Analysis
- max time kernel
18s - max time network
88s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
24/01/2024, 14:26
General
- Target FCC1EBC0FB18420654C7F80097AA5BC7.exe
- Size 4.8MB
- Sample240124-rrt5fscef8
- SHA256 f61bd5315d71bbd27f704ce063f970dd2e3131e5484ecd940c5b14a74d08c620
Malware Config
Signatures
- Detect ZGRat V1 6 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Creates new service(s) 1 TTPs
- Stops running service(s) 3 TTPs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 3 IoCs
- Drops file in Program Files directory 5 IoCs
- Drops file in Windows directory 3 IoCs
- Launches sc.exe 9 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\FCC1EBC0FB18420654C7F80097AA5BC7.exe"C:\Users\Admin\AppData\Local\Temp\FCC1EBC0FB18420654C7F80097AA5BC7.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ca.exe"C:\Users\Admin\AppData\Local\Temp\ca.exe"2⤵
- Executes dropped EXE
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc3⤵
- Launches sc.exe
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart3⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart4⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc3⤵
- Launches sc.exe
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe3⤵
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "SOOGNLYX"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "SOOGNLYX" binpath= "C:\ProgramData\hqrksrpxxvxo\ucdmcsniqgkb.exe" start= "auto"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "SOOGNLYX"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog3⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\providerbrowsersession.exe"C:\Users\Admin\AppData\Local\Temp\providerbrowsersession.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3jrAgRfiFD.bat"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost4⤵
- Runs ping.exe
-
-
C:\odt\SppExtComObj.exe"C:\odt\SppExtComObj.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\ProgramData\hqrksrpxxvxo\ucdmcsniqgkb.exeC:\ProgramData\hqrksrpxxvxo\ucdmcsniqgkb.exe1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
ucdmcsniqgkb.exe
ucdmcsniqgkb.exe
3jrAgRfiFD.bat
__PSScriptPolicyTest_zvvbqgnc.2tc.ps1
ca.exe
ca.exe
ca.exe
providerbrowsersession.exe
providerbrowsersession.exe
providerbrowsersession.exe
SppExtComObj.exe
memory/396-137-0x00000254407F0000-0x000002544081B000-memory.dmp
memory/396-141-0x00007FFCD07F0000-0x00007FFCD0800000-memory.dmp
memory/396-152-0x00000254407F0000-0x000002544081B000-memory.dmp
memory/416-154-0x000001E912760000-0x000001E91278B000-memory.dmp
memory/416-149-0x00007FFCD07F0000-0x00007FFCD0800000-memory.dmp
memory/416-147-0x000001E912760000-0x000001E91278B000-memory.dmp
memory/624-126-0x00000253F7BD0000-0x00000253F7BF4000-memory.dmp
memory/624-128-0x00000253F7C00000-0x00000253F7C2B000-memory.dmp
memory/624-135-0x00007FFD1080D000-0x00007FFD1080E000-memory.dmp
memory/624-188-0x00000253F7C00000-0x00000253F7C2B000-memory.dmp
memory/668-164-0x00007FFCD07F0000-0x00007FFCD0800000-memory.dmp
memory/668-161-0x00000168501D0000-0x00000168501FB000-memory.dmp
memory/684-139-0x00007FFD1080D000-0x00007FFD1080E000-memory.dmp
memory/684-129-0x0000029B0B190000-0x0000029B0B1BB000-memory.dmp
memory/684-132-0x0000029B0B190000-0x0000029B0B1BB000-memory.dmp
memory/684-131-0x00007FFCD07F0000-0x00007FFCD0800000-memory.dmp
memory/684-148-0x00007FFD1080F000-0x00007FFD10810000-memory.dmp
memory/932-162-0x0000016BC5340000-0x0000016BC536B000-memory.dmp
memory/932-166-0x00007FFCD07F0000-0x00007FFCD0800000-memory.dmp
memory/968-153-0x00007FFD1080C000-0x00007FFD1080D000-memory.dmp
memory/968-150-0x0000018F023D0000-0x0000018F023FB000-memory.dmp
memory/968-140-0x00007FFCD07F0000-0x00007FFCD0800000-memory.dmp
memory/968-136-0x0000018F023D0000-0x0000018F023FB000-memory.dmp
memory/1072-165-0x0000022A0E5C0000-0x0000022A0E5EB000-memory.dmp
memory/1072-169-0x00007FFCD07F0000-0x00007FFCD0800000-memory.dmp
memory/1072-172-0x0000022A0E5C0000-0x0000022A0E5EB000-memory.dmp
memory/1108-170-0x000001CACEAD0000-0x000001CACEAFB000-memory.dmp
memory/1108-174-0x00007FFCD07F0000-0x00007FFCD0800000-memory.dmp
memory/1108-175-0x000001CACEAD0000-0x000001CACEAFB000-memory.dmp
memory/1176-180-0x00007FFCD07F0000-0x00007FFCD0800000-memory.dmp
memory/1176-179-0x00000270870B0000-0x00000270870DB000-memory.dmp
memory/1256-182-0x00000217206A0000-0x00000217206CB000-memory.dmp
memory/1256-184-0x00007FFCD07F0000-0x00007FFCD0800000-memory.dmp
memory/1304-194-0x00007FFCD07F0000-0x00007FFCD0800000-memory.dmp
memory/1304-193-0x0000022E30660000-0x0000022E3068B000-memory.dmp
memory/1320-198-0x00000222601D0000-0x00000222601FB000-memory.dmp
memory/2028-114-0x0000000140000000-0x000000014002B000-memory.dmp
memory/2028-123-0x0000000140000000-0x000000014002B000-memory.dmp
memory/2028-120-0x00007FFD10770000-0x00007FFD10965000-memory.dmp
memory/2028-121-0x00007FFD0F480000-0x00007FFD0F53E000-memory.dmp
memory/2028-117-0x0000000140000000-0x000000014002B000-memory.dmp
memory/2028-119-0x0000000140000000-0x000000014002B000-memory.dmp
memory/2028-116-0x0000000140000000-0x000000014002B000-memory.dmp
memory/2028-115-0x0000000140000000-0x000000014002B000-memory.dmp
memory/2408-49-0x0000000002DB0000-0x0000000002DBE000-memory.dmp
memory/2408-33-0x00007FFD0F400000-0x00007FFD0F401000-memory.dmp
memory/2408-23-0x0000000000950000-0x0000000000B4E000-memory.dmp
memory/2408-24-0x00007FFCF1EB0000-0x00007FFCF2971000-memory.dmp
memory/2408-25-0x000000001B820000-0x000000001B830000-memory.dmp
memory/2408-26-0x00000000012E0000-0x00000000012E1000-memory.dmp
memory/2408-27-0x00007FFD0F480000-0x00007FFD0F53E000-memory.dmp
memory/2408-30-0x00007FFD0F410000-0x00007FFD0F411000-memory.dmp
memory/2408-29-0x0000000001320000-0x000000000132E000-memory.dmp
memory/2408-31-0x000000001B820000-0x000000001B830000-memory.dmp
memory/2408-32-0x00007FFD0F480000-0x00007FFD0F53E000-memory.dmp
memory/2408-35-0x0000000002DC0000-0x0000000002DDC000-memory.dmp
memory/2408-39-0x00007FFD0F3F0000-0x00007FFD0F3F1000-memory.dmp
memory/2408-41-0x0000000002C60000-0x0000000002C6E000-memory.dmp
memory/2408-46-0x0000000002DA0000-0x0000000002DB0000-memory.dmp
memory/2408-44-0x00007FFD0F3D0000-0x00007FFD0F3D1000-memory.dmp
memory/2408-43-0x00007FFCF1EB0000-0x00007FFCF2971000-memory.dmp
memory/2408-42-0x00007FFD0F3E0000-0x00007FFD0F3E1000-memory.dmp
memory/2408-38-0x0000000002DE0000-0x0000000002DF8000-memory.dmp
memory/2408-36-0x000000001BA30000-0x000000001BA80000-memory.dmp
memory/2408-50-0x00007FFD0F3C0000-0x00007FFD0F3C1000-memory.dmp
memory/2408-72-0x00007FFCF1EB0000-0x00007FFCF2971000-memory.dmp
memory/2408-69-0x000000001BD50000-0x000000001BDF9000-memory.dmp
memory/2408-71-0x00007FFD0F480000-0x00007FFD0F53E000-memory.dmp
memory/2408-47-0x000000001B820000-0x000000001B830000-memory.dmp
memory/2408-51-0x00007FFD0F3B0000-0x00007FFD0F3B1000-memory.dmp
memory/2408-53-0x0000000002E00000-0x0000000002E0C000-memory.dmp
memory/2508-107-0x000001E9F0310000-0x000001E9F0332000-memory.dmp
memory/2508-110-0x000001E9F03E0000-0x000001E9F03F0000-memory.dmp
memory/2508-109-0x000001E9F03E0000-0x000001E9F03F0000-memory.dmp
memory/2508-108-0x00007FFCF1C70000-0x00007FFCF2731000-memory.dmp
memory/2508-113-0x00007FFCF1C70000-0x00007FFCF2731000-memory.dmp
memory/2696-168-0x00007FFCF1C70000-0x00007FFCF2731000-memory.dmp
memory/2696-207-0x000001BC210C0000-0x000001BC210D0000-memory.dmp
memory/2696-155-0x000001BC210C0000-0x000001BC210D0000-memory.dmp
memory/2696-157-0x000001BC210C0000-0x000001BC210D0000-memory.dmp
memory/3296-89-0x00007FFD0F3E0000-0x00007FFD0F3E1000-memory.dmp
memory/3296-97-0x00007FFD0F3B0000-0x00007FFD0F3B1000-memory.dmp
memory/3296-86-0x00007FFD0F400000-0x00007FFD0F401000-memory.dmp
memory/3296-144-0x000000001C8B0000-0x000000001C959000-memory.dmp
memory/3296-84-0x00007FFD0F480000-0x00007FFD0F53E000-memory.dmp
memory/3296-82-0x00007FFD0F410000-0x00007FFD0F411000-memory.dmp
memory/3296-90-0x00007FFD0F3D0000-0x00007FFD0F3D1000-memory.dmp
memory/3296-94-0x00007FFCF1C70000-0x00007FFCF2731000-memory.dmp
memory/3296-96-0x000000001BBA0000-0x000000001BBB0000-memory.dmp
memory/3296-87-0x00007FFD0F3F0000-0x00007FFD0F3F1000-memory.dmp
memory/3296-95-0x00007FFD0F3C0000-0x00007FFD0F3C1000-memory.dmp
memory/3296-80-0x000000001BBA0000-0x000000001BBB0000-memory.dmp
memory/3296-79-0x00007FFD0F480000-0x00007FFD0F53E000-memory.dmp
memory/3296-78-0x0000000002F10000-0x0000000002F11000-memory.dmp
memory/3296-77-0x000000001BBA0000-0x000000001BBB0000-memory.dmp
memory/3296-76-0x00007FFCF1C70000-0x00007FFCF2731000-memory.dmp
memory/4716-21-0x0000000000400000-0x00000000008D1000-memory.dmp