Analysis
- max time kernel
300s - max time network
304s - platform
windows10-1703_x64 - resource
win10-20240221-en - resource tags
- submitted
18/03/2024, 15:12
General
- Target SurrogateServerIntoSvc.exe
- Size 147.8MB
- Sample240318-slmnvscc5w
- SHA256 df18a66e0d7dac7371e4371005a83e4735f5e22377b28f00bb0f41a3feee92a5
Malware Config
Signatures
- Detect ZGRat V1 35 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SurrogateServerIntoSvc.exe"C:\Users\Admin\AppData\Local\Temp\SurrogateServerIntoSvc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SurrogateServerIntoSvc.exeC:\Users\Admin\AppData\Local\Temp\SurrogateServerIntoSvc.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SurrogateServerIntoSvc.exeC:\Users\Admin\AppData\Local\Temp\SurrogateServerIntoSvc.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SurrogateServerIntoSvc.exeC:\Users\Admin\AppData\Local\Temp\SurrogateServerIntoSvc.exe2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6a41b934-2f1a-4e89-aed1-cb808483376e.vbs"3⤵
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f1af4d01-789e-42ac-b4d6-a369a86f271a.vbs"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
SurrogateServerIntoSvc.exe.log
6a41b934-2f1a-4e89-aed1-cb808483376e.vbs
f1af4d01-789e-42ac-b4d6-a369a86f271a.vbs
memory/2356-4791-0x0000000073BE0000-0x00000000742CE000-memory.dmp
memory/2356-4793-0x0000000000400000-0x000000000051A000-memory.dmp
memory/2356-4794-0x0000000005AA0000-0x0000000005AB0000-memory.dmp
memory/2356-4795-0x00000000061A0000-0x00000000061AE000-memory.dmp
memory/2356-4807-0x0000000005AA0000-0x0000000005AB0000-memory.dmp
memory/2356-4806-0x0000000073BE0000-0x00000000742CE000-memory.dmp
memory/2356-4796-0x00000000061D0000-0x00000000061DA000-memory.dmp
memory/4332-42-0x0000000004FB0000-0x0000000005220000-memory.dmp
memory/4332-52-0x0000000004FB0000-0x0000000005220000-memory.dmp
memory/4332-10-0x0000000004FB0000-0x0000000005220000-memory.dmp
memory/4332-12-0x0000000004FB0000-0x0000000005220000-memory.dmp
memory/4332-16-0x0000000004FB0000-0x0000000005220000-memory.dmp
memory/4332-14-0x0000000004FB0000-0x0000000005220000-memory.dmp
memory/4332-18-0x0000000004FB0000-0x0000000005220000-memory.dmp
memory/4332-20-0x0000000004FB0000-0x0000000005220000-memory.dmp
memory/4332-22-0x0000000004FB0000-0x0000000005220000-memory.dmp
memory/4332-24-0x0000000004FB0000-0x0000000005220000-memory.dmp
memory/4332-26-0x0000000004FB0000-0x0000000005220000-memory.dmp
memory/4332-28-0x0000000004FB0000-0x0000000005220000-memory.dmp
memory/4332-30-0x0000000004FB0000-0x0000000005220000-memory.dmp
memory/4332-32-0x0000000004FB0000-0x0000000005220000-memory.dmp
memory/4332-34-0x0000000004FB0000-0x0000000005220000-memory.dmp
memory/4332-36-0x0000000004FB0000-0x0000000005220000-memory.dmp
memory/4332-38-0x0000000004FB0000-0x0000000005220000-memory.dmp
memory/4332-40-0x0000000004FB0000-0x0000000005220000-memory.dmp
memory/4332-6-0x0000000004FB0000-0x0000000005220000-memory.dmp
memory/4332-44-0x0000000004FB0000-0x0000000005220000-memory.dmp
memory/4332-46-0x0000000004FB0000-0x0000000005220000-memory.dmp
memory/4332-48-0x0000000004FB0000-0x0000000005220000-memory.dmp
memory/4332-50-0x0000000004FB0000-0x0000000005220000-memory.dmp
memory/4332-8-0x0000000004FB0000-0x0000000005220000-memory.dmp
memory/4332-54-0x0000000004FB0000-0x0000000005220000-memory.dmp
memory/4332-56-0x0000000004FB0000-0x0000000005220000-memory.dmp
memory/4332-58-0x0000000004FB0000-0x0000000005220000-memory.dmp
memory/4332-60-0x0000000004FB0000-0x0000000005220000-memory.dmp
memory/4332-62-0x0000000004FB0000-0x0000000005220000-memory.dmp
memory/4332-64-0x0000000004FB0000-0x0000000005220000-memory.dmp
memory/4332-66-0x0000000004FB0000-0x0000000005220000-memory.dmp
memory/4332-2207-0x0000000073BE0000-0x00000000742CE000-memory.dmp
memory/4332-4780-0x0000000004FA0000-0x0000000004FB0000-memory.dmp
memory/4332-4781-0x0000000004F20000-0x0000000004F21000-memory.dmp
memory/4332-4782-0x00000000055F0000-0x00000000056AE000-memory.dmp
memory/4332-4783-0x0000000005450000-0x000000000549C000-memory.dmp
memory/4332-4784-0x0000000005750000-0x00000000057E2000-memory.dmp
memory/4332-4-0x0000000004FB0000-0x0000000005220000-memory.dmp
memory/4332-3-0x0000000004FB0000-0x0000000005220000-memory.dmp
memory/4332-2-0x0000000004FB0000-0x0000000005226000-memory.dmp
memory/4332-1-0x00000000001E0000-0x000000000050E000-memory.dmp
memory/4332-0-0x0000000073BE0000-0x00000000742CE000-memory.dmp
memory/4332-4785-0x0000000005860000-0x00000000058C6000-memory.dmp
memory/4332-4786-0x0000000005ED0000-0x00000000063CE000-memory.dmp
memory/4332-4787-0x0000000004FA0000-0x0000000004FB0000-memory.dmp
memory/4332-4792-0x0000000073BE0000-0x00000000742CE000-memory.dmp