zgrat | 88a7e9929cb967f33475bc95d02e05449bcc7a04968777d5dffd3f33c8d1bad3

General

Target

cfbd28652bdc2f1c3a30d6ad3a77d408.exe
Size

1.8MB
MD5

cfbd28652bdc2f1c3a30d6ad3a77d408
SHA1

846254a9fd531785ffa0cfc34b30a6b47c4603d6
SHA256

88a7e9929cb967f33475bc95d02e05449bcc7a04968777d5dffd3f33c8d1bad3
SHA512

268a0fed1f93ad29138a03654cc5282ed09f3d6d9930282df2cdc46fc5851cc14d56a9833d899ebd8d80d3f6b611f00dc062143bf08ebf73e8c3863ad2f85a86
SSDEEP

49152:JOxf2vTY5hgsgJ2a9N4FA3358pYwHvr/hou:pbEhda9N+A5UVhou

Score

10^/10

zgrat rat

Malware Config

Signatures

Detect ZGRat V1 34 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2100-8-0x0000000002180000-0x00000000021D8000-memory.dmp	family_zgrat_v1
behavioral1/memory/2100-16-0x0000000002180000-0x00000000021D2000-memory.dmp	family_zgrat_v1
behavioral1/memory/2100-22-0x0000000002180000-0x00000000021D2000-memory.dmp	family_zgrat_v1
behavioral1/memory/2100-28-0x0000000002180000-0x00000000021D2000-memory.dmp	family_zgrat_v1
behavioral1/memory/2100-34-0x0000000002180000-0x00000000021D2000-memory.dmp	family_zgrat_v1
behavioral1/memory/2100-40-0x0000000002180000-0x00000000021D2000-memory.dmp	family_zgrat_v1
behavioral1/memory/2100-46-0x0000000002180000-0x00000000021D2000-memory.dmp	family_zgrat_v1
behavioral1/memory/2100-54-0x0000000002180000-0x00000000021D2000-memory.dmp	family_zgrat_v1
behavioral1/memory/2100-58-0x0000000002180000-0x00000000021D2000-memory.dmp	family_zgrat_v1
behavioral1/memory/2100-66-0x0000000002180000-0x00000000021D2000-memory.dmp	family_zgrat_v1
behavioral1/memory/2100-72-0x0000000002180000-0x00000000021D2000-memory.dmp	family_zgrat_v1
behavioral1/memory/2100-70-0x0000000002180000-0x00000000021D2000-memory.dmp	family_zgrat_v1
behavioral1/memory/2100-68-0x0000000002180000-0x00000000021D2000-memory.dmp	family_zgrat_v1
behavioral1/memory/2100-64-0x0000000002180000-0x00000000021D2000-memory.dmp	family_zgrat_v1
behavioral1/memory/2100-62-0x0000000002180000-0x00000000021D2000-memory.dmp	family_zgrat_v1
behavioral1/memory/2100-60-0x0000000002180000-0x00000000021D2000-memory.dmp	family_zgrat_v1
behavioral1/memory/2100-56-0x0000000002180000-0x00000000021D2000-memory.dmp	family_zgrat_v1
behavioral1/memory/2100-52-0x0000000002180000-0x00000000021D2000-memory.dmp	family_zgrat_v1
behavioral1/memory/2100-50-0x0000000002180000-0x00000000021D2000-memory.dmp	family_zgrat_v1
behavioral1/memory/2100-48-0x0000000002180000-0x00000000021D2000-memory.dmp	family_zgrat_v1
behavioral1/memory/2100-44-0x0000000002180000-0x00000000021D2000-memory.dmp	family_zgrat_v1
behavioral1/memory/2100-42-0x0000000002180000-0x00000000021D2000-memory.dmp	family_zgrat_v1
behavioral1/memory/2100-38-0x0000000002180000-0x00000000021D2000-memory.dmp	family_zgrat_v1
behavioral1/memory/2100-36-0x0000000002180000-0x00000000021D2000-memory.dmp	family_zgrat_v1
behavioral1/memory/2100-32-0x0000000002180000-0x00000000021D2000-memory.dmp	family_zgrat_v1
behavioral1/memory/2100-30-0x0000000002180000-0x00000000021D2000-memory.dmp	family_zgrat_v1
behavioral1/memory/2100-26-0x0000000002180000-0x00000000021D2000-memory.dmp	family_zgrat_v1
behavioral1/memory/2100-24-0x0000000002180000-0x00000000021D2000-memory.dmp	family_zgrat_v1
behavioral1/memory/2100-20-0x0000000002180000-0x00000000021D2000-memory.dmp	family_zgrat_v1
behavioral1/memory/2100-18-0x0000000002180000-0x00000000021D2000-memory.dmp	family_zgrat_v1
behavioral1/memory/2100-14-0x0000000002180000-0x00000000021D2000-memory.dmp	family_zgrat_v1
behavioral1/memory/2100-12-0x0000000002180000-0x00000000021D2000-memory.dmp	family_zgrat_v1
behavioral1/memory/2100-10-0x0000000002180000-0x00000000021D2000-memory.dmp	family_zgrat_v1
behavioral1/memory/2100-9-0x0000000002180000-0x00000000021D2000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Suspicious use of SetThreadContext 1 IoCs

Processes:

cfbd28652bdc2f1c3a30d6ad3a77d408.exe

description pid process target process

PID 2100 set thread context of 1340 2100 cfbd28652bdc2f1c3a30d6ad3a77d408.exe cfbd28652bdc2f1c3a30d6ad3a77d408.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

cfbd28652bdc2f1c3a30d6ad3a77d408.exepowershell.exe

pid process

2100 cfbd28652bdc2f1c3a30d6ad3a77d408.exe
2100 cfbd28652bdc2f1c3a30d6ad3a77d408.exe
1724 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

cfbd28652bdc2f1c3a30d6ad3a77d408.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2100 cfbd28652bdc2f1c3a30d6ad3a77d408.exe
Token: SeDebugPrivilege 1724 powershell.exe

description	pid	process	target process
PID 2100 set thread context of 1340	2100	cfbd28652bdc2f1c3a30d6ad3a77d408.exe	cfbd28652bdc2f1c3a30d6ad3a77d408.exe

pid	process
2100	cfbd28652bdc2f1c3a30d6ad3a77d408.exe
2100	cfbd28652bdc2f1c3a30d6ad3a77d408.exe
1724	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2100	cfbd28652bdc2f1c3a30d6ad3a77d408.exe
Token: SeDebugPrivilege	1724	powershell.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

cfbd28652bdc2f1c3a30d6ad3a77d408.exeWScript.exe

description	pid	process	target process
PID 2100 wrote to memory of 1516	2100	cfbd28652bdc2f1c3a30d6ad3a77d408.exe	WScript.exe
PID 2100 wrote to memory of 1516	2100	cfbd28652bdc2f1c3a30d6ad3a77d408.exe	WScript.exe
PID 2100 wrote to memory of 1516	2100	cfbd28652bdc2f1c3a30d6ad3a77d408.exe	WScript.exe
PID 2100 wrote to memory of 1516	2100	cfbd28652bdc2f1c3a30d6ad3a77d408.exe	WScript.exe
PID 2100 wrote to memory of 1340	2100	cfbd28652bdc2f1c3a30d6ad3a77d408.exe	cfbd28652bdc2f1c3a30d6ad3a77d408.exe
PID 2100 wrote to memory of 1340	2100	cfbd28652bdc2f1c3a30d6ad3a77d408.exe	cfbd28652bdc2f1c3a30d6ad3a77d408.exe
PID 2100 wrote to memory of 1340	2100	cfbd28652bdc2f1c3a30d6ad3a77d408.exe	cfbd28652bdc2f1c3a30d6ad3a77d408.exe
PID 2100 wrote to memory of 1340	2100	cfbd28652bdc2f1c3a30d6ad3a77d408.exe	cfbd28652bdc2f1c3a30d6ad3a77d408.exe
PID 2100 wrote to memory of 1340	2100	cfbd28652bdc2f1c3a30d6ad3a77d408.exe	cfbd28652bdc2f1c3a30d6ad3a77d408.exe
PID 2100 wrote to memory of 1340	2100	cfbd28652bdc2f1c3a30d6ad3a77d408.exe	cfbd28652bdc2f1c3a30d6ad3a77d408.exe
PID 1516 wrote to memory of 1724	1516	WScript.exe	powershell.exe
PID 1516 wrote to memory of 1724	1516	WScript.exe	powershell.exe
PID 1516 wrote to memory of 1724	1516	WScript.exe	powershell.exe
PID 1516 wrote to memory of 1724	1516	WScript.exe	powershell.exe
PID 2100 wrote to memory of 1340	2100	cfbd28652bdc2f1c3a30d6ad3a77d408.exe	cfbd28652bdc2f1c3a30d6ad3a77d408.exe
PID 2100 wrote to memory of 1340	2100	cfbd28652bdc2f1c3a30d6ad3a77d408.exe	cfbd28652bdc2f1c3a30d6ad3a77d408.exe

C:\Users\Admin\AppData\Local\Temp\cfbd28652bdc2f1c3a30d6ad3a77d408.exe
"C:\Users\Admin\AppData\Local\Temp\cfbd28652bdc2f1c3a30d6ad3a77d408.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2100

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Ekleezyvovzpjcfscz.vbs"
2⤵
- Suspicious use of WriteProcessMemory
PID:1516

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\chrome\chrome\chrome\chrome.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1724

C:\Users\Admin\AppData\Local\Temp\cfbd28652bdc2f1c3a30d6ad3a77d408.exe
C:\Users\Admin\AppData\Local\Temp\cfbd28652bdc2f1c3a30d6ad3a77d408.exe
2⤵
PID:1340

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_Ekleezyvovzpjcfscz.vbs
Filesize
195B

MD5
752b55899ecc5e4dc8760996258a2ce3

SHA1
e256bf7781d5d6a7e6bc43072863e3d46b14f6ab

SHA256
2d07de2853865f08f0e92d50b34a51f1defc6cf0e54d2feb0e203cb6272bd8aa

SHA512
426d83b30727558918895b54d925777e7a352e8ab421b359b86e041e8c8625b812c7730acc6b8d6f04d7855b32da26bc956e07e56e5f26c7c5057e7f9ebd3876

Download Submit
memory/1724-1476-0x0000000072C60000-0x000000007320B000-memory.dmp

Filesize
5.7MB

Download
memory/1724-1475-0x0000000002BB0000-0x0000000002BF0000-memory.dmp

Filesize
256KB

Download
memory/1724-1472-0x0000000072C60000-0x000000007320B000-memory.dmp

Filesize
5.7MB

Download
memory/1724-1474-0x0000000002BB0000-0x0000000002BF0000-memory.dmp

Filesize
256KB

Download
memory/1724-1473-0x0000000072C60000-0x000000007320B000-memory.dmp

Filesize
5.7MB

Download
memory/2100-56-0x0000000002180000-0x00000000021D2000-memory.dmp

Filesize
328KB

Download
memory/2100-48-0x0000000002180000-0x00000000021D2000-memory.dmp

Filesize
328KB

Download
memory/2100-8-0x0000000002180000-0x00000000021D8000-memory.dmp

Filesize
352KB

Download
memory/2100-16-0x0000000002180000-0x00000000021D2000-memory.dmp

Filesize
328KB

Download
memory/2100-22-0x0000000002180000-0x00000000021D2000-memory.dmp

Filesize
328KB

Download
memory/2100-28-0x0000000002180000-0x00000000021D2000-memory.dmp

Filesize
328KB

Download
memory/2100-34-0x0000000002180000-0x00000000021D2000-memory.dmp

Filesize
328KB

Download
memory/2100-40-0x0000000002180000-0x00000000021D2000-memory.dmp

Filesize
328KB

Download
memory/2100-46-0x0000000002180000-0x00000000021D2000-memory.dmp

Filesize
328KB

Download
memory/2100-54-0x0000000002180000-0x00000000021D2000-memory.dmp

Filesize
328KB

Download
memory/2100-58-0x0000000002180000-0x00000000021D2000-memory.dmp

Filesize
328KB

Download
memory/2100-66-0x0000000002180000-0x00000000021D2000-memory.dmp

Filesize
328KB

Download
memory/2100-72-0x0000000002180000-0x00000000021D2000-memory.dmp

Filesize
328KB

Download
memory/2100-70-0x0000000002180000-0x00000000021D2000-memory.dmp

Filesize
328KB

Download
memory/2100-68-0x0000000002180000-0x00000000021D2000-memory.dmp

Filesize
328KB

Download
memory/2100-64-0x0000000002180000-0x00000000021D2000-memory.dmp

Filesize
328KB

Download
memory/2100-62-0x0000000002180000-0x00000000021D2000-memory.dmp

Filesize
328KB

Download
memory/2100-60-0x0000000002180000-0x00000000021D2000-memory.dmp

Filesize
328KB

Download
memory/2100-0-0x0000000000A10000-0x0000000000BEE000-memory.dmp

Filesize
1.9MB

Download
memory/2100-52-0x0000000002180000-0x00000000021D2000-memory.dmp

Filesize
328KB

Download
memory/2100-50-0x0000000002180000-0x00000000021D2000-memory.dmp

Filesize
328KB

Download
memory/2100-7-0x00000000081F0000-0x0000000008398000-memory.dmp

Filesize
1.7MB

Download
memory/2100-44-0x0000000002180000-0x00000000021D2000-memory.dmp

Filesize
328KB

Download
memory/2100-42-0x0000000002180000-0x00000000021D2000-memory.dmp

Filesize
328KB

Download
memory/2100-38-0x0000000002180000-0x00000000021D2000-memory.dmp

Filesize
328KB

Download
memory/2100-36-0x0000000002180000-0x00000000021D2000-memory.dmp

Filesize
328KB

Download
memory/2100-32-0x0000000002180000-0x00000000021D2000-memory.dmp

Filesize
328KB

Download
memory/2100-30-0x0000000002180000-0x00000000021D2000-memory.dmp

Filesize
328KB

Download
memory/2100-26-0x0000000002180000-0x00000000021D2000-memory.dmp

Filesize
328KB

Download
memory/2100-24-0x0000000002180000-0x00000000021D2000-memory.dmp

Filesize
328KB

Download
memory/2100-20-0x0000000002180000-0x00000000021D2000-memory.dmp

Filesize
328KB

Download
memory/2100-18-0x0000000002180000-0x00000000021D2000-memory.dmp

Filesize
328KB

Download
memory/2100-14-0x0000000002180000-0x00000000021D2000-memory.dmp

Filesize
328KB

Download
memory/2100-12-0x0000000002180000-0x00000000021D2000-memory.dmp

Filesize
328KB

Download
memory/2100-10-0x0000000002180000-0x00000000021D2000-memory.dmp

Filesize
328KB

Download
memory/2100-9-0x0000000002180000-0x00000000021D2000-memory.dmp

Filesize
328KB

Download
memory/2100-6-0x0000000004EF0000-0x0000000004F30000-memory.dmp

Filesize
256KB

Download
memory/2100-1469-0x0000000073FC0000-0x00000000746AE000-memory.dmp

Filesize
6.9MB

Download
memory/2100-5-0x0000000004EF0000-0x0000000004F30000-memory.dmp

Filesize
256KB

Download
memory/2100-4-0x0000000073FC0000-0x00000000746AE000-memory.dmp

Filesize
6.9MB

Download
memory/2100-3-0x0000000004EF0000-0x0000000004F30000-memory.dmp

Filesize
256KB

Download
memory/2100-2-0x0000000004EF0000-0x0000000004F30000-memory.dmp

Filesize
256KB

Download
memory/2100-1-0x0000000073FC0000-0x00000000746AE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing