Analysis

  • max time kernel
    149s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-01-2024 20:19

General

  • Target

    magic.poisontoolz.com/yagacrypt.exe

  • Size

    56KB

  • MD5

    0abd42634db4f4fb3bbbcaa066413d68

  • SHA1

    074f62ae3b24d775f09e98e81e857e6f1be05f3b

  • SHA256

    a2ac7be629121924985b42fdf34380efe12be78a3d8665b625a2eae80808cff4

  • SHA512

    578ef89e668c8e38e66353f485be2b90ebf8ec21bcf0f5de0ec65ee0710b55256876f28219e540beaf2dea41224c51355dc9a39930cfa3b231b3450264ac47d2

  • SSDEEP

    1536:rytceGvzLlLa2kSrZRPV1mcKAgSfTl3Blpgr1dv:rytceGv3lLa2LRPVBvfR3TpgBdv

Score
10/10

Malware Config

Signatures

  • Detect ZGRat V1 35 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Executes dropped EXE 3 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\magic.poisontoolz.com\yagacrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\magic.poisontoolz.com\yagacrypt.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4044
    • C:\Users\Admin\AppData\Local\Temp\magic.poisontoolz.com\yagacrypt.exe
      C:\Users\Admin\AppData\Local\Temp\magic.poisontoolz.com\yagacrypt.exe
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:208
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABMAGUAZwBhAGwAQgBsAG8AYwBrAFMAaQB6AGUAcwAuAGUAeABlADsA
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2308
  • C:\Users\Admin\AppData\Local\IsInvalid\ugqwo\LegalBlockSizes.exe
    C:\Users\Admin\AppData\Local\IsInvalid\ugqwo\LegalBlockSizes.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3740
    • C:\Users\Admin\AppData\Local\IsInvalid\ugqwo\LegalBlockSizes.exe
      C:\Users\Admin\AppData\Local\IsInvalid\ugqwo\LegalBlockSizes.exe
      2⤵
      • Executes dropped EXE
      PID:4088
    • C:\Users\Admin\AppData\Local\IsInvalid\ugqwo\LegalBlockSizes.exe
      C:\Users\Admin\AppData\Local\IsInvalid\ugqwo\LegalBlockSizes.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5080
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4404
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABMAGUAZwBhAGwAQgBsAG8AYwBrAFMAaQB6AGUAcwAuAGUAeABlADsA
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\IsInvalid\ugqwo\LegalBlockSizes.exe

    Filesize

    56KB

    MD5

    0abd42634db4f4fb3bbbcaa066413d68

    SHA1

    074f62ae3b24d775f09e98e81e857e6f1be05f3b

    SHA256

    a2ac7be629121924985b42fdf34380efe12be78a3d8665b625a2eae80808cff4

    SHA512

    578ef89e668c8e38e66353f485be2b90ebf8ec21bcf0f5de0ec65ee0710b55256876f28219e540beaf2dea41224c51355dc9a39930cfa3b231b3450264ac47d2

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    d85ba6ff808d9e5444a4b369f5bc2730

    SHA1

    31aa9d96590fff6981b315e0b391b575e4c0804a

    SHA256

    84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

    SHA512

    8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\yagacrypt.exe.log

    Filesize

    1KB

    MD5

    c3941d9fa38f1717d5cecd7a2ca71667

    SHA1

    33b5362675383b58b4166ed9f9a61e5aa6768d2e

    SHA256

    f1ed6ff1cd3df219061e32df1c75d6f48de6484cf50e5ea7d86cd8bcfcb93256

    SHA512

    98f103ef97d32bf8c0566a6f6da5cf8d58d18f698c1b3e5bd0be0ea8462f5fe54c2e5e6b5188f2b7d8f70082ffd6745b1f7f6cab95af474e2b7eaed50a9d9c45

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    d28a889fd956d5cb3accfbaf1143eb6f

    SHA1

    157ba54b365341f8ff06707d996b3635da8446f7

    SHA256

    21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

    SHA512

    0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d42etw3k.fcj.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/208-3182-0x0000000074B00000-0x00000000752B0000-memory.dmp

    Filesize

    7.7MB

  • memory/208-3179-0x0000000005830000-0x0000000005886000-memory.dmp

    Filesize

    344KB

  • memory/208-3184-0x0000000074B00000-0x00000000752B0000-memory.dmp

    Filesize

    7.7MB

  • memory/208-946-0x0000000000400000-0x000000000049C000-memory.dmp

    Filesize

    624KB

  • memory/208-947-0x0000000074B00000-0x00000000752B0000-memory.dmp

    Filesize

    7.7MB

  • memory/208-949-0x0000000003110000-0x0000000003120000-memory.dmp

    Filesize

    64KB

  • memory/208-948-0x00000000056D0000-0x00000000057B8000-memory.dmp

    Filesize

    928KB

  • memory/208-3181-0x0000000005EF0000-0x0000000005F44000-memory.dmp

    Filesize

    336KB

  • memory/208-3180-0x0000000005AC0000-0x0000000005B26000-memory.dmp

    Filesize

    408KB

  • memory/1468-7031-0x00000159D10E0000-0x00000159D10F0000-memory.dmp

    Filesize

    64KB

  • memory/1468-7192-0x00000159D10E0000-0x00000159D10F0000-memory.dmp

    Filesize

    64KB

  • memory/1468-6748-0x00007FFE09850000-0x00007FFE0A311000-memory.dmp

    Filesize

    10.8MB

  • memory/1468-7327-0x00007FFE09850000-0x00007FFE0A311000-memory.dmp

    Filesize

    10.8MB

  • memory/1468-6765-0x00000159D10E0000-0x00000159D10F0000-memory.dmp

    Filesize

    64KB

  • memory/2308-3196-0x000001C2DC2D0000-0x000001C2DC2F2000-memory.dmp

    Filesize

    136KB

  • memory/2308-3190-0x00007FFE09850000-0x00007FFE0A311000-memory.dmp

    Filesize

    10.8MB

  • memory/2308-3191-0x000001C2DC300000-0x000001C2DC310000-memory.dmp

    Filesize

    64KB

  • memory/2308-3197-0x000001C2DC300000-0x000001C2DC310000-memory.dmp

    Filesize

    64KB

  • memory/2308-3200-0x00007FFE09850000-0x00007FFE0A311000-memory.dmp

    Filesize

    10.8MB

  • memory/3740-3203-0x0000000074B00000-0x00000000752B0000-memory.dmp

    Filesize

    7.7MB

  • memory/3740-3204-0x0000000005350000-0x0000000005360000-memory.dmp

    Filesize

    64KB

  • memory/3740-4137-0x0000000005FF0000-0x0000000005FF1000-memory.dmp

    Filesize

    4KB

  • memory/3740-4145-0x0000000005350000-0x0000000005360000-memory.dmp

    Filesize

    64KB

  • memory/3740-4146-0x0000000074B00000-0x00000000752B0000-memory.dmp

    Filesize

    7.7MB

  • memory/4044-34-0x0000000005880000-0x00000000059A3000-memory.dmp

    Filesize

    1.1MB

  • memory/4044-0-0x0000000074B00000-0x00000000752B0000-memory.dmp

    Filesize

    7.7MB

  • memory/4044-58-0x0000000005880000-0x00000000059A3000-memory.dmp

    Filesize

    1.1MB

  • memory/4044-66-0x0000000005880000-0x00000000059A3000-memory.dmp

    Filesize

    1.1MB

  • memory/4044-54-0x0000000005880000-0x00000000059A3000-memory.dmp

    Filesize

    1.1MB

  • memory/4044-48-0x0000000005880000-0x00000000059A3000-memory.dmp

    Filesize

    1.1MB

  • memory/4044-44-0x0000000005880000-0x00000000059A3000-memory.dmp

    Filesize

    1.1MB

  • memory/4044-40-0x0000000005880000-0x00000000059A3000-memory.dmp

    Filesize

    1.1MB

  • memory/4044-68-0x0000000005880000-0x00000000059A3000-memory.dmp

    Filesize

    1.1MB

  • memory/4044-937-0x00000000059C0000-0x00000000059C1000-memory.dmp

    Filesize

    4KB

  • memory/4044-938-0x0000000005BA0000-0x0000000005C60000-memory.dmp

    Filesize

    768KB

  • memory/4044-939-0x0000000005CA0000-0x0000000005CEC000-memory.dmp

    Filesize

    304KB

  • memory/4044-940-0x0000000074B00000-0x00000000752B0000-memory.dmp

    Filesize

    7.7MB

  • memory/4044-941-0x00000000027B0000-0x00000000027C0000-memory.dmp

    Filesize

    64KB

  • memory/4044-942-0x0000000006490000-0x0000000006A34000-memory.dmp

    Filesize

    5.6MB

  • memory/4044-62-0x0000000005880000-0x00000000059A3000-memory.dmp

    Filesize

    1.1MB

  • memory/4044-60-0x0000000005880000-0x00000000059A3000-memory.dmp

    Filesize

    1.1MB

  • memory/4044-56-0x0000000005880000-0x00000000059A3000-memory.dmp

    Filesize

    1.1MB

  • memory/4044-52-0x0000000005880000-0x00000000059A3000-memory.dmp

    Filesize

    1.1MB

  • memory/4044-50-0x0000000005880000-0x00000000059A3000-memory.dmp

    Filesize

    1.1MB

  • memory/4044-952-0x0000000074B00000-0x00000000752B0000-memory.dmp

    Filesize

    7.7MB

  • memory/4044-46-0x0000000005880000-0x00000000059A3000-memory.dmp

    Filesize

    1.1MB

  • memory/4044-42-0x0000000005880000-0x00000000059A3000-memory.dmp

    Filesize

    1.1MB

  • memory/4044-38-0x0000000005880000-0x00000000059A3000-memory.dmp

    Filesize

    1.1MB

  • memory/4044-36-0x0000000005880000-0x00000000059A3000-memory.dmp

    Filesize

    1.1MB

  • memory/4044-64-0x0000000005880000-0x00000000059A3000-memory.dmp

    Filesize

    1.1MB

  • memory/4044-32-0x0000000005880000-0x00000000059A3000-memory.dmp

    Filesize

    1.1MB

  • memory/4044-30-0x0000000005880000-0x00000000059A3000-memory.dmp

    Filesize

    1.1MB

  • memory/4044-28-0x0000000005880000-0x00000000059A3000-memory.dmp

    Filesize

    1.1MB

  • memory/4044-14-0x0000000005880000-0x00000000059A3000-memory.dmp

    Filesize

    1.1MB

  • memory/4044-16-0x0000000005880000-0x00000000059A3000-memory.dmp

    Filesize

    1.1MB

  • memory/4044-22-0x0000000005880000-0x00000000059A3000-memory.dmp

    Filesize

    1.1MB

  • memory/4044-26-0x0000000005880000-0x00000000059A3000-memory.dmp

    Filesize

    1.1MB

  • memory/4044-24-0x0000000005880000-0x00000000059A3000-memory.dmp

    Filesize

    1.1MB

  • memory/4044-20-0x0000000005880000-0x00000000059A3000-memory.dmp

    Filesize

    1.1MB

  • memory/4044-18-0x0000000005880000-0x00000000059A3000-memory.dmp

    Filesize

    1.1MB

  • memory/4044-1-0x00000000003B0000-0x00000000003C4000-memory.dmp

    Filesize

    80KB

  • memory/4044-2-0x00000000027B0000-0x00000000027C0000-memory.dmp

    Filesize

    64KB

  • memory/4044-12-0x0000000005880000-0x00000000059A3000-memory.dmp

    Filesize

    1.1MB

  • memory/4044-10-0x0000000005880000-0x00000000059A3000-memory.dmp

    Filesize

    1.1MB

  • memory/4044-3-0x0000000002780000-0x0000000002786000-memory.dmp

    Filesize

    24KB

  • memory/4044-4-0x0000000005880000-0x00000000059AA000-memory.dmp

    Filesize

    1.2MB

  • memory/4044-8-0x0000000005880000-0x00000000059A3000-memory.dmp

    Filesize

    1.1MB

  • memory/4044-6-0x0000000005880000-0x00000000059A3000-memory.dmp

    Filesize

    1.1MB

  • memory/4044-5-0x0000000005880000-0x00000000059A3000-memory.dmp

    Filesize

    1.1MB

  • memory/4404-6376-0x0000000074B00000-0x00000000752B0000-memory.dmp

    Filesize

    7.7MB

  • memory/4404-7325-0x0000000005990000-0x0000000005991000-memory.dmp

    Filesize

    4KB

  • memory/4404-7328-0x0000000074B00000-0x00000000752B0000-memory.dmp

    Filesize

    7.7MB

  • memory/5080-6377-0x0000000074B00000-0x00000000752B0000-memory.dmp

    Filesize

    7.7MB

  • memory/5080-4144-0x0000000005130000-0x0000000005140000-memory.dmp

    Filesize

    64KB

  • memory/5080-4143-0x0000000074B00000-0x00000000752B0000-memory.dmp

    Filesize

    7.7MB