • memory/4616-0-0x0000000000DE0000-0x000000000146C000-memory.dmp

    Filesize

    6.5MB

  • memory/4616-59-0x000000001DE20000-0x000000001DE8C000-memory.dmp

    Filesize

    432KB

  • memory/4616-61-0x000000001DE20000-0x000000001DE8C000-memory.dmp

    Filesize

    432KB

  • memory/4616-1-0x00007FFD02390000-0x00007FFD02E51000-memory.dmp

    Filesize

    10.8MB

  • memory/4616-63-0x000000001DE20000-0x000000001DE8C000-memory.dmp

    Filesize

    432KB

  • memory/4616-2-0x000000001CFB0000-0x000000001CFC0000-memory.dmp

    Filesize

    64KB

  • memory/4616-3-0x00007FFD02390000-0x00007FFD02E51000-memory.dmp

    Filesize

    10.8MB

  • memory/4616-4-0x000000001F520000-0x000000001FB8A000-memory.dmp

    Filesize

    6.4MB

  • memory/4616-51-0x000000001DE20000-0x000000001DE8C000-memory.dmp

    Filesize

    432KB

  • memory/4616-65-0x000000001DE20000-0x000000001DE8C000-memory.dmp

    Filesize

    432KB

  • memory/4616-67-0x000000001DE20000-0x000000001DE8C000-memory.dmp

    Filesize

    432KB

  • memory/4616-69-0x000000001DE20000-0x000000001DE8C000-memory.dmp

    Filesize

    432KB

  • memory/4616-57-0x000000001DE20000-0x000000001DE8C000-memory.dmp

    Filesize

    432KB

  • memory/4616-41-0x000000001DE20000-0x000000001DE8C000-memory.dmp

    Filesize

    432KB

  • memory/4616-43-0x000000001DE20000-0x000000001DE8C000-memory.dmp

    Filesize

    432KB

  • memory/4616-33-0x000000001DE20000-0x000000001DE8C000-memory.dmp

    Filesize

    432KB

  • memory/4616-17-0x000000001DE20000-0x000000001DE8C000-memory.dmp

    Filesize

    432KB

  • memory/4616-7-0x000000001DE20000-0x000000001DE8C000-memory.dmp

    Filesize

    432KB

  • memory/4932-2122-0x00007FFD02390000-0x00007FFD02E51000-memory.dmp

    Filesize

    10.8MB

  • memory/4932-2115-0x0000024CE20E0000-0x0000024CE20F0000-memory.dmp

    Filesize

    64KB

  • memory/4932-2112-0x0000024CE2330000-0x0000024CE2352000-memory.dmp

    Filesize

    136KB

  • memory/4932-2113-0x00007FFD02390000-0x00007FFD02E51000-memory.dmp

    Filesize

    10.8MB

  • memory/4932-2114-0x0000024CE20E0000-0x0000024CE20F0000-memory.dmp

    Filesize

    64KB

  • memory/5380-2182-0x00007FFD02390000-0x00007FFD02E51000-memory.dmp

    Filesize

    10.8MB

  • memory/5380-2180-0x000001D72DF90000-0x000001D72DFA0000-memory.dmp

    Filesize

    64KB

  • memory/5380-2179-0x000001D72DF90000-0x000001D72DFA0000-memory.dmp

    Filesize

    64KB

  • memory/5380-2177-0x00007FFD02390000-0x00007FFD02E51000-memory.dmp

    Filesize

    10.8MB

  • memory/5748-2167-0x00007FFD02390000-0x00007FFD02E51000-memory.dmp

    Filesize

    10.8MB

  • memory/5748-2163-0x00007FFD02390000-0x00007FFD02E51000-memory.dmp

    Filesize

    10.8MB

  • memory/5748-2164-0x00000226D5BB0000-0x00000226D5BC0000-memory.dmp

    Filesize

    64KB

  • memory/5748-2165-0x00000226D5BB0000-0x00000226D5BC0000-memory.dmp

    Filesize

    64KB