Analysis
- max time kernel
195s - max time network
205s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
15/03/2024, 22:22
General
- Target cc67adca18aa492545571dd5c02ec4e9.exe
- Size 613KB
- Sample240315-2ablwscd8s
- SHA256 28184c88216897491c60fc75dbd6bd99a2f436a5cf8c7f4322f10d2245b4dba5
Malware Config
Extracted
-
nanocore
-
1.2.2.0
-
bohemiabenz.ddns.net:6060
-
127.0.0.1:6060
-
f21340ca-f3ab-4839-83a8-c9e6c48024b3
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
-
backup_dns_server
37.235.1.177
-
buffer_size
65535
-
build_time
2021-06-01T10:13:43.746606036Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
6060
-
default_group
HYDROGEN
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
f21340ca-f3ab-4839-83a8-c9e6c48024b3
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
bohemiabenz.ddns.net
-
primary_dns_server
37.235.1.174
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
- Detect ZGRat V1 34 IoCs
- NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
- ZGRat
ZGRat is remote access trojan written in C#.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Program Files directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc67adca18aa492545571dd5c02ec4e9.exe"C:\Users\Admin\AppData\Local\Temp\cc67adca18aa492545571dd5c02ec4e9.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Oulukktmhwezyrksfvt.vbs"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\200chrome.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\RegAsm.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\RegAsm.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
RegAsm.exe
_Oulukktmhwezyrksfvt.vbs
__PSScriptPolicyTest_3peh3msa.isn.ps1
memory/956-2530-0x0000000074630000-0x0000000074DE0000-memory.dmp
memory/956-2475-0x0000000000400000-0x0000000000438000-memory.dmp
memory/956-2477-0x0000000074630000-0x0000000074DE0000-memory.dmp
memory/956-2478-0x0000000005260000-0x00000000052FC000-memory.dmp
memory/956-2484-0x0000000005240000-0x000000000524A000-memory.dmp
memory/956-2485-0x00000000055D0000-0x00000000055EE000-memory.dmp
memory/956-2487-0x0000000005740000-0x000000000574A000-memory.dmp
memory/2840-2520-0x0000000006E50000-0x0000000006E5A000-memory.dmp
memory/2840-2494-0x0000000004D90000-0x0000000004DF6000-memory.dmp
memory/2840-2517-0x0000000006CA0000-0x0000000006D43000-memory.dmp
memory/2840-2516-0x0000000006080000-0x000000000609E000-memory.dmp
memory/2840-2506-0x00000000707F0000-0x000000007083C000-memory.dmp
memory/2840-2505-0x00000000060A0000-0x00000000060D2000-memory.dmp
memory/2840-2504-0x000000007F4C0000-0x000000007F4D0000-memory.dmp
memory/2840-2503-0x0000000004860000-0x0000000004870000-memory.dmp
memory/2840-2502-0x0000000005B10000-0x0000000005B5C000-memory.dmp
memory/2840-2501-0x0000000005AF0000-0x0000000005B0E000-memory.dmp
memory/2840-2500-0x00000000056D0000-0x0000000005A24000-memory.dmp
memory/2840-2495-0x00000000054D0000-0x0000000005536000-memory.dmp
memory/2840-2519-0x0000000006DE0000-0x0000000006DFA000-memory.dmp
memory/2840-2518-0x0000000007420000-0x0000000007A9A000-memory.dmp
memory/2840-2488-0x0000000004B00000-0x0000000004B22000-memory.dmp
memory/2840-2521-0x0000000007060000-0x00000000070F6000-memory.dmp
memory/2840-2486-0x0000000004EA0000-0x00000000054C8000-memory.dmp
memory/2840-2522-0x0000000006FE0000-0x0000000006FF1000-memory.dmp
memory/2840-2523-0x0000000007010000-0x000000000701E000-memory.dmp
memory/2840-2481-0x0000000004860000-0x0000000004870000-memory.dmp
memory/2840-2480-0x0000000074630000-0x0000000074DE0000-memory.dmp
memory/2840-2479-0x0000000002180000-0x00000000021B6000-memory.dmp
memory/2840-2524-0x0000000007020000-0x0000000007034000-memory.dmp
memory/2840-2525-0x0000000007120000-0x000000000713A000-memory.dmp
memory/2840-2526-0x0000000007100000-0x0000000007108000-memory.dmp
memory/2840-2529-0x0000000074630000-0x0000000074DE0000-memory.dmp
memory/4300-30-0x00000000065C0000-0x0000000006636000-memory.dmp
memory/4300-38-0x00000000065C0000-0x0000000006636000-memory.dmp
memory/4300-64-0x00000000065C0000-0x0000000006636000-memory.dmp
memory/4300-66-0x00000000065C0000-0x0000000006636000-memory.dmp
memory/4300-68-0x00000000065C0000-0x0000000006636000-memory.dmp
memory/4300-70-0x00000000065C0000-0x0000000006636000-memory.dmp
memory/4300-72-0x00000000065C0000-0x0000000006636000-memory.dmp
memory/4300-74-0x00000000065C0000-0x0000000006636000-memory.dmp
memory/4300-2459-0x0000000004AC0000-0x0000000004AD0000-memory.dmp
memory/4300-2460-0x00000000067A0000-0x00000000067BE000-memory.dmp
memory/4300-2461-0x0000000004AC0000-0x0000000004AD0000-memory.dmp
memory/4300-60-0x00000000065C0000-0x0000000006636000-memory.dmp
memory/4300-58-0x00000000065C0000-0x0000000006636000-memory.dmp
memory/4300-56-0x00000000065C0000-0x0000000006636000-memory.dmp
memory/4300-2476-0x0000000074630000-0x0000000074DE0000-memory.dmp
memory/4300-54-0x00000000065C0000-0x0000000006636000-memory.dmp
memory/4300-50-0x00000000065C0000-0x0000000006636000-memory.dmp
memory/4300-52-0x00000000065C0000-0x0000000006636000-memory.dmp
memory/4300-48-0x00000000065C0000-0x0000000006636000-memory.dmp
memory/4300-46-0x00000000065C0000-0x0000000006636000-memory.dmp
memory/4300-44-0x00000000065C0000-0x0000000006636000-memory.dmp
memory/4300-42-0x00000000065C0000-0x0000000006636000-memory.dmp
memory/4300-40-0x00000000065C0000-0x0000000006636000-memory.dmp
memory/4300-62-0x00000000065C0000-0x0000000006636000-memory.dmp
memory/4300-36-0x00000000065C0000-0x0000000006636000-memory.dmp
memory/4300-34-0x00000000065C0000-0x0000000006636000-memory.dmp
memory/4300-32-0x00000000065C0000-0x0000000006636000-memory.dmp
memory/4300-0-0x0000000074630000-0x0000000074DE0000-memory.dmp
memory/4300-28-0x00000000065C0000-0x0000000006636000-memory.dmp
memory/4300-26-0x00000000065C0000-0x0000000006636000-memory.dmp
memory/4300-24-0x00000000065C0000-0x0000000006636000-memory.dmp
memory/4300-22-0x00000000065C0000-0x0000000006636000-memory.dmp
memory/4300-20-0x00000000065C0000-0x0000000006636000-memory.dmp
memory/4300-18-0x00000000065C0000-0x0000000006636000-memory.dmp
memory/4300-16-0x00000000065C0000-0x0000000006636000-memory.dmp
memory/4300-14-0x00000000065C0000-0x0000000006636000-memory.dmp
memory/4300-12-0x00000000065C0000-0x0000000006636000-memory.dmp
memory/4300-11-0x00000000065C0000-0x0000000006636000-memory.dmp
memory/4300-10-0x00000000065C0000-0x000000000663C000-memory.dmp
memory/4300-9-0x00000000062B0000-0x0000000006326000-memory.dmp
memory/4300-8-0x00000000061C0000-0x0000000006230000-memory.dmp
memory/4300-7-0x0000000004AC0000-0x0000000004AD0000-memory.dmp
memory/4300-6-0x0000000074630000-0x0000000074DE0000-memory.dmp
memory/4300-5-0x0000000004AF0000-0x0000000004AFA000-memory.dmp
memory/4300-4-0x0000000004AC0000-0x0000000004AD0000-memory.dmp
memory/4300-3-0x0000000004B20000-0x0000000004BB2000-memory.dmp
memory/4300-2-0x0000000005030000-0x00000000055D4000-memory.dmp
memory/4300-1-0x0000000000040000-0x00000000000E0000-memory.dmp