Analysis
- max time kernel
2s - max time network
88s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
19/01/2024, 20:19
General
- Target magic.poisontoolz.com/Binded.exe
- Size 5.4MB
- Sample240119-y3w7hsdee7
- SHA256 59e7180a2a869453fb54d13f04b4eda1a5153659378501fa31b18f862576f800
Malware Config
Signatures
- Detect ZGRat V1 32 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
Processes
-
C:\Users\Admin\AppData\Local\Temp\magic.poisontoolz.com\Binded.exe"C:\Users\Admin\AppData\Local\Temp\magic.poisontoolz.com\Binded.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\blbrok.exe"C:\Users\Admin\AppData\Local\Temp\blbrok.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\rock.exe"C:\Users\Admin\AppData\Local\Temp\rock.exe"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABUAHkAcABlAEkAZAAuAGUAeABlADsA1⤵
-
C:\Users\Admin\AppData\Local\Hash\mdvhj\TypeId.exeC:\Users\Admin\AppData\Local\Hash\mdvhj\TypeId.exe1⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABUAHkAcABlAEkAZAAuAGUAeABlADsA1⤵
-
C:\Users\Admin\AppData\Local\Temp\nxryyws.exeC:\Users\Admin\AppData\Local\Temp\nxryyws.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\nxryyws.exeC:\Users\Admin\AppData\Local\Temp\nxryyws.exe2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
TypeId.exe
TypeId.exe
powershell.exe.log
nxryyws.exe.log
StartupProfileData-NonInteractive
Autofills.txt
Cookies.txt
CreditCards.txt
Downloads.txt
Histories.txt
Passwords.txt
__PSScriptPolicyTest_joffblep.we4.ps1
blbrok.exe
blbrok.exe
blbrok.exe
nxryyws.exe
nxryyws.exe
rock.exe
rock.exe
rock.exe
memory/1148-6745-0x00007FF80EF30000-0x00007FF80F9F1000-memory.dmp
memory/1148-6205-0x0000028263D40000-0x0000028263D50000-memory.dmp
memory/1148-5989-0x0000028263D40000-0x0000028263D50000-memory.dmp
memory/1148-5656-0x0000028263D40000-0x0000028263D50000-memory.dmp
memory/1148-5654-0x00007FF80EF30000-0x00007FF80F9F1000-memory.dmp
memory/1200-1-0x00007FF80F340000-0x00007FF80FE01000-memory.dmp
memory/1200-0-0x0000000000E10000-0x0000000001382000-memory.dmp
memory/1200-34-0x00007FF80F340000-0x00007FF80FE01000-memory.dmp
memory/1200-2-0x0000000001B80000-0x0000000001B90000-memory.dmp
memory/2168-2307-0x0000020630B40000-0x0000020630B50000-memory.dmp
memory/2168-2295-0x0000020630B40000-0x0000020630B50000-memory.dmp
memory/2168-2306-0x00000206490D0000-0x00000206490F2000-memory.dmp
memory/2168-2296-0x0000020630B40000-0x0000020630B50000-memory.dmp
memory/2168-2310-0x00007FF80EF30000-0x00007FF80F9F1000-memory.dmp
memory/2168-2294-0x00007FF80EF30000-0x00007FF80F9F1000-memory.dmp
memory/2576-73-0x00000273AB100000-0x00000273AB150000-memory.dmp
memory/2576-7689-0x0000000006160000-0x0000000006704000-memory.dmp
memory/2576-6751-0x00000000001F0000-0x000000000020C000-memory.dmp
memory/2576-6752-0x0000000074BB0000-0x0000000075360000-memory.dmp
memory/2576-6753-0x0000000004A70000-0x0000000004A80000-memory.dmp
memory/2576-37-0x00000273AB170000-0x00000273AB180000-memory.dmp
memory/2576-33-0x00007FF80F340000-0x00007FF80FE01000-memory.dmp
memory/2576-6754-0x0000000005580000-0x00000000056B6000-memory.dmp
memory/2576-32-0x0000027390990000-0x0000027390B08000-memory.dmp
memory/2576-7687-0x00000000056B0000-0x00000000056B1000-memory.dmp
memory/2576-7688-0x00000000058B0000-0x000000000597E000-memory.dmp
memory/2576-463-0x00007FF80F340000-0x00007FF80FE01000-memory.dmp
memory/2576-7696-0x0000000074BB0000-0x0000000075360000-memory.dmp
memory/2960-4521-0x0000000074BB0000-0x0000000075360000-memory.dmp
memory/2960-4522-0x0000000005490000-0x00000000054A0000-memory.dmp
memory/2960-6746-0x0000000074BB0000-0x0000000075360000-memory.dmp
memory/3560-7694-0x0000000000400000-0x0000000000578000-memory.dmp
memory/3560-7697-0x0000000005830000-0x00000000058C2000-memory.dmp
memory/3560-7698-0x0000000005A80000-0x0000000005A90000-memory.dmp
memory/3560-7741-0x0000000074BB0000-0x0000000075360000-memory.dmp
memory/3560-7695-0x0000000074BB0000-0x0000000075360000-memory.dmp
memory/3560-7699-0x0000000006770000-0x000000000677A000-memory.dmp
memory/3560-7700-0x0000000008FD0000-0x0000000009020000-memory.dmp
memory/3560-7740-0x0000000005A80000-0x0000000005A90000-memory.dmp
memory/3892-75-0x00000000054A0000-0x0000000005582000-memory.dmp
memory/3892-70-0x00000000054A0000-0x0000000005582000-memory.dmp
memory/3892-2290-0x0000000005C70000-0x0000000005CC4000-memory.dmp
memory/3892-2289-0x0000000005850000-0x00000000058B6000-memory.dmp
memory/3892-2287-0x0000000005630000-0x0000000005686000-memory.dmp
memory/3892-2288-0x0000000005690000-0x00000000056DC000-memory.dmp
memory/3892-40-0x00000000054A0000-0x0000000005582000-memory.dmp
memory/3892-46-0x00000000054A0000-0x0000000005582000-memory.dmp
memory/3892-48-0x00000000054A0000-0x0000000005582000-memory.dmp
memory/3892-50-0x00000000054A0000-0x0000000005582000-memory.dmp
memory/3892-54-0x00000000054A0000-0x0000000005582000-memory.dmp
memory/3892-36-0x0000000000B80000-0x0000000000C1C000-memory.dmp
memory/3892-35-0x0000000074BB0000-0x0000000075360000-memory.dmp
memory/3892-56-0x00000000054A0000-0x0000000005582000-memory.dmp
memory/3892-38-0x0000000005490000-0x00000000054A0000-memory.dmp
memory/3892-62-0x00000000054A0000-0x0000000005582000-memory.dmp
memory/3892-66-0x00000000054A0000-0x0000000005582000-memory.dmp
memory/3892-68-0x00000000054A0000-0x0000000005582000-memory.dmp
memory/3892-72-0x00000000054A0000-0x0000000005582000-memory.dmp
memory/3892-90-0x00000000054A0000-0x0000000005582000-memory.dmp
memory/3892-113-0x00000000054A0000-0x0000000005582000-memory.dmp
memory/3892-117-0x00000000054A0000-0x0000000005582000-memory.dmp
memory/3892-119-0x00000000054A0000-0x0000000005582000-memory.dmp
memory/3892-123-0x00000000054A0000-0x0000000005582000-memory.dmp
memory/3892-125-0x00000000054A0000-0x0000000005582000-memory.dmp
memory/3892-129-0x00000000054A0000-0x0000000005582000-memory.dmp
memory/3892-131-0x00000000054A0000-0x0000000005582000-memory.dmp
memory/3892-133-0x00000000054A0000-0x0000000005582000-memory.dmp
memory/3892-137-0x00000000054A0000-0x0000000005582000-memory.dmp
memory/3892-135-0x00000000054A0000-0x0000000005582000-memory.dmp
memory/3892-127-0x00000000054A0000-0x0000000005582000-memory.dmp
memory/3892-121-0x00000000054A0000-0x0000000005582000-memory.dmp
memory/3892-115-0x00000000054A0000-0x0000000005582000-memory.dmp
memory/3892-82-0x00000000054A0000-0x0000000005582000-memory.dmp
memory/3892-2293-0x0000000074BB0000-0x0000000075360000-memory.dmp
memory/3892-64-0x00000000054A0000-0x0000000005582000-memory.dmp
memory/3892-60-0x00000000054A0000-0x0000000005582000-memory.dmp
memory/3892-58-0x00000000054A0000-0x0000000005582000-memory.dmp
memory/3892-52-0x00000000054A0000-0x0000000005582000-memory.dmp
memory/3892-43-0x00000000054A0000-0x0000000005582000-memory.dmp
memory/3892-41-0x00000000054A0000-0x0000000005582000-memory.dmp
memory/3892-39-0x00000000054A0000-0x0000000005588000-memory.dmp
memory/3984-4523-0x0000000074BB0000-0x0000000075360000-memory.dmp
memory/3984-2313-0x0000000074BB0000-0x0000000075360000-memory.dmp
memory/3984-2314-0x0000000002930000-0x0000000002940000-memory.dmp