Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
21/03/2024, 04:17
General
- Target 2bae8753475af921d7258f9b1e9fccd4.exe
- Size 2.7MB
- Sample240321-ewdl2sbf54
- SHA256 9df4aaa956d54f55f1bb038f3e8f086169983e094ef8432cd71df928a888a2d0
Malware Config
Signatures
- Detect ZGRat V1 35 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2bae8753475af921d7258f9b1e9fccd4.exe"C:\Users\Admin\AppData\Local\Temp\2bae8753475af921d7258f9b1e9fccd4.exe"1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\CanReuseTransform\fiuxaa\TypeId.exeC:\Users\Admin\AppData\Local\CanReuseTransform\fiuxaa\TypeId.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
TypeId.exe
memory/2028-0-0x0000000000750000-0x0000000000A16000-memory.dmp
memory/2028-1-0x0000000074900000-0x00000000750B0000-memory.dmp
memory/2028-2-0x00000000054B0000-0x00000000054C0000-memory.dmp
memory/2028-3-0x00000000066F0000-0x00000000069A6000-memory.dmp
memory/2028-4-0x0000000006F50000-0x00000000074F4000-memory.dmp
memory/2028-5-0x0000000006A40000-0x0000000006AD2000-memory.dmp
memory/2028-7-0x00000000066F0000-0x00000000069A0000-memory.dmp
memory/2028-6-0x00000000066F0000-0x00000000069A0000-memory.dmp
memory/2028-9-0x00000000066F0000-0x00000000069A0000-memory.dmp
memory/2028-11-0x00000000066F0000-0x00000000069A0000-memory.dmp
memory/2028-13-0x00000000066F0000-0x00000000069A0000-memory.dmp
memory/2028-15-0x00000000066F0000-0x00000000069A0000-memory.dmp
memory/2028-17-0x00000000066F0000-0x00000000069A0000-memory.dmp
memory/2028-19-0x00000000066F0000-0x00000000069A0000-memory.dmp
memory/2028-21-0x00000000066F0000-0x00000000069A0000-memory.dmp
memory/2028-23-0x00000000066F0000-0x00000000069A0000-memory.dmp
memory/2028-25-0x00000000066F0000-0x00000000069A0000-memory.dmp
memory/2028-27-0x00000000066F0000-0x00000000069A0000-memory.dmp
memory/2028-29-0x00000000066F0000-0x00000000069A0000-memory.dmp
memory/2028-31-0x00000000066F0000-0x00000000069A0000-memory.dmp
memory/2028-33-0x00000000066F0000-0x00000000069A0000-memory.dmp
memory/2028-35-0x00000000066F0000-0x00000000069A0000-memory.dmp
memory/2028-37-0x00000000066F0000-0x00000000069A0000-memory.dmp
memory/2028-39-0x00000000066F0000-0x00000000069A0000-memory.dmp
memory/2028-41-0x00000000066F0000-0x00000000069A0000-memory.dmp
memory/2028-43-0x00000000066F0000-0x00000000069A0000-memory.dmp
memory/2028-45-0x00000000066F0000-0x00000000069A0000-memory.dmp
memory/2028-47-0x00000000066F0000-0x00000000069A0000-memory.dmp
memory/2028-49-0x00000000066F0000-0x00000000069A0000-memory.dmp
memory/2028-51-0x00000000066F0000-0x00000000069A0000-memory.dmp
memory/2028-53-0x00000000066F0000-0x00000000069A0000-memory.dmp
memory/2028-55-0x00000000066F0000-0x00000000069A0000-memory.dmp
memory/2028-57-0x00000000066F0000-0x00000000069A0000-memory.dmp
memory/2028-59-0x00000000066F0000-0x00000000069A0000-memory.dmp
memory/2028-61-0x00000000066F0000-0x00000000069A0000-memory.dmp
memory/2028-63-0x00000000066F0000-0x00000000069A0000-memory.dmp
memory/2028-65-0x00000000066F0000-0x00000000069A0000-memory.dmp
memory/2028-67-0x00000000066F0000-0x00000000069A0000-memory.dmp
memory/2028-69-0x00000000066F0000-0x00000000069A0000-memory.dmp
memory/2028-2583-0x0000000074900000-0x00000000750B0000-memory.dmp
memory/2028-2886-0x00000000054B0000-0x00000000054C0000-memory.dmp
memory/2028-4868-0x0000000002EE0000-0x0000000002EE1000-memory.dmp
memory/2028-4869-0x00000000075D0000-0x00000000076C4000-memory.dmp
memory/2028-4870-0x00000000055C0000-0x000000000560C000-memory.dmp
memory/2028-4871-0x00000000773A1000-0x00000000774C1000-memory.dmp
memory/2028-4872-0x00000000012C0000-0x0000000001314000-memory.dmp
memory/2028-4874-0x0000000005790000-0x000000000583C000-memory.dmp
memory/2028-4875-0x0000000005840000-0x0000000005928000-memory.dmp
memory/2028-7084-0x0000000005B50000-0x0000000005BB6000-memory.dmp
memory/2028-7087-0x0000000074900000-0x00000000750B0000-memory.dmp
memory/4360-7090-0x0000000074900000-0x00000000750B0000-memory.dmp
memory/4360-7091-0x0000000005940000-0x0000000005950000-memory.dmp
memory/4360-9582-0x0000000074900000-0x00000000750B0000-memory.dmp
memory/4360-10224-0x0000000005940000-0x0000000005950000-memory.dmp
memory/4360-11954-0x0000000005FD0000-0x0000000005FD1000-memory.dmp