Analysis
- max time kernel
145s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
30/01/2024, 04:02
General
- Target file.exe
- Size 667KB
- Sample240130-elscfshdbj
- SHA256 0e9bea8429cee4efcd30dfcdb52c7e043caddf235406bc96dddce309502340dc
Malware Config
Extracted
-
systembc
-
69.10.60.115:4018
Signatures
- Detect ZGRat V1 35 IoCs
- SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
- ZGRat
ZGRat is remote access trojan written in C#.
- Downloads MZ/PE file
- Executes dropped EXE 5 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Drops file in System32 directory 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Drops file in Windows directory 4 IoCs
- Modifies data under HKEY_USERS 5 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 27 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\file.exeC:\Users\Admin\AppData\Local\Temp\file.exe2⤵
- Adds Run key to start application
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\vidsl.exeC:\Users\Admin\AppData\Local\Temp\vidsl.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vidsl.exeC:\Users\Admin\AppData\Local\Temp\vidsl.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
-
C:\Users\Admin\AppData\Local\Temp\vidsl.exeC:\Users\Admin\AppData\Local\Temp\vidsl.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vidsl.exeC:\Users\Admin\AppData\Local\Temp\vidsl.exe2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
-
C:\Windows\TEMP\doctl.exeC:\Windows\TEMP\doctl.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
vidsl.exe
vidsl.exe.log
memory/800-3788-0x0000000001890000-0x0000000001891000-memory.dmp
memory/800-2855-0x00000000018C0000-0x00000000018D0000-memory.dmp
memory/800-2854-0x0000000075270000-0x0000000075A20000-memory.dmp
memory/1200-56-0x0000000004FF0000-0x0000000005081000-memory.dmp
memory/1200-938-0x0000000005120000-0x000000000514E000-memory.dmp
memory/1200-8-0x0000000004FF0000-0x0000000005081000-memory.dmp
memory/1200-14-0x0000000004FF0000-0x0000000005081000-memory.dmp
memory/1200-20-0x0000000004FF0000-0x0000000005081000-memory.dmp
memory/1200-22-0x0000000004FF0000-0x0000000005081000-memory.dmp
memory/1200-24-0x0000000004FF0000-0x0000000005081000-memory.dmp
memory/1200-18-0x0000000004FF0000-0x0000000005081000-memory.dmp
memory/1200-16-0x0000000004FF0000-0x0000000005081000-memory.dmp
memory/1200-12-0x0000000004FF0000-0x0000000005081000-memory.dmp
memory/1200-10-0x0000000004FF0000-0x0000000005081000-memory.dmp
memory/1200-6-0x0000000004FF0000-0x0000000005081000-memory.dmp
memory/1200-26-0x0000000004FF0000-0x0000000005081000-memory.dmp
memory/1200-5-0x0000000004FF0000-0x0000000005081000-memory.dmp
memory/1200-30-0x0000000004FF0000-0x0000000005081000-memory.dmp
memory/1200-36-0x0000000004FF0000-0x0000000005081000-memory.dmp
memory/1200-34-0x0000000004FF0000-0x0000000005081000-memory.dmp
memory/1200-38-0x0000000004FF0000-0x0000000005081000-memory.dmp
memory/1200-42-0x0000000004FF0000-0x0000000005081000-memory.dmp
memory/1200-48-0x0000000004FF0000-0x0000000005081000-memory.dmp
memory/1200-46-0x0000000004FF0000-0x0000000005081000-memory.dmp
memory/1200-44-0x0000000004FF0000-0x0000000005081000-memory.dmp
memory/1200-40-0x0000000004FF0000-0x0000000005081000-memory.dmp
memory/1200-50-0x0000000004FF0000-0x0000000005081000-memory.dmp
memory/1200-58-0x0000000004FF0000-0x0000000005081000-memory.dmp
memory/1200-60-0x0000000004FF0000-0x0000000005081000-memory.dmp
memory/1200-62-0x0000000004FF0000-0x0000000005081000-memory.dmp
memory/1200-3-0x0000000004EC0000-0x0000000004F56000-memory.dmp
memory/1200-68-0x0000000004FF0000-0x0000000005081000-memory.dmp
memory/1200-66-0x0000000004FF0000-0x0000000005081000-memory.dmp
memory/1200-4-0x0000000004FF0000-0x0000000005088000-memory.dmp
memory/1200-64-0x0000000004FF0000-0x0000000005081000-memory.dmp
memory/1200-2-0x0000000004F70000-0x0000000004F80000-memory.dmp
memory/1200-32-0x0000000004FF0000-0x0000000005081000-memory.dmp
memory/1200-28-0x0000000004FF0000-0x0000000005081000-memory.dmp
memory/1200-937-0x00000000050B0000-0x00000000050B1000-memory.dmp
memory/1200-54-0x0000000004FF0000-0x0000000005081000-memory.dmp
memory/1200-939-0x0000000005150000-0x000000000519C000-memory.dmp
memory/1200-940-0x0000000075230000-0x00000000759E0000-memory.dmp
memory/1200-941-0x0000000004F70000-0x0000000004F80000-memory.dmp
memory/1200-942-0x0000000005B50000-0x00000000060F4000-memory.dmp
memory/1200-949-0x0000000075230000-0x00000000759E0000-memory.dmp
memory/1200-1-0x0000000000520000-0x00000000005CE000-memory.dmp
memory/1200-0-0x0000000075230000-0x00000000759E0000-memory.dmp
memory/1200-52-0x0000000004FF0000-0x0000000005081000-memory.dmp
memory/2204-3793-0x0000000075270000-0x0000000075A20000-memory.dmp
memory/2204-2847-0x0000000075270000-0x0000000075A20000-memory.dmp
memory/2204-1912-0x0000000075270000-0x0000000075A20000-memory.dmp
memory/2204-2846-0x0000000003940000-0x0000000003941000-memory.dmp
memory/2204-1913-0x0000000003710000-0x0000000003720000-memory.dmp
memory/2204-2848-0x0000000003710000-0x0000000003720000-memory.dmp
memory/4212-950-0x0000000000400000-0x0000000000406000-memory.dmp
memory/5008-960-0x0000000003C50000-0x0000000003C60000-memory.dmp
memory/5008-957-0x0000000000640000-0x00000000006EE000-memory.dmp
memory/5008-1894-0x0000000003C30000-0x0000000003C31000-memory.dmp
memory/5008-961-0x0000000003CD0000-0x0000000003D68000-memory.dmp
memory/5008-958-0x0000000074B00000-0x00000000752B0000-memory.dmp
memory/5008-959-0x0000000003B70000-0x0000000003C06000-memory.dmp
memory/5008-1895-0x0000000003DC0000-0x0000000003DEE000-memory.dmp
memory/5008-1898-0x0000000074B00000-0x00000000752B0000-memory.dmp
memory/5008-1899-0x0000000003C50000-0x0000000003C60000-memory.dmp
memory/5008-1906-0x0000000074B00000-0x00000000752B0000-memory.dmp