Analysis
- max time kernel
120s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
15/04/2024, 23:21
General
- Target tmp.exe
- Size 5.3MB
- Sample240415-3cg25aba65
- SHA256 432747c04ab478a654328867d7ca806b52fedf1572c74712fa8b7c0edb71df67
Malware Config
Signatures
- Detect ZGRat V1 36 IoCs
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 26 IoCs
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BLHisbnd.exe"C:\Users\Admin\AppData\Local\Temp\BLHisbnd.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BLHisbnd.exe"C:\Users\Admin\AppData\Local\Temp\BLHisbnd.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 4443⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 4483⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4508 -ip 45081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4508 -ip 45081⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAVABhAGcAcwAuAGUAeABlADsA1⤵
-
C:\Users\Admin\AppData\Local\Remaining\iiyvaqxl\Tags.exeC:\Users\Admin\AppData\Local\Remaining\iiyvaqxl\Tags.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
BLHisbnd.exe.log
Tags.exe
Tags.exe
BLHisbnd.exe
__PSScriptPolicyTest_ubax3fen.odi.ps1
memory/1576-9811-0x0000000005640000-0x0000000005734000-memory.dmp
memory/1576-9816-0x00000000751D0000-0x0000000075980000-memory.dmp
memory/1576-9809-0x0000000004ED0000-0x0000000004EE0000-memory.dmp
memory/1576-9810-0x0000000004EC0000-0x0000000004EC1000-memory.dmp
memory/1576-6229-0x00000000751D0000-0x0000000075980000-memory.dmp
memory/1576-4904-0x0000000004EE0000-0x0000000005198000-memory.dmp
memory/1576-4900-0x0000000000270000-0x00000000005D0000-memory.dmp
memory/1576-4901-0x00000000751D0000-0x0000000075980000-memory.dmp
memory/2760-34-0x0000000005B70000-0x000000000601B000-memory.dmp
memory/2760-16-0x0000000005B70000-0x000000000601B000-memory.dmp
memory/2760-26-0x0000000005B70000-0x000000000601B000-memory.dmp
memory/2760-28-0x0000000005B70000-0x000000000601B000-memory.dmp
memory/2760-30-0x0000000005B70000-0x000000000601B000-memory.dmp
memory/2760-32-0x0000000005B70000-0x000000000601B000-memory.dmp
memory/2760-1-0x0000000000B40000-0x000000000109A000-memory.dmp
memory/2760-36-0x0000000005B70000-0x000000000601B000-memory.dmp
memory/2760-38-0x0000000005B70000-0x000000000601B000-memory.dmp
memory/2760-40-0x0000000005B70000-0x000000000601B000-memory.dmp
memory/2760-42-0x0000000005B70000-0x000000000601B000-memory.dmp
memory/2760-46-0x0000000005B70000-0x000000000601B000-memory.dmp
memory/2760-44-0x0000000005B70000-0x000000000601B000-memory.dmp
memory/2760-48-0x0000000005B70000-0x000000000601B000-memory.dmp
memory/2760-50-0x0000000005B70000-0x000000000601B000-memory.dmp
memory/2760-52-0x0000000005B70000-0x000000000601B000-memory.dmp
memory/2760-54-0x0000000005B70000-0x000000000601B000-memory.dmp
memory/2760-56-0x0000000005B70000-0x000000000601B000-memory.dmp
memory/2760-58-0x0000000005B70000-0x000000000601B000-memory.dmp
memory/2760-60-0x0000000005B70000-0x000000000601B000-memory.dmp
memory/2760-62-0x0000000005B70000-0x000000000601B000-memory.dmp
memory/2760-64-0x0000000005B70000-0x000000000601B000-memory.dmp
memory/2760-66-0x0000000005B70000-0x000000000601B000-memory.dmp
memory/2760-2075-0x00000000751D0000-0x0000000075980000-memory.dmp
memory/2760-4884-0x0000000005B60000-0x0000000005B70000-memory.dmp
memory/2760-4885-0x0000000001160000-0x0000000001161000-memory.dmp
memory/2760-4886-0x00000000073D0000-0x00000000076BC000-memory.dmp
memory/2760-4887-0x00000000019A0000-0x00000000019EC000-memory.dmp
memory/2760-22-0x0000000005B70000-0x000000000601B000-memory.dmp
memory/2760-4899-0x00000000097B0000-0x0000000009D54000-memory.dmp
memory/2760-4902-0x0000000008A10000-0x0000000008A64000-memory.dmp
memory/2760-20-0x0000000005B70000-0x000000000601B000-memory.dmp
memory/2760-18-0x0000000005B70000-0x000000000601B000-memory.dmp
memory/2760-24-0x0000000005B70000-0x000000000601B000-memory.dmp
memory/2760-4909-0x00000000751D0000-0x0000000075980000-memory.dmp
memory/2760-0-0x00000000751D0000-0x0000000075980000-memory.dmp
memory/2760-2-0x0000000005B70000-0x0000000006020000-memory.dmp
memory/2760-3-0x0000000005B70000-0x000000000601B000-memory.dmp
memory/2760-4-0x0000000005B70000-0x000000000601B000-memory.dmp
memory/2760-8-0x0000000005B70000-0x000000000601B000-memory.dmp
memory/2760-6-0x0000000005B70000-0x000000000601B000-memory.dmp
memory/2760-10-0x0000000005B70000-0x000000000601B000-memory.dmp
memory/2760-12-0x0000000005B70000-0x000000000601B000-memory.dmp
memory/2760-14-0x0000000005B70000-0x000000000601B000-memory.dmp
memory/4288-9815-0x0000000000930000-0x00000000009DC000-memory.dmp
memory/4288-9818-0x0000000004E20000-0x0000000004F08000-memory.dmp
memory/4288-9817-0x00000000751D0000-0x0000000075980000-memory.dmp
memory/4288-12033-0x0000000004FD0000-0x0000000004FD8000-memory.dmp
memory/4288-12034-0x0000000004FE0000-0x0000000005036000-memory.dmp
memory/4288-12035-0x0000000005270000-0x00000000052D6000-memory.dmp
memory/4288-12037-0x00000000751D0000-0x0000000075980000-memory.dmp
memory/4456-12056-0x00000000751D0000-0x0000000075980000-memory.dmp
memory/4508-5084-0x0000000004110000-0x0000000004510000-memory.dmp
memory/4508-4912-0x0000000000400000-0x000000000046D000-memory.dmp
memory/4508-5033-0x0000000004110000-0x0000000004510000-memory.dmp
memory/4508-5039-0x0000000004110000-0x0000000004510000-memory.dmp
memory/4744-12047-0x000002BAC53C0000-0x000002BAC53E2000-memory.dmp
memory/4744-12049-0x000002BAAACA0000-0x000002BAAACB0000-memory.dmp
memory/4744-12048-0x00007FFC363C0000-0x00007FFC36E81000-memory.dmp
memory/4744-12050-0x000002BAAACA0000-0x000002BAAACB0000-memory.dmp
memory/4744-12053-0x00007FFC363C0000-0x00007FFC36E81000-memory.dmp
memory/4756-5051-0x0000000000D10000-0x0000000000D19000-memory.dmp
memory/4756-5054-0x0000000002AD0000-0x0000000002ED0000-memory.dmp
memory/4756-5057-0x0000000002AD0000-0x0000000002ED0000-memory.dmp
memory/4756-5077-0x0000000002AD0000-0x0000000002ED0000-memory.dmp