zgrat | 84c7debe3cb4532bff5d9b73600923aef456dc3dfbbb5dafb68fac8e982cff74

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
16/02/2024, 04:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3162918d4416f975209170513989207e.exe
Size 1.7MB
Sample240216-fa359aac89
SHA256 84c7debe3cb4532bff5d9b73600923aef456dc3dfbbb5dafb68fac8e982cff74
MD5 3162918d4416f975209170513989207e
SHA1 5f914a97870fe27cdcb4d385be53b9ab8dd7c4a2
SHA512 332b51f2e7c3b5276c834ecd5aa344b0ffa9feb726f3a77168860980c4e33dec994d5ab0e2787879d0c3317222e0f4b36ea5e911ca03027a692e51012e3332af
SSDEEP 49152:IBJpjmIoRr7wUqmA/qi9oVjlQtBvpVgVV:yDOr0DmJi9oVmtJc/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

zgrat rat spyware stealer

Malware Config

Signatures

Detect ZGRat V1 3 IoCs

resource	yara_rule
behavioral1/files/0x000c0000000144ac-9.dat	family_zgrat_v1
behavioral1/memory/2592-13-0x00000000000B0000-0x000000000028E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2272-49-0x00000000011F0000-0x00000000013CE000-memory.dmp	family_zgrat_v1

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2476	1660	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2520	1660	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2740	1660	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2996	1660	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1176	1660	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1324	1660	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3008	1660	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2512	1660	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2672	1660	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	1660	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1916	1660	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2496	1660	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2808	1660	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1240	1660	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2864	1660	schtasks.exe	32

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Executes dropped EXE 2 IoCs

pid	Process
2592	SurraogatefRefdll.exe
2272	System.exe

Loads dropped DLL 2 IoCs

pid	Process
1372	cmd.exe
1372	cmd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Vss\Writers\Application\27d1bcfc3c54e0	SurraogatefRefdll.exe
File created	C:\Windows\system\winlogon.exe	SurraogatefRefdll.exe
File created	C:\Windows\system\cc11b995f2a76d	SurraogatefRefdll.exe
File created	C:\Windows\Vss\Writers\Application\System.exe	SurraogatefRefdll.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2520	schtasks.exe
2740	schtasks.exe
1176	schtasks.exe
1240	schtasks.exe
2996	schtasks.exe
2476	schtasks.exe
2512	schtasks.exe
2672	schtasks.exe
1916	schtasks.exe
2496	schtasks.exe
2808	schtasks.exe
1324	schtasks.exe
3008	schtasks.exe
2712	schtasks.exe
2864	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2592	SurraogatefRefdll.exe
2272	System.exe
2272	System.exe
2272	System.exe
2272	System.exe
2272	System.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2272	System.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2592	SurraogatefRefdll.exe
Token: SeDebugPrivilege	2272	System.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2960	1720	3162918d4416f975209170513989207e.exe	28
PID 1720 wrote to memory of 2960	1720	3162918d4416f975209170513989207e.exe	28
PID 1720 wrote to memory of 2960	1720	3162918d4416f975209170513989207e.exe	28
PID 1720 wrote to memory of 2960	1720	3162918d4416f975209170513989207e.exe	28
PID 2960 wrote to memory of 1372	2960	WScript.exe	29
PID 2960 wrote to memory of 1372	2960	WScript.exe	29
PID 2960 wrote to memory of 1372	2960	WScript.exe	29
PID 2960 wrote to memory of 1372	2960	WScript.exe	29
PID 1372 wrote to memory of 2592	1372	cmd.exe	31
PID 1372 wrote to memory of 2592	1372	cmd.exe	31
PID 1372 wrote to memory of 2592	1372	cmd.exe	31
PID 1372 wrote to memory of 2592	1372	cmd.exe	31
PID 2592 wrote to memory of 1612	2592	SurraogatefRefdll.exe	48
PID 2592 wrote to memory of 1612	2592	SurraogatefRefdll.exe	48
PID 2592 wrote to memory of 1612	2592	SurraogatefRefdll.exe	48
PID 1612 wrote to memory of 3020	1612	cmd.exe	50
PID 1612 wrote to memory of 3020	1612	cmd.exe	50
PID 1612 wrote to memory of 3020	1612	cmd.exe	50
PID 1612 wrote to memory of 1652	1612	cmd.exe	51
PID 1612 wrote to memory of 1652	1612	cmd.exe	51
PID 1612 wrote to memory of 1652	1612	cmd.exe	51
PID 1612 wrote to memory of 2272	1612	cmd.exe	52
PID 1612 wrote to memory of 2272	1612	cmd.exe	52
PID 1612 wrote to memory of 2272	1612	cmd.exe	52

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\3162918d4416f975209170513989207e.exe
"C:\Users\Admin\AppData\Local\Temp\3162918d4416f975209170513989207e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\blockPortaserverfonztreview\4u39bgU8q5oBwBkV7hvzKofwBimA7SB9CiFfBGYXAMiLk1sJM.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\blockPortaserverfonztreview\ruXFMB.bat" "
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1372
  - - C:\blockPortaserverfonztreview\SurraogatefRefdll.exe
      "C:\blockPortaserverfonztreview/SurraogatefRefdll.exe"
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2592
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cQM4ZmSk6t.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1612
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:3020
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:1652
      - C:\Windows\Vss\Writers\Application\System.exe
        
        "C:\Windows\Vss\Writers\Application\System.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:2272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Windows\system\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\system\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Windows\system\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Windows\Vss\Writers\Application\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\Vss\Writers\Application\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Windows\Vss\Writers\Application\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cQM4ZmSk6t.bat

Path C:\Users\Admin\AppData\Local\Temp\cQM4ZmSk6t.bat
Size 221B
SHA256 23127373b8c8f1188ebff9e8f2b85a0544f97f1e8c6931fde4cff839fcf639df
MD5 9c98257b621610bac1325c949f309c56
SHA1 4428f3037c5d90664d3e9f90db54da1379c519df
SHA512 7e99d29286488235b09926a6fd775094475174faf040a70c1149053a2a5b1fbb8bf1472dfe1dacbd7a95b913192eed6eb68e02aa665859b9c56fac6f99e4d94a
MD5 SHA1 SHA512

Submit Download

4u39bgU8q5oBwBkV7hvzKofwBimA7SB9CiFfBGYXAMiLk1sJM.vbe

Path C:\blockPortaserverfonztreview\4u39bgU8q5oBwBkV7hvzKofwBimA7SB9CiFfBGYXAMiLk1sJM.vbe
Size 211B
SHA256 0ceb5ec6af33657e4da8f151e0fea295f36f9ca9dfa525e7f860b8cf2ecc9a2c
MD5 97e02e23fad1b8550419a4b29aeacef9
SHA1 71ebfa5155baa78dd2ecfb6b093dbadec2ad8e0f
SHA512 6f2a65815fe5bfb57c9452c2cee2b4134c2f52554441871ba53d1c77b057c4562ad1b485e384faf603c67c92805c6d16989a796898ba6fe6e31f2457ed5d091d
MD5 SHA1 SHA512

Submit Download

ruXFMB.bat

Path C:\blockPortaserverfonztreview\ruXFMB.bat
Size 111B
SHA256 02c9647400261add4896036459d216a3339dcb6f785bccf6789718674cef6827
MD5 fb84450149e175704bf31deeea1b7f41
SHA1 02023d5d1542be42e998e90915e00c9f7b6c65b7
SHA512 dcf85433ef6505e3b315812d7457f19a9a8e8bacb2cb9681f508e6ca25fde0f98987234f4cbd3816b66ba054f77c0d9bf3dcf716f3cc21e733e3d1d5b5336c2e
MD5 SHA1 SHA512

Submit Download

SurraogatefRefdll.exe

Path \blockPortaserverfonztreview\SurraogatefRefdll.exe
Size 1.8MB
SHA256 df9be42d3523ed084c0cbc16ce7674212f8c3a69637b8f8c986caabb5c1927fe
MD5 398b4cbd7572a2c5e8600faf0705c2af
SHA1 dc7155ceb86089d7718d98e6cca078664edece87
SHA512 1ea832001ce261576be424b35fa19689a0dd970138aff2e620aa5486d90eb4f5aca5b36ec4be92204de9dee01e9a04705c198dd300b3f48f99a243522c42abfb
SSDEEP 49152:sE76sDVfY6Hskfcqo6QEgJNd0QIiTIeIFXK8tU+WW:sE76sD6hkUb+POsXdU+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2272-62-0x0000000077710000-0x0000000077711000-memory.dmp

Download

memory/2272-59-0x0000000077720000-0x0000000077721000-memory.dmp

Download

memory/2272-65-0x000000001B450000-0x000000001B4D0000-memory.dmp

Download

memory/2272-64-0x000000001B450000-0x000000001B4D0000-memory.dmp

Download

memory/2272-83-0x000000001B450000-0x000000001B4D0000-memory.dmp

Download

memory/2272-63-0x000007FEF52A0000-0x000007FEF5C8C000-memory.dmp

Download

memory/2272-50-0x000007FEF52A0000-0x000007FEF5C8C000-memory.dmp

Download

memory/2272-66-0x000000001B450000-0x000000001B4D0000-memory.dmp

Download

memory/2272-58-0x0000000077730000-0x0000000077731000-memory.dmp

Download

memory/2272-55-0x000000001B450000-0x000000001B4D0000-memory.dmp

Download

memory/2272-54-0x0000000077740000-0x0000000077741000-memory.dmp

Download

memory/2272-53-0x000000001B450000-0x000000001B4D0000-memory.dmp

Download

memory/2272-52-0x0000000000240000-0x0000000000241000-memory.dmp

Download

memory/2272-84-0x000000001B450000-0x000000001B4D0000-memory.dmp

Download

memory/2272-51-0x000000001B450000-0x000000001B4D0000-memory.dmp

Download

memory/2272-49-0x00000000011F0000-0x00000000013CE000-memory.dmp

Download

memory/2592-18-0x0000000077740000-0x0000000077741000-memory.dmp

Download

memory/2592-46-0x000007FEF5C90000-0x000007FEF667C000-memory.dmp

Download

memory/2592-30-0x00000000003F0000-0x00000000003FC000-memory.dmp

Download

memory/2592-28-0x0000000077710000-0x0000000077711000-memory.dmp

Download

memory/2592-27-0x0000000077720000-0x0000000077721000-memory.dmp

Download

memory/2592-26-0x0000000000650000-0x0000000000668000-memory.dmp

Download

memory/2592-24-0x0000000077730000-0x0000000077731000-memory.dmp

Download

memory/2592-23-0x0000000000630000-0x000000000064C000-memory.dmp

Download

memory/2592-21-0x000000001B460000-0x000000001B4E0000-memory.dmp

Download

memory/2592-20-0x00000000003D0000-0x00000000003DE000-memory.dmp

Download

memory/2592-17-0x000000001B460000-0x000000001B4E0000-memory.dmp

Download

memory/2592-16-0x0000000000390000-0x0000000000391000-memory.dmp

Download

memory/2592-15-0x000000001B460000-0x000000001B4E0000-memory.dmp

Download

memory/2592-14-0x000007FEF5C90000-0x000007FEF667C000-memory.dmp

Download

memory/2592-13-0x00000000000B0000-0x000000000028E000-memory.dmp

Download