Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
11-04-2024 07:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
003c78df2e77687e1b28a9b498152cff4ce27ab0bef5f65b3a2c00b37ef49c13.exe
Resource
win10v2004-20240226-en
6 signatures
150 seconds
General
-
Target
003c78df2e77687e1b28a9b498152cff4ce27ab0bef5f65b3a2c00b37ef49c13.exe
-
Size
697KB
-
MD5
8ab428444842653c6ebf5a71f14f80e2
-
SHA1
780f71e211c5dbe9e37805fdcbaf88359651f7b2
-
SHA256
003c78df2e77687e1b28a9b498152cff4ce27ab0bef5f65b3a2c00b37ef49c13
-
SHA512
37bf000a2407a9eac7d8006fec624de07e036c6ec711e95ef15b749cb532a762af2c822089e9f25a3b450a1a9b335ce4193c9a57fc6219054569bf1997e9f79d
-
SSDEEP
12288:jJFKeIV/ORw6mBTCz2BqbKKsobl9XGzwHJeL7dIh89zwHJeo:HC+hbK5ox9XcwpeLkmwpeo
Malware Config
Signatures
-
Detect ZGRat V1 33 IoCs
resource yara_rule behavioral2/memory/4292-5-0x00000000055B0000-0x0000000005684000-memory.dmp family_zgrat_v1 behavioral2/memory/4292-10-0x00000000055B0000-0x000000000567F000-memory.dmp family_zgrat_v1 behavioral2/memory/4292-11-0x00000000055B0000-0x000000000567F000-memory.dmp family_zgrat_v1 behavioral2/memory/4292-13-0x00000000055B0000-0x000000000567F000-memory.dmp family_zgrat_v1 behavioral2/memory/4292-15-0x00000000055B0000-0x000000000567F000-memory.dmp family_zgrat_v1 behavioral2/memory/4292-17-0x00000000055B0000-0x000000000567F000-memory.dmp family_zgrat_v1 behavioral2/memory/4292-19-0x00000000055B0000-0x000000000567F000-memory.dmp family_zgrat_v1 behavioral2/memory/4292-21-0x00000000055B0000-0x000000000567F000-memory.dmp family_zgrat_v1 behavioral2/memory/4292-23-0x00000000055B0000-0x000000000567F000-memory.dmp family_zgrat_v1 behavioral2/memory/4292-25-0x00000000055B0000-0x000000000567F000-memory.dmp family_zgrat_v1 behavioral2/memory/4292-27-0x00000000055B0000-0x000000000567F000-memory.dmp family_zgrat_v1 behavioral2/memory/4292-29-0x00000000055B0000-0x000000000567F000-memory.dmp family_zgrat_v1 behavioral2/memory/4292-31-0x00000000055B0000-0x000000000567F000-memory.dmp family_zgrat_v1 behavioral2/memory/4292-33-0x00000000055B0000-0x000000000567F000-memory.dmp family_zgrat_v1 behavioral2/memory/4292-35-0x00000000055B0000-0x000000000567F000-memory.dmp family_zgrat_v1 behavioral2/memory/4292-37-0x00000000055B0000-0x000000000567F000-memory.dmp family_zgrat_v1 behavioral2/memory/4292-39-0x00000000055B0000-0x000000000567F000-memory.dmp family_zgrat_v1 behavioral2/memory/4292-41-0x00000000055B0000-0x000000000567F000-memory.dmp family_zgrat_v1 behavioral2/memory/4292-43-0x00000000055B0000-0x000000000567F000-memory.dmp family_zgrat_v1 behavioral2/memory/4292-45-0x00000000055B0000-0x000000000567F000-memory.dmp family_zgrat_v1 behavioral2/memory/4292-47-0x00000000055B0000-0x000000000567F000-memory.dmp family_zgrat_v1 behavioral2/memory/4292-49-0x00000000055B0000-0x000000000567F000-memory.dmp family_zgrat_v1 behavioral2/memory/4292-51-0x00000000055B0000-0x000000000567F000-memory.dmp family_zgrat_v1 behavioral2/memory/4292-53-0x00000000055B0000-0x000000000567F000-memory.dmp family_zgrat_v1 behavioral2/memory/4292-55-0x00000000055B0000-0x000000000567F000-memory.dmp family_zgrat_v1 behavioral2/memory/4292-57-0x00000000055B0000-0x000000000567F000-memory.dmp family_zgrat_v1 behavioral2/memory/4292-61-0x00000000055B0000-0x000000000567F000-memory.dmp family_zgrat_v1 behavioral2/memory/4292-59-0x00000000055B0000-0x000000000567F000-memory.dmp family_zgrat_v1 behavioral2/memory/4292-63-0x00000000055B0000-0x000000000567F000-memory.dmp family_zgrat_v1 behavioral2/memory/4292-65-0x00000000055B0000-0x000000000567F000-memory.dmp family_zgrat_v1 behavioral2/memory/4292-67-0x00000000055B0000-0x000000000567F000-memory.dmp family_zgrat_v1 behavioral2/memory/4292-69-0x00000000055B0000-0x000000000567F000-memory.dmp family_zgrat_v1 behavioral2/memory/4292-71-0x00000000055B0000-0x000000000567F000-memory.dmp family_zgrat_v1 -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2976 set thread context of 4292 2976 003c78df2e77687e1b28a9b498152cff4ce27ab0bef5f65b3a2c00b37ef49c13.exe 78 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4032 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4292 003c78df2e77687e1b28a9b498152cff4ce27ab0bef5f65b3a2c00b37ef49c13.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2976 wrote to memory of 4292 2976 003c78df2e77687e1b28a9b498152cff4ce27ab0bef5f65b3a2c00b37ef49c13.exe 78 PID 2976 wrote to memory of 4292 2976 003c78df2e77687e1b28a9b498152cff4ce27ab0bef5f65b3a2c00b37ef49c13.exe 78 PID 2976 wrote to memory of 4292 2976 003c78df2e77687e1b28a9b498152cff4ce27ab0bef5f65b3a2c00b37ef49c13.exe 78 PID 2976 wrote to memory of 4292 2976 003c78df2e77687e1b28a9b498152cff4ce27ab0bef5f65b3a2c00b37ef49c13.exe 78 PID 2976 wrote to memory of 4292 2976 003c78df2e77687e1b28a9b498152cff4ce27ab0bef5f65b3a2c00b37ef49c13.exe 78 PID 2976 wrote to memory of 4292 2976 003c78df2e77687e1b28a9b498152cff4ce27ab0bef5f65b3a2c00b37ef49c13.exe 78 PID 2976 wrote to memory of 4292 2976 003c78df2e77687e1b28a9b498152cff4ce27ab0bef5f65b3a2c00b37ef49c13.exe 78 PID 2976 wrote to memory of 4292 2976 003c78df2e77687e1b28a9b498152cff4ce27ab0bef5f65b3a2c00b37ef49c13.exe 78 PID 2976 wrote to memory of 4924 2976 003c78df2e77687e1b28a9b498152cff4ce27ab0bef5f65b3a2c00b37ef49c13.exe 79 PID 2976 wrote to memory of 4924 2976 003c78df2e77687e1b28a9b498152cff4ce27ab0bef5f65b3a2c00b37ef49c13.exe 79 PID 2976 wrote to memory of 4924 2976 003c78df2e77687e1b28a9b498152cff4ce27ab0bef5f65b3a2c00b37ef49c13.exe 79 PID 2976 wrote to memory of 3596 2976 003c78df2e77687e1b28a9b498152cff4ce27ab0bef5f65b3a2c00b37ef49c13.exe 80 PID 2976 wrote to memory of 3596 2976 003c78df2e77687e1b28a9b498152cff4ce27ab0bef5f65b3a2c00b37ef49c13.exe 80 PID 2976 wrote to memory of 3596 2976 003c78df2e77687e1b28a9b498152cff4ce27ab0bef5f65b3a2c00b37ef49c13.exe 80 PID 2976 wrote to memory of 4560 2976 003c78df2e77687e1b28a9b498152cff4ce27ab0bef5f65b3a2c00b37ef49c13.exe 81 PID 2976 wrote to memory of 4560 2976 003c78df2e77687e1b28a9b498152cff4ce27ab0bef5f65b3a2c00b37ef49c13.exe 81 PID 2976 wrote to memory of 4560 2976 003c78df2e77687e1b28a9b498152cff4ce27ab0bef5f65b3a2c00b37ef49c13.exe 81 PID 3596 wrote to memory of 4032 3596 cmd.exe 85 PID 3596 wrote to memory of 4032 3596 cmd.exe 85 PID 3596 wrote to memory of 4032 3596 cmd.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\003c78df2e77687e1b28a9b498152cff4ce27ab0bef5f65b3a2c00b37ef49c13.exe"C:\Users\Admin\AppData\Local\Temp\003c78df2e77687e1b28a9b498152cff4ce27ab0bef5f65b3a2c00b37ef49c13.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\003c78df2e77687e1b28a9b498152cff4ce27ab0bef5f65b3a2c00b37ef49c13.exe"C:\Users\Admin\AppData\Local\Temp\003c78df2e77687e1b28a9b498152cff4ce27ab0bef5f65b3a2c00b37ef49c13.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4292
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\dghdhww"2⤵PID:4924
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 10 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\dghdhww\dghdhww.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 10 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\dghdhww\dghdhww.exe'" /f3⤵
- Creates scheduled task(s)
PID:4032
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\003c78df2e77687e1b28a9b498152cff4ce27ab0bef5f65b3a2c00b37ef49c13.exe" "C:\Users\Admin\AppData\Roaming\dghdhww\dghdhww.exe"2⤵PID:4560
-