Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
09/02/2024, 15:37
General
- Target 702208b62f9db0aca6b28f47a7b402a7.exe
- Size 1.3MB
- Sample240209-s2ggsaec35
- SHA256 ddd3762a1f95e1f86b86a92e54f2d52b2e9b96499a6fdc07fab98813eeaca8a2
Malware Config
Signatures
- Detect ZGRat V1 37 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Downloads MZ/PE file
- Executes dropped EXE 4 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 7 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 43 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\702208b62f9db0aca6b28f47a7b402a7.exe"C:\Users\Admin\AppData\Local\Temp\702208b62f9db0aca6b28f47a7b402a7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\702208b62f9db0aca6b28f47a7b402a7.exeC:\Users\Admin\AppData\Local\Temp\702208b62f9db0aca6b28f47a7b402a7.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\IdentityReference\jioteiax\HostFile.exeC:\Users\Admin\AppData\Local\IdentityReference\jioteiax\HostFile.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\IdentityReference\jioteiax\HostFile.exeC:\Users\Admin\AppData\Local\IdentityReference\jioteiax\HostFile.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\bvliqzaz.exeC:\Users\Admin\AppData\Local\Temp\bvliqzaz.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bvliqzaz.exeC:\Users\Admin\AppData\Local\Temp\bvliqzaz.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
HostFile.exe
702208b62f9db0aca6b28f47a7b402a7.exe.log
bvliqzaz.exe.log
bvliqzaz.exe
bvliqzaz.exe
memory/1436-6310-0x00007FFE7AEA0000-0x00007FFE7B961000-memory.dmp
memory/1436-7250-0x00007FFE7AEA0000-0x00007FFE7B961000-memory.dmp
memory/1436-7244-0x000002C4F2190000-0x000002C4F2191000-memory.dmp
memory/1564-3160-0x00007FFE7AEA0000-0x00007FFE7B961000-memory.dmp
memory/1564-4093-0x000002604EA00000-0x000002604EA10000-memory.dmp
memory/1564-4094-0x0000026036050000-0x0000026036051000-memory.dmp
memory/1564-4098-0x00007FFE7AEA0000-0x00007FFE7B961000-memory.dmp
memory/1836-11720-0x000001FC5AA40000-0x000001FC5AA50000-memory.dmp
memory/1836-10601-0x00007FFE7AEA0000-0x00007FFE7B961000-memory.dmp
memory/1836-10602-0x000001FC5AA40000-0x000001FC5AA50000-memory.dmp
memory/1836-11718-0x000001FC591D0000-0x000001FC591D1000-memory.dmp
memory/1836-11719-0x00007FFE7AEA0000-0x00007FFE7B961000-memory.dmp
memory/1836-11726-0x00007FFE7AEA0000-0x00007FFE7B961000-memory.dmp
memory/1960-9462-0x000001C0F7610000-0x000001C0F775A000-memory.dmp
memory/1960-10596-0x00007FFE7AEA0000-0x00007FFE7B961000-memory.dmp
memory/1960-10586-0x00007FFE7AEA0000-0x00007FFE7B961000-memory.dmp
memory/1960-9463-0x000001C0F9C80000-0x000001C0F9DCA000-memory.dmp
memory/1960-9465-0x000001C0F9EE0000-0x000001C0F9FEA000-memory.dmp
memory/1960-10583-0x000001C0F9DD0000-0x000001C0F9EA2000-memory.dmp
memory/1960-10581-0x000001C0F9C70000-0x000001C0F9C80000-memory.dmp
memory/1960-10582-0x000001C0F7B00000-0x000001C0F7B01000-memory.dmp
memory/1960-9464-0x00007FFE7AEA0000-0x00007FFE7B961000-memory.dmp
memory/3352-10600-0x0000013E732D0000-0x0000013E732E0000-memory.dmp
memory/3352-10594-0x00007FFE7AEA0000-0x00007FFE7B961000-memory.dmp
memory/3352-10603-0x00007FFE7AEA0000-0x00007FFE7B961000-memory.dmp
memory/3352-10593-0x0000013E73A90000-0x0000013E73B92000-memory.dmp
memory/3352-10592-0x0000000000400000-0x00000000004B4000-memory.dmp
memory/3352-10598-0x0000013E73350000-0x0000013E733A6000-memory.dmp
memory/3352-10597-0x0000013E732C0000-0x0000013E732C8000-memory.dmp
memory/3352-10595-0x0000013E732D0000-0x0000013E732E0000-memory.dmp
memory/3984-7248-0x00007FFE7AEA0000-0x00007FFE7B961000-memory.dmp
memory/3984-7249-0x0000020EEF490000-0x0000020EEF4A0000-memory.dmp
memory/3984-10584-0x0000020EEF490000-0x0000020EEF4A0000-memory.dmp
memory/3984-9459-0x0000020EEF490000-0x0000020EEF4A0000-memory.dmp
memory/3984-10083-0x00007FFE7AEA0000-0x00007FFE7B961000-memory.dmp
memory/3984-10585-0x0000020EEF490000-0x0000020EEF4A0000-memory.dmp
memory/4744-11724-0x00007FFE7AEA0000-0x00007FFE7B961000-memory.dmp
memory/4744-11725-0x000001F332CF0000-0x000001F332D00000-memory.dmp
memory/4792-44-0x000001FCB9ED0000-0x000001FCB9FFD000-memory.dmp
memory/4792-22-0x000001FCB9ED0000-0x000001FCB9FFD000-memory.dmp
memory/4792-2-0x00007FFE7AEA0000-0x00007FFE7B961000-memory.dmp
memory/4792-1-0x000001FCB9ED0000-0x000001FCBA002000-memory.dmp
memory/4792-4-0x000001FCB9ED0000-0x000001FCB9FFD000-memory.dmp
memory/4792-3-0x000001FCB9ED0000-0x000001FCB9FFD000-memory.dmp
memory/4792-6-0x000001FCB9ED0000-0x000001FCB9FFD000-memory.dmp
memory/4792-8-0x000001FCB9ED0000-0x000001FCB9FFD000-memory.dmp
memory/4792-10-0x000001FCB9ED0000-0x000001FCB9FFD000-memory.dmp
memory/4792-12-0x000001FCB9ED0000-0x000001FCB9FFD000-memory.dmp
memory/4792-938-0x000001FCBA0D0000-0x000001FCBA11C000-memory.dmp
memory/4792-937-0x000001FCBA000000-0x000001FCBA0CA000-memory.dmp
memory/4792-14-0x000001FCB9ED0000-0x000001FCB9FFD000-memory.dmp
memory/4792-16-0x000001FCB9ED0000-0x000001FCB9FFD000-memory.dmp
memory/4792-18-0x000001FCB9ED0000-0x000001FCB9FFD000-memory.dmp
memory/4792-936-0x000001FC9FD10000-0x000001FC9FD11000-memory.dmp
memory/4792-20-0x000001FCB9ED0000-0x000001FCB9FFD000-memory.dmp
memory/4792-935-0x000001FC9FD00000-0x000001FC9FD10000-memory.dmp
memory/4792-54-0x000001FCB9ED0000-0x000001FCB9FFD000-memory.dmp
memory/4792-66-0x000001FCB9ED0000-0x000001FCB9FFD000-memory.dmp
memory/4792-64-0x000001FCB9ED0000-0x000001FCB9FFD000-memory.dmp
memory/4792-56-0x000001FCB9ED0000-0x000001FCB9FFD000-memory.dmp
memory/4792-62-0x000001FCB9ED0000-0x000001FCB9FFD000-memory.dmp
memory/4792-60-0x000001FCB9ED0000-0x000001FCB9FFD000-memory.dmp
memory/4792-58-0x000001FCB9ED0000-0x000001FCB9FFD000-memory.dmp
memory/4792-52-0x000001FCB9ED0000-0x000001FCB9FFD000-memory.dmp
memory/4792-50-0x000001FCB9ED0000-0x000001FCB9FFD000-memory.dmp
memory/4792-42-0x000001FCB9ED0000-0x000001FCB9FFD000-memory.dmp
memory/4792-48-0x000001FCB9ED0000-0x000001FCB9FFD000-memory.dmp
memory/4792-0-0x000001FC9F7D0000-0x000001FC9F91C000-memory.dmp
memory/4792-46-0x000001FCB9ED0000-0x000001FCB9FFD000-memory.dmp
memory/4792-40-0x000001FCB9ED0000-0x000001FCB9FFD000-memory.dmp
memory/4792-38-0x000001FCB9ED0000-0x000001FCB9FFD000-memory.dmp
memory/4792-36-0x000001FCB9ED0000-0x000001FCB9FFD000-memory.dmp
memory/4792-32-0x000001FCB9ED0000-0x000001FCB9FFD000-memory.dmp
memory/4792-34-0x000001FCB9ED0000-0x000001FCB9FFD000-memory.dmp
memory/4792-26-0x000001FCB9ED0000-0x000001FCB9FFD000-memory.dmp
memory/4792-28-0x000001FCB9ED0000-0x000001FCB9FFD000-memory.dmp
memory/4792-30-0x000001FCB9ED0000-0x000001FCB9FFD000-memory.dmp
memory/4792-24-0x000001FCB9ED0000-0x000001FCB9FFD000-memory.dmp
memory/4792-943-0x00007FFE7AEA0000-0x00007FFE7B961000-memory.dmp
memory/5012-6315-0x00007FFE7AEA0000-0x00007FFE7B961000-memory.dmp
memory/5012-6309-0x000001A339620000-0x000001A339630000-memory.dmp
memory/5012-4101-0x000001A339620000-0x000001A339630000-memory.dmp
memory/5012-4100-0x00007FFE7AEA0000-0x00007FFE7B961000-memory.dmp
memory/5024-942-0x0000000000400000-0x00000000004AA000-memory.dmp
memory/5024-945-0x00007FFE7AEA0000-0x00007FFE7B961000-memory.dmp
memory/5024-944-0x000001D67A8B0000-0x000001D67A996000-memory.dmp
memory/5024-3157-0x00007FFE7AEA0000-0x00007FFE7B961000-memory.dmp
memory/5024-3155-0x000001D67AC90000-0x000001D67ACE4000-memory.dmp
memory/5024-3154-0x000001D67A9A0000-0x000001D67A9F6000-memory.dmp
memory/5024-3153-0x000001D679FD0000-0x000001D679FD8000-memory.dmp
memory/5024-946-0x000001D67AA80000-0x000001D67AA90000-memory.dmp