Analysis
- max time kernel
155s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
05/02/2024, 17:04
General
- Target tmp.exe
- Size 692KB
- Sample240205-vld3tscff4
- SHA256 860318a9982e93b8833e68bef2e4d70d81ed06747571ffb9312dacf4a2ae2855
Malware Config
Extracted
-
systembc
-
69.10.60.115:4018
Signatures
- Detect ZGRat V1 34 IoCs
- SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
- ZGRat
ZGRat is remote access trojan written in C#.
- Downloads MZ/PE file
- Executes dropped EXE 3 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Drops file in System32 directory 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Drops file in Windows directory 2 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exeC:\Users\Admin\AppData\Local\Temp\tmp.exe2⤵
- Adds Run key to start application
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\dpuo.exeC:\Users\Admin\AppData\Local\Temp\dpuo.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dpuo.exeC:\Users\Admin\AppData\Local\Temp\dpuo.exe2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
-
C:\Users\Admin\AppData\Local\Temp\dpuo.exeC:\Users\Admin\AppData\Local\Temp\dpuo.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
dpuo.exe
dpuo.exe.log
memory/1108-956-0x00000000743D0000-0x0000000074B80000-memory.dmp
memory/1108-1889-0x0000000003A60000-0x0000000003A70000-memory.dmp
memory/1108-1890-0x0000000003BB0000-0x0000000003BB1000-memory.dmp
memory/1108-1899-0x00000000743D0000-0x0000000074B80000-memory.dmp
memory/1108-1892-0x0000000003A60000-0x0000000003A70000-memory.dmp
memory/1108-1891-0x00000000743D0000-0x0000000074B80000-memory.dmp
memory/1732-1905-0x0000000074B40000-0x00000000752F0000-memory.dmp
memory/2380-948-0x0000000000400000-0x0000000000406000-memory.dmp
memory/2580-38-0x0000000005450000-0x00000000054E1000-memory.dmp
memory/2580-48-0x0000000005450000-0x00000000054E1000-memory.dmp
memory/2580-10-0x0000000005450000-0x00000000054E1000-memory.dmp
memory/2580-12-0x0000000005450000-0x00000000054E1000-memory.dmp
memory/2580-14-0x0000000005450000-0x00000000054E1000-memory.dmp
memory/2580-16-0x0000000005450000-0x00000000054E1000-memory.dmp
memory/2580-18-0x0000000005450000-0x00000000054E1000-memory.dmp
memory/2580-20-0x0000000005450000-0x00000000054E1000-memory.dmp
memory/2580-22-0x0000000005450000-0x00000000054E1000-memory.dmp
memory/2580-24-0x0000000005450000-0x00000000054E1000-memory.dmp
memory/2580-26-0x0000000005450000-0x00000000054E1000-memory.dmp
memory/2580-28-0x0000000005450000-0x00000000054E1000-memory.dmp
memory/2580-30-0x0000000005450000-0x00000000054E1000-memory.dmp
memory/2580-32-0x0000000005450000-0x00000000054E1000-memory.dmp
memory/2580-34-0x0000000005450000-0x00000000054E1000-memory.dmp
memory/2580-36-0x0000000005450000-0x00000000054E1000-memory.dmp
memory/2580-6-0x0000000005450000-0x00000000054E1000-memory.dmp
memory/2580-40-0x0000000005450000-0x00000000054E1000-memory.dmp
memory/2580-42-0x0000000005450000-0x00000000054E1000-memory.dmp
memory/2580-44-0x0000000005450000-0x00000000054E1000-memory.dmp
memory/2580-46-0x0000000005450000-0x00000000054E1000-memory.dmp
memory/2580-8-0x0000000005450000-0x00000000054E1000-memory.dmp
memory/2580-50-0x0000000005450000-0x00000000054E1000-memory.dmp
memory/2580-52-0x0000000005450000-0x00000000054E1000-memory.dmp
memory/2580-54-0x0000000005450000-0x00000000054E1000-memory.dmp
memory/2580-56-0x0000000005450000-0x00000000054E1000-memory.dmp
memory/2580-58-0x0000000005450000-0x00000000054E1000-memory.dmp
memory/2580-60-0x0000000005450000-0x00000000054E1000-memory.dmp
memory/2580-62-0x0000000005450000-0x00000000054E1000-memory.dmp
memory/2580-64-0x0000000005450000-0x00000000054E1000-memory.dmp
memory/2580-66-0x0000000005450000-0x00000000054E1000-memory.dmp
memory/2580-935-0x0000000005570000-0x0000000005580000-memory.dmp
memory/2580-936-0x0000000005520000-0x0000000005521000-memory.dmp
memory/2580-937-0x00000000055A0000-0x00000000055CE000-memory.dmp
memory/2580-938-0x00000000055D0000-0x000000000561C000-memory.dmp
memory/2580-4-0x0000000005450000-0x00000000054E1000-memory.dmp
memory/2580-3-0x0000000005450000-0x00000000054E1000-memory.dmp
memory/2580-2-0x0000000005450000-0x00000000054E8000-memory.dmp
memory/2580-1-0x0000000000910000-0x00000000009C4000-memory.dmp
memory/2580-0-0x0000000074B00000-0x00000000752B0000-memory.dmp
memory/2580-939-0x0000000074B00000-0x00000000752B0000-memory.dmp
memory/2580-940-0x0000000005570000-0x0000000005580000-memory.dmp
memory/2580-941-0x0000000005FB0000-0x0000000006554000-memory.dmp
memory/2580-949-0x0000000074B00000-0x00000000752B0000-memory.dmp