Analysis
- max time kernel
145s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
16/02/2024, 04:41
General
- Target 3162918d4416f975209170513989207e.exe
- Size 1.7MB
- Sample240216-fa359aac89
- SHA256 84c7debe3cb4532bff5d9b73600923aef456dc3dfbbb5dafb68fac8e982cff74
Malware Config
Signatures
- Detect ZGRat V1 2 IoCs
- Process spawned unexpected child process 15 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- ZGRat
ZGRat is remote access trojan written in C#.
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 4 IoCs
- Drops file in Windows directory 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 15 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3162918d4416f975209170513989207e.exe"C:\Users\Admin\AppData\Local\Temp\3162918d4416f975209170513989207e.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\blockPortaserverfonztreview\4u39bgU8q5oBwBkV7hvzKofwBimA7SB9CiFfBGYXAMiLk1sJM.vbe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\blockPortaserverfonztreview\ruXFMB.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\blockPortaserverfonztreview\SurraogatefRefdll.exe"C:\blockPortaserverfonztreview/SurraogatefRefdll.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ck2FpNZH2A.bat"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650016⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵
-
-
C:\Windows\Tasks\RuntimeBroker.exe"C:\Windows\Tasks\RuntimeBroker.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Documents\My Music\sihost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\Public\Documents\My Music\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Documents\My Music\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Windows\Tasks\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Tasks\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Windows\Tasks\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Windows\Tasks\StartMenuExperienceHost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\Tasks\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Windows\Tasks\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Portable Devices\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Portable Devices\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
ck2FpNZH2A.bat
4u39bgU8q5oBwBkV7hvzKofwBimA7SB9CiFfBGYXAMiLk1sJM.vbe
SurraogatefRefdll.exe
ruXFMB.bat
memory/1564-28-0x00007FFFDC610000-0x00007FFFDC611000-memory.dmp
memory/1564-47-0x00007FFFDCEB0000-0x00007FFFDCF6E000-memory.dmp
memory/1564-14-0x00000000013A0000-0x00000000013A1000-memory.dmp
memory/1564-16-0x000000001B780000-0x000000001B790000-memory.dmp
memory/1564-18-0x0000000002B40000-0x0000000002B4E000-memory.dmp
memory/1564-19-0x00007FFFDCEB0000-0x00007FFFDCF6E000-memory.dmp
memory/1564-21-0x000000001B780000-0x000000001B790000-memory.dmp
memory/1564-20-0x00007FFFDCEA0000-0x00007FFFDCEA1000-memory.dmp
memory/1564-24-0x00007FFFDC620000-0x00007FFFDC621000-memory.dmp
memory/1564-23-0x0000000002BD0000-0x0000000002BEC000-memory.dmp
memory/1564-25-0x000000001B720000-0x000000001B770000-memory.dmp
memory/1564-27-0x0000000002BF0000-0x0000000002C08000-memory.dmp
memory/1564-13-0x00007FFFBF1F0000-0x00007FFFBFCB1000-memory.dmp
memory/1564-31-0x00007FFFDC600000-0x00007FFFDC601000-memory.dmp
memory/1564-30-0x0000000002B60000-0x0000000002B6C000-memory.dmp
memory/1564-15-0x000000001B780000-0x000000001B790000-memory.dmp
memory/1564-49-0x00007FFFBF1F0000-0x00007FFFBFCB1000-memory.dmp
memory/1564-12-0x00000000008A0000-0x0000000000A7E000-memory.dmp
memory/2380-53-0x00007FFFBF080000-0x00007FFFBFB41000-memory.dmp
memory/2380-54-0x000000001AFB0000-0x000000001AFB1000-memory.dmp
memory/2380-55-0x00007FFFDCEB0000-0x00007FFFDCF6E000-memory.dmp
memory/2380-57-0x00007FFFDCEA0000-0x00007FFFDCEA1000-memory.dmp
memory/2380-58-0x00007FFFDCEB0000-0x00007FFFDCF6E000-memory.dmp
memory/2380-60-0x00007FFFDC620000-0x00007FFFDC621000-memory.dmp
memory/2380-61-0x00007FFFDC610000-0x00007FFFDC611000-memory.dmp
memory/2380-64-0x00007FFFDC600000-0x00007FFFDC601000-memory.dmp
memory/2380-65-0x00007FFFBF080000-0x00007FFFBFB41000-memory.dmp
memory/2380-66-0x000000001AFE0000-0x000000001AFE8000-memory.dmp
memory/2380-67-0x00007FFFDCEB0000-0x00007FFFDCF6E000-memory.dmp