Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
13-02-2024 02:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exe
Resource
win7-20231215-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exe
-
Size
8.8MB
-
MD5
0bba32660d3323f8cdf71a4b2ae25738
-
SHA1
48ad23aa2767d45fd51c00ee165cef4dd1f9e7ae
-
SHA256
0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad
-
SHA512
535ad86843a0a1807117e7cd059bc6565fa20685aa0a14ded789e6df42f0467242fbb85cf7b17a5e98eb3c9ba34c46b4b9fa65350c6730092e905bef9f6738c5
-
SSDEEP
196608:ymfI8mgWLU16Uwg55LasSW4yIK1ni4+YW/3T9xU:ykmlw4mL/SNKdPMbU
Score
10/10
Malware Config
Signatures
-
Detect ZGRat V1 34 IoCs
resource yara_rule behavioral2/memory/2456-3-0x00000178FD0C0000-0x00000178FD984000-memory.dmp family_zgrat_v1 behavioral2/memory/2456-4-0x00000178FD0C0000-0x00000178FD97E000-memory.dmp family_zgrat_v1 behavioral2/memory/2456-5-0x00000178FD0C0000-0x00000178FD97E000-memory.dmp family_zgrat_v1 behavioral2/memory/2456-7-0x00000178FD0C0000-0x00000178FD97E000-memory.dmp family_zgrat_v1 behavioral2/memory/2456-9-0x00000178FD0C0000-0x00000178FD97E000-memory.dmp family_zgrat_v1 behavioral2/memory/2456-11-0x00000178FD0C0000-0x00000178FD97E000-memory.dmp family_zgrat_v1 behavioral2/memory/2456-13-0x00000178FD0C0000-0x00000178FD97E000-memory.dmp family_zgrat_v1 behavioral2/memory/2456-15-0x00000178FD0C0000-0x00000178FD97E000-memory.dmp family_zgrat_v1 behavioral2/memory/2456-17-0x00000178FD0C0000-0x00000178FD97E000-memory.dmp family_zgrat_v1 behavioral2/memory/2456-19-0x00000178FD0C0000-0x00000178FD97E000-memory.dmp family_zgrat_v1 behavioral2/memory/2456-21-0x00000178FD0C0000-0x00000178FD97E000-memory.dmp family_zgrat_v1 behavioral2/memory/2456-23-0x00000178FD0C0000-0x00000178FD97E000-memory.dmp family_zgrat_v1 behavioral2/memory/2456-25-0x00000178FD0C0000-0x00000178FD97E000-memory.dmp family_zgrat_v1 behavioral2/memory/2456-27-0x00000178FD0C0000-0x00000178FD97E000-memory.dmp family_zgrat_v1 behavioral2/memory/2456-29-0x00000178FD0C0000-0x00000178FD97E000-memory.dmp family_zgrat_v1 behavioral2/memory/2456-31-0x00000178FD0C0000-0x00000178FD97E000-memory.dmp family_zgrat_v1 behavioral2/memory/2456-33-0x00000178FD0C0000-0x00000178FD97E000-memory.dmp family_zgrat_v1 behavioral2/memory/2456-35-0x00000178FD0C0000-0x00000178FD97E000-memory.dmp family_zgrat_v1 behavioral2/memory/2456-37-0x00000178FD0C0000-0x00000178FD97E000-memory.dmp family_zgrat_v1 behavioral2/memory/2456-39-0x00000178FD0C0000-0x00000178FD97E000-memory.dmp family_zgrat_v1 behavioral2/memory/2456-41-0x00000178FD0C0000-0x00000178FD97E000-memory.dmp family_zgrat_v1 behavioral2/memory/2456-45-0x00000178FD0C0000-0x00000178FD97E000-memory.dmp family_zgrat_v1 behavioral2/memory/2456-43-0x00000178FD0C0000-0x00000178FD97E000-memory.dmp family_zgrat_v1 behavioral2/memory/2456-47-0x00000178FD0C0000-0x00000178FD97E000-memory.dmp family_zgrat_v1 behavioral2/memory/2456-49-0x00000178FD0C0000-0x00000178FD97E000-memory.dmp family_zgrat_v1 behavioral2/memory/2456-51-0x00000178FD0C0000-0x00000178FD97E000-memory.dmp family_zgrat_v1 behavioral2/memory/2456-53-0x00000178FD0C0000-0x00000178FD97E000-memory.dmp family_zgrat_v1 behavioral2/memory/2456-55-0x00000178FD0C0000-0x00000178FD97E000-memory.dmp family_zgrat_v1 behavioral2/memory/2456-57-0x00000178FD0C0000-0x00000178FD97E000-memory.dmp family_zgrat_v1 behavioral2/memory/2456-59-0x00000178FD0C0000-0x00000178FD97E000-memory.dmp family_zgrat_v1 behavioral2/memory/2456-61-0x00000178FD0C0000-0x00000178FD97E000-memory.dmp family_zgrat_v1 behavioral2/memory/2456-63-0x00000178FD0C0000-0x00000178FD97E000-memory.dmp family_zgrat_v1 behavioral2/memory/2456-65-0x00000178FD0C0000-0x00000178FD97E000-memory.dmp family_zgrat_v1 behavioral2/memory/2456-67-0x00000178FD0C0000-0x00000178FD97E000-memory.dmp family_zgrat_v1 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation 0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Vdtiytdlsgj = "C:\\Users\\Admin\\AppData\\Roaming\\Vdtiytdlsgj.exe" 0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\MRT.exe 0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2456 set thread context of 3304 2456 0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exe 94 PID 3304 set thread context of 1488 3304 0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exe 97 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4780 powershell.exe 4780 powershell.exe 3304 0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exe 3024 powershell.exe 3024 powershell.exe 3304 0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exe 3304 0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2456 0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exe Token: SeDebugPrivilege 4780 powershell.exe Token: SeDebugPrivilege 3024 powershell.exe Token: SeLockMemoryPrivilege 1488 explorer.exe Token: SeLockMemoryPrivilege 1488 explorer.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 2456 wrote to memory of 4780 2456 0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exe 87 PID 2456 wrote to memory of 4780 2456 0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exe 87 PID 2456 wrote to memory of 3304 2456 0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exe 94 PID 2456 wrote to memory of 3304 2456 0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exe 94 PID 2456 wrote to memory of 3304 2456 0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exe 94 PID 2456 wrote to memory of 3304 2456 0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exe 94 PID 2456 wrote to memory of 3304 2456 0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exe 94 PID 2456 wrote to memory of 3304 2456 0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exe 94 PID 2456 wrote to memory of 3304 2456 0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exe 94 PID 2456 wrote to memory of 3304 2456 0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exe 94 PID 2456 wrote to memory of 3304 2456 0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exe 94 PID 2456 wrote to memory of 3304 2456 0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exe 94 PID 2456 wrote to memory of 3304 2456 0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exe 94 PID 4908 wrote to memory of 4520 4908 cmd.exe 98 PID 4908 wrote to memory of 4520 4908 cmd.exe 98 PID 3304 wrote to memory of 1488 3304 0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exe 97 PID 3304 wrote to memory of 1488 3304 0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exe 97 PID 3304 wrote to memory of 1488 3304 0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exe 97 PID 3304 wrote to memory of 1488 3304 0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exe 97 PID 3304 wrote to memory of 1488 3304 0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exe 97 PID 3304 wrote to memory of 1488 3304 0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exe 97 PID 3304 wrote to memory of 1488 3304 0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exe 97 PID 3304 wrote to memory of 1488 3304 0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exe 97 PID 3304 wrote to memory of 1488 3304 0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exe 97 PID 3304 wrote to memory of 1488 3304 0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exe 97 PID 3304 wrote to memory of 1488 3304 0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exe 97 PID 3304 wrote to memory of 1488 3304 0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exe"C:\Users\Admin\AppData\Local\Temp\0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMAA4ADEANwBjAGYAMwA0AGIAMABkAGQANwBiAGUAYwA3ADMAOAA4ADEANQA5AGEAYwA5AGIANgBhADEANgBhAGMANwA4ADkAOABjAGYAMgA0ADMAYwAwADAAOQAwAGQAOQAzADUAYgBmADgAOQAyADQANwAyADkANAAzAGEAZAAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAMAA4ADEANwBjAGYAMwA0AGIAMABkAGQANwBiAGUAYwA3ADMAOAA4ADEANQA5AGEAYwA5AGIANgBhADEANgBhAGMANwA4ADkAOABjAGYAMgA0ADMAYwAwADAAOQAwAGQAOQAzADUAYgBmADgAOQAyADQANwAyADkANAAzAGEAZAAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAVgBkAHQAaQB5AHQAZABsAHMAZwBqAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABWAGQAdABpAHkAdABkAGwAcwBnAGoALgBlAHgAZQA=2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4780
-
-
C:\Users\Admin\AppData\Local\Temp\0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exeC:\Users\Admin\AppData\Local\Temp\0817cf34b0dd7bec7388159ac9b6a16ac7898cf243c0090d935bf892472943ad.exe2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3024
-
-
C:\Windows\explorer.exeexplorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1488
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart3⤵
- Suspicious use of WriteProcessMemory
PID:4908
-
-
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart1⤵PID:4520
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82