Overview

overview

10

Static

static

10

xone.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    xone.exe

  • Size

    2.1MB

  • Sample

    240308-twl1rabf94

  • MD5

    9fafa70510322de8516d8f59aa30c499

  • SHA1

    be43d0f2c29898c4a748df955390bb3f892755cd

  • SHA256

    f2ae5ae9670add7474b7f3e3106bb0a4058085584d48f921dd542aab708232a5

  • SHA512

    78c7cf4726baa0d601083b65ccac6225f40b69ed82d4b78b67ae1d3f6b15657c6dea632d8554f5fefdebe8f543d43659f2b122bee639411bec30b97e4dc4820d

  • SSDEEP

    24576:STbBv5rUVNy+O8bJJymZUUmZiT2xo+1tbqGBEDhdFKjN05xaFxSdET0VDhSBA17l:0Bp+3yr4+1NqGyVSN0x2ot77ZeohWYv

Score
10/10
zgratpersistencerat

Malware Config

Targets

    • Target

      xone.exe

    • Size

      2.1MB

    • MD5

      9fafa70510322de8516d8f59aa30c499

    • SHA1

      be43d0f2c29898c4a748df955390bb3f892755cd

    • SHA256

      f2ae5ae9670add7474b7f3e3106bb0a4058085584d48f921dd542aab708232a5

    • SHA512

      78c7cf4726baa0d601083b65ccac6225f40b69ed82d4b78b67ae1d3f6b15657c6dea632d8554f5fefdebe8f543d43659f2b122bee639411bec30b97e4dc4820d

    • SSDEEP

      24576:STbBv5rUVNy+O8bJJymZUUmZiT2xo+1tbqGBEDhdFKjN05xaFxSdET0VDhSBA17l:0Bp+3yr4+1NqGyVSN0x2ot77ZeohWYv

    Score
    10/10
    zgratpersistencerat

    • Detect ZGRat V1

    • Modifies WinLogon for persistence

      persistence

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks