Analysis
- max time kernel
145s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
30/01/2024, 04:02
General
- Target file.exe
- Size 667KB
- Sample240130-elscfsgae6
- SHA256 9b61ab1b854861a9e98bc354da2b104c277c97fd758e39a24c382a9b06e29bc9
Malware Config
Extracted
-
systembc
-
69.10.60.115:4018
Signatures
- Detect ZGRat V1 34 IoCs
- SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
- ZGRat
ZGRat is remote access trojan written in C#.
- Downloads MZ/PE file
- Executes dropped EXE 5 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Drops file in System32 directory 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Drops file in Windows directory 4 IoCs
- Modifies data under HKEY_USERS 5 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 33 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\file.exeC:\Users\Admin\AppData\Local\Temp\file.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\file.exeC:\Users\Admin\AppData\Local\Temp\file.exe2⤵
- Adds Run key to start application
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\file.exeC:\Users\Admin\AppData\Local\Temp\file.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\wuldk.exeC:\Users\Admin\AppData\Local\Temp\wuldk.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\wuldk.exeC:\Users\Admin\AppData\Local\Temp\wuldk.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
-
C:\Users\Admin\AppData\Local\Temp\wuldk.exeC:\Users\Admin\AppData\Local\Temp\wuldk.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\wuldk.exeC:\Users\Admin\AppData\Local\Temp\wuldk.exe2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
-
C:\Windows\TEMP\csldu.exeC:\Windows\TEMP\csldu.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
wuldk.exe
wuldk.exe.log
memory/348-3783-0x0000000004280000-0x0000000004281000-memory.dmp
memory/348-2850-0x0000000004160000-0x0000000004170000-memory.dmp
memory/348-2849-0x00000000748C0000-0x0000000075070000-memory.dmp
memory/1036-1900-0x0000000074150000-0x0000000074900000-memory.dmp
memory/1036-1894-0x0000000003FF0000-0x0000000004000000-memory.dmp
memory/1036-1893-0x0000000074150000-0x0000000074900000-memory.dmp
memory/1036-1890-0x00000000018A0000-0x00000000018A1000-memory.dmp
memory/1036-958-0x0000000003FF0000-0x0000000004000000-memory.dmp
memory/1036-956-0x0000000074150000-0x0000000074900000-memory.dmp
memory/4120-38-0x0000000004B90000-0x0000000004C21000-memory.dmp
memory/4120-24-0x0000000004B90000-0x0000000004C21000-memory.dmp
memory/4120-8-0x0000000004B90000-0x0000000004C21000-memory.dmp
memory/4120-34-0x0000000004B90000-0x0000000004C21000-memory.dmp
memory/4120-0-0x00000000000B0000-0x000000000015E000-memory.dmp
memory/4120-40-0x0000000004B90000-0x0000000004C21000-memory.dmp
memory/4120-46-0x0000000004B90000-0x0000000004C21000-memory.dmp
memory/4120-58-0x0000000004B90000-0x0000000004C21000-memory.dmp
memory/4120-64-0x0000000004B90000-0x0000000004C21000-memory.dmp
memory/4120-62-0x0000000004B90000-0x0000000004C21000-memory.dmp
memory/4120-60-0x0000000004B90000-0x0000000004C21000-memory.dmp
memory/4120-56-0x0000000004B90000-0x0000000004C21000-memory.dmp
memory/4120-54-0x0000000004B90000-0x0000000004C21000-memory.dmp
memory/4120-52-0x0000000004B90000-0x0000000004C21000-memory.dmp
memory/4120-50-0x0000000004B90000-0x0000000004C21000-memory.dmp
memory/4120-66-0x0000000004B90000-0x0000000004C21000-memory.dmp
memory/4120-48-0x0000000004B90000-0x0000000004C21000-memory.dmp
memory/4120-68-0x0000000004B90000-0x0000000004C21000-memory.dmp
memory/4120-44-0x0000000004B90000-0x0000000004C21000-memory.dmp
memory/4120-42-0x0000000004B90000-0x0000000004C21000-memory.dmp
memory/4120-36-0x0000000004B90000-0x0000000004C21000-memory.dmp
memory/4120-32-0x0000000004B90000-0x0000000004C21000-memory.dmp
memory/4120-30-0x0000000004B90000-0x0000000004C21000-memory.dmp
memory/4120-28-0x0000000004B90000-0x0000000004C21000-memory.dmp
memory/4120-26-0x0000000004B90000-0x0000000004C21000-memory.dmp
memory/4120-16-0x0000000004B90000-0x0000000004C21000-memory.dmp
memory/4120-22-0x0000000004B90000-0x0000000004C21000-memory.dmp
memory/4120-937-0x0000000004C30000-0x0000000004C31000-memory.dmp
memory/4120-939-0x0000000004CE0000-0x0000000004D2C000-memory.dmp
memory/4120-938-0x0000000004CB0000-0x0000000004CDE000-memory.dmp
memory/4120-940-0x0000000074880000-0x0000000075030000-memory.dmp
memory/4120-941-0x00000000056F0000-0x0000000005C94000-memory.dmp
memory/4120-1-0x0000000074880000-0x0000000075030000-memory.dmp
memory/4120-948-0x0000000074880000-0x0000000075030000-memory.dmp
memory/4120-20-0x0000000004B90000-0x0000000004C21000-memory.dmp
memory/4120-18-0x0000000004B90000-0x0000000004C21000-memory.dmp
memory/4120-14-0x0000000004B90000-0x0000000004C21000-memory.dmp
memory/4120-12-0x0000000004B90000-0x0000000004C21000-memory.dmp
memory/4120-10-0x0000000004B90000-0x0000000004C21000-memory.dmp
memory/4120-6-0x0000000004B90000-0x0000000004C21000-memory.dmp
memory/4120-5-0x0000000004B90000-0x0000000004C21000-memory.dmp
memory/4120-4-0x0000000004B90000-0x0000000004C28000-memory.dmp
memory/4120-2-0x0000000004C60000-0x0000000004C70000-memory.dmp
memory/4120-3-0x0000000004A80000-0x0000000004B16000-memory.dmp
memory/4584-2841-0x0000000004310000-0x0000000004311000-memory.dmp
memory/4584-2842-0x00000000748C0000-0x0000000075070000-memory.dmp
memory/4584-2843-0x0000000004390000-0x00000000043A0000-memory.dmp
memory/4584-1908-0x0000000004390000-0x00000000043A0000-memory.dmp
memory/4584-1907-0x00000000748C0000-0x0000000075070000-memory.dmp
memory/4584-3788-0x00000000748C0000-0x0000000075070000-memory.dmp
memory/5144-949-0x0000000000400000-0x0000000000406000-memory.dmp