Analysis
- max time kernel
302s - max time network
303s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
18/03/2024, 15:12
General
- Target SurrogateServerIntoSvc.exe
- Size 147.8MB
- Sample240318-slmnvscc5w
- SHA256 df18a66e0d7dac7371e4371005a83e4735f5e22377b28f00bb0f41a3feee92a5
Malware Config
Signatures
- Detect ZGRat V1 35 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies system certificate store 2 TTPs 9 IoCs
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SurrogateServerIntoSvc.exe"C:\Users\Admin\AppData\Local\Temp\SurrogateServerIntoSvc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SurrogateServerIntoSvc.exeC:\Users\Admin\AppData\Local\Temp\SurrogateServerIntoSvc.exe2⤵
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ce68ae3b-3bbe-45a2-b3af-813910de8613.vbs"3⤵
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4b8db514-9be0-40bd-a3c5-393360c9089e.vbs"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
94308059B57B3142E455B38A6EB92015
94308059B57B3142E455B38A6EB92015
94308059B57B3142E455B38A6EB92015
4b8db514-9be0-40bd-a3c5-393360c9089e.vbs
TarCDF0.tmp
ce68ae3b-3bbe-45a2-b3af-813910de8613.vbs
memory/1164-36-0x0000000004CB0000-0x0000000004F20000-memory.dmp
memory/1164-40-0x0000000004CB0000-0x0000000004F20000-memory.dmp
memory/1164-3-0x0000000004CB0000-0x0000000004F20000-memory.dmp
memory/1164-4-0x0000000004CB0000-0x0000000004F20000-memory.dmp
memory/1164-6-0x0000000004CB0000-0x0000000004F20000-memory.dmp
memory/1164-8-0x0000000004CB0000-0x0000000004F20000-memory.dmp
memory/1164-10-0x0000000004CB0000-0x0000000004F20000-memory.dmp
memory/1164-12-0x0000000004CB0000-0x0000000004F20000-memory.dmp
memory/1164-16-0x0000000004CB0000-0x0000000004F20000-memory.dmp
memory/1164-14-0x0000000004CB0000-0x0000000004F20000-memory.dmp
memory/1164-18-0x0000000004CB0000-0x0000000004F20000-memory.dmp
memory/1164-20-0x0000000004CB0000-0x0000000004F20000-memory.dmp
memory/1164-22-0x0000000004CB0000-0x0000000004F20000-memory.dmp
memory/1164-24-0x0000000004CB0000-0x0000000004F20000-memory.dmp
memory/1164-26-0x0000000004CB0000-0x0000000004F20000-memory.dmp
memory/1164-28-0x0000000004CB0000-0x0000000004F20000-memory.dmp
memory/1164-30-0x0000000004CB0000-0x0000000004F20000-memory.dmp
memory/1164-34-0x0000000004CB0000-0x0000000004F20000-memory.dmp
memory/1164-32-0x0000000004CB0000-0x0000000004F20000-memory.dmp
memory/1164-38-0x0000000004CB0000-0x0000000004F20000-memory.dmp
memory/1164-1-0x0000000000990000-0x0000000000CBE000-memory.dmp
memory/1164-44-0x0000000004CB0000-0x0000000004F20000-memory.dmp
memory/1164-42-0x0000000004CB0000-0x0000000004F20000-memory.dmp
memory/1164-2-0x0000000004CB0000-0x0000000004F26000-memory.dmp
memory/1164-46-0x0000000004CB0000-0x0000000004F20000-memory.dmp
memory/1164-48-0x0000000004CB0000-0x0000000004F20000-memory.dmp
memory/1164-50-0x0000000004CB0000-0x0000000004F20000-memory.dmp
memory/1164-54-0x0000000004CB0000-0x0000000004F20000-memory.dmp
memory/1164-52-0x0000000004CB0000-0x0000000004F20000-memory.dmp
memory/1164-58-0x0000000004CB0000-0x0000000004F20000-memory.dmp
memory/1164-62-0x0000000004CB0000-0x0000000004F20000-memory.dmp
memory/1164-60-0x0000000004CB0000-0x0000000004F20000-memory.dmp
memory/1164-64-0x0000000004CB0000-0x0000000004F20000-memory.dmp
memory/1164-66-0x0000000004CB0000-0x0000000004F20000-memory.dmp
memory/1164-56-0x0000000004CB0000-0x0000000004F20000-memory.dmp
memory/1164-4222-0x00000000745A0000-0x0000000074C8E000-memory.dmp
memory/1164-4780-0x0000000004C70000-0x0000000004CB0000-memory.dmp
memory/1164-4781-0x00000000005B0000-0x00000000005B1000-memory.dmp
memory/1164-4782-0x0000000005860000-0x000000000591E000-memory.dmp
memory/1164-4783-0x0000000002420000-0x000000000246C000-memory.dmp
memory/1164-4784-0x0000000004C70000-0x0000000004CB0000-memory.dmp
memory/1164-0-0x00000000745A0000-0x0000000074C8E000-memory.dmp
memory/1164-4794-0x00000000745A0000-0x0000000074C8E000-memory.dmp
memory/2008-4798-0x0000000000400000-0x000000000051A000-memory.dmp
memory/2008-4799-0x0000000074520000-0x0000000074C0E000-memory.dmp
memory/2008-4800-0x00000000002C0000-0x00000000002CE000-memory.dmp
memory/2008-4801-0x00000000003E0000-0x00000000003EA000-memory.dmp
memory/2008-4939-0x0000000074520000-0x0000000074C0E000-memory.dmp