Analysis
- max time kernel
145s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
05/02/2024, 14:48
General
- Target file.exe
- Size 5.1MB
- Sample240205-r6f65sade3
- SHA256 a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13
Malware Config
Signatures
- Detect ZGRat V1 1 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty-Path'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'-Name'Automating_the_cleaning_actionsApp';New-ItemProperty-Path'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'-Name'Automating_the_cleaning_actionsApp' -Value '"C:\Users\Admin\AppData\Local\Automating_the_cleaning_actionsApp\Automating_the_cleaning_actionsApp.exe"' -PropertyType 'String'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 11322⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4704 -ip 47041⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
Protect544cd51a.dll
__PSScriptPolicyTest_sgjxj0br.xig.ps1
memory/2804-33-0x00000000057B0000-0x0000000005816000-memory.dmp
memory/2804-44-0x0000000005DD0000-0x0000000005DEE000-memory.dmp
memory/2804-43-0x0000000005820000-0x0000000005B74000-memory.dmp
memory/2804-45-0x0000000005E10000-0x0000000005E5C000-memory.dmp
memory/2804-26-0x00000000024B0000-0x00000000024E6000-memory.dmp
memory/2804-31-0x0000000004F00000-0x0000000004F22000-memory.dmp
memory/2804-32-0x00000000056D0000-0x0000000005736000-memory.dmp
memory/2804-27-0x0000000074690000-0x0000000074E40000-memory.dmp
memory/2804-28-0x0000000004FA0000-0x00000000055C8000-memory.dmp
memory/2804-29-0x0000000002600000-0x0000000002610000-memory.dmp
memory/2804-49-0x0000000074690000-0x0000000074E40000-memory.dmp
memory/2804-30-0x0000000002600000-0x0000000002610000-memory.dmp
memory/4372-22-0x0000000000400000-0x000000000040E000-memory.dmp
memory/4704-8-0x0000000005CE0000-0x0000000005CF0000-memory.dmp
memory/4704-9-0x00000000061C0000-0x0000000006352000-memory.dmp
memory/4704-20-0x0000000005CE0000-0x0000000005CF0000-memory.dmp
memory/4704-17-0x0000000005CE0000-0x0000000005CF0000-memory.dmp
memory/4704-21-0x0000000006D10000-0x0000000006E10000-memory.dmp
memory/4704-19-0x0000000005CE0000-0x0000000005CF0000-memory.dmp
memory/4704-18-0x0000000005CE0000-0x0000000005CF0000-memory.dmp
memory/4704-14-0x0000000005CE0000-0x0000000005CF0000-memory.dmp
memory/4704-15-0x0000000005CE0000-0x0000000005CF0000-memory.dmp
memory/4704-23-0x0000000006FB0000-0x0000000007042000-memory.dmp
memory/4704-0-0x0000000074690000-0x0000000074E40000-memory.dmp
memory/4704-7-0x0000000074690000-0x0000000074E40000-memory.dmp
memory/4704-16-0x0000000006180000-0x0000000006190000-memory.dmp
memory/4704-6-0x0000000005A90000-0x0000000005A98000-memory.dmp
memory/4704-5-0x00000000063E0000-0x0000000006984000-memory.dmp
memory/4704-3-0x0000000005A50000-0x0000000005A6A000-memory.dmp
memory/4704-4-0x0000000005CE0000-0x0000000005CF0000-memory.dmp
memory/4704-2-0x0000000005AA0000-0x0000000005B3C000-memory.dmp
memory/4704-46-0x0000000074690000-0x0000000074E40000-memory.dmp
memory/4704-1-0x0000000000D00000-0x0000000001214000-memory.dmp