zgrat | e9b2a118ebeb92f8f01ea5cb835723dee6ab16bf2bb221834c17c4f24449d329

General

Target

e9b2a118ebeb92f8f01ea5cb835723dee6ab16bf2bb221834c17c4f24449d329.exe
Size

1.3MB
MD5

1870c2c7621f31f8ff544c98bd5dfc99
SHA1

1771aae9906c52861052be3f6c1d41e2ec6361e0
SHA256

e9b2a118ebeb92f8f01ea5cb835723dee6ab16bf2bb221834c17c4f24449d329
SHA512

f23aefe84ed31cfaba37100fc003aaa0ea1209607708250f595949577abe7ec8b8e8bfe2e9e05d1d3029efef29807fa5eff1fe1948fe8b06459d62fbb2bb0857
SSDEEP

24576:qG4ITaGJvZtBveuE25MwmcVO9r2A5Hs8FD48QhY0c6+2bZmgJiLBkmV+7pLNN:qG4ITaGnvavz4xc6HNmvtW7hN

Score

10^/10

zgrat rat

Malware Config

Signatures

Detect ZGRat V1 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2956-0-0x0000000000E90000-0x0000000000FDA000-memory.dmp	family_zgrat_v1
C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\svchost.exe	family_zgrat_v1
behavioral1/memory/2700-15-0x0000000000170000-0x00000000002BA000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

2700 svchost.exe

pid	process
2700	svchost.exe

Drops file in Windows directory 2 IoCs

Processes:

e9b2a118ebeb92f8f01ea5cb835723dee6ab16bf2bb221834c17c4f24449d329.exe

description	ioc	process
File created	C:\Windows\PolicyDefinitions\en-US\WmiPrvSE.exe	e9b2a118ebeb92f8f01ea5cb835723dee6ab16bf2bb221834c17c4f24449d329.exe
File created	C:\Windows\PolicyDefinitions\en-US\24dbde2999530ef5fd907494bc374d663924116c	e9b2a118ebeb92f8f01ea5cb835723dee6ab16bf2bb221834c17c4f24449d329.exe

Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

2528 schtasks.exe
2828 schtasks.exe
2684 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

e9b2a118ebeb92f8f01ea5cb835723dee6ab16bf2bb221834c17c4f24449d329.exesvchost.exe

pid process

2956 e9b2a118ebeb92f8f01ea5cb835723dee6ab16bf2bb221834c17c4f24449d329.exe
2700 svchost.exe

pid	process
2528	schtasks.exe
2828	schtasks.exe
2684	schtasks.exe

pid	process
2956	e9b2a118ebeb92f8f01ea5cb835723dee6ab16bf2bb221834c17c4f24449d329.exe
2700	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

e9b2a118ebeb92f8f01ea5cb835723dee6ab16bf2bb221834c17c4f24449d329.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	2956	e9b2a118ebeb92f8f01ea5cb835723dee6ab16bf2bb221834c17c4f24449d329.exe
Token: SeDebugPrivilege	2700	svchost.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

e9b2a118ebeb92f8f01ea5cb835723dee6ab16bf2bb221834c17c4f24449d329.exe

description	pid	process	target process
PID 2956 wrote to memory of 2528	2956	e9b2a118ebeb92f8f01ea5cb835723dee6ab16bf2bb221834c17c4f24449d329.exe	schtasks.exe
PID 2956 wrote to memory of 2528	2956	e9b2a118ebeb92f8f01ea5cb835723dee6ab16bf2bb221834c17c4f24449d329.exe	schtasks.exe
PID 2956 wrote to memory of 2528	2956	e9b2a118ebeb92f8f01ea5cb835723dee6ab16bf2bb221834c17c4f24449d329.exe	schtasks.exe
PID 2956 wrote to memory of 2828	2956	e9b2a118ebeb92f8f01ea5cb835723dee6ab16bf2bb221834c17c4f24449d329.exe	schtasks.exe
PID 2956 wrote to memory of 2828	2956	e9b2a118ebeb92f8f01ea5cb835723dee6ab16bf2bb221834c17c4f24449d329.exe	schtasks.exe
PID 2956 wrote to memory of 2828	2956	e9b2a118ebeb92f8f01ea5cb835723dee6ab16bf2bb221834c17c4f24449d329.exe	schtasks.exe
PID 2956 wrote to memory of 2684	2956	e9b2a118ebeb92f8f01ea5cb835723dee6ab16bf2bb221834c17c4f24449d329.exe	schtasks.exe
PID 2956 wrote to memory of 2684	2956	e9b2a118ebeb92f8f01ea5cb835723dee6ab16bf2bb221834c17c4f24449d329.exe	schtasks.exe
PID 2956 wrote to memory of 2684	2956	e9b2a118ebeb92f8f01ea5cb835723dee6ab16bf2bb221834c17c4f24449d329.exe	schtasks.exe
PID 2956 wrote to memory of 2700	2956	e9b2a118ebeb92f8f01ea5cb835723dee6ab16bf2bb221834c17c4f24449d329.exe	svchost.exe
PID 2956 wrote to memory of 2700	2956	e9b2a118ebeb92f8f01ea5cb835723dee6ab16bf2bb221834c17c4f24449d329.exe	svchost.exe
PID 2956 wrote to memory of 2700	2956	e9b2a118ebeb92f8f01ea5cb835723dee6ab16bf2bb221834c17c4f24449d329.exe	svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\e9b2a118ebeb92f8f01ea5cb835723dee6ab16bf2bb221834c17c4f24449d329.exe
"C:\Users\Admin\AppData\Local\Temp\e9b2a118ebeb92f8f01ea5cb835723dee6ab16bf2bb221834c17c4f24449d329.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2956

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\Idle.exe'" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:2528

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\PolicyDefinitions\en-US\WmiPrvSE.exe'" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:2828

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\svchost.exe'" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:2684

C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\svchost.exe
"C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\svchost.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2700

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\svchost.exe
Filesize
1.3MB

MD5
1870c2c7621f31f8ff544c98bd5dfc99

SHA1
1771aae9906c52861052be3f6c1d41e2ec6361e0

SHA256
e9b2a118ebeb92f8f01ea5cb835723dee6ab16bf2bb221834c17c4f24449d329

SHA512
f23aefe84ed31cfaba37100fc003aaa0ea1209607708250f595949577abe7ec8b8e8bfe2e9e05d1d3029efef29807fa5eff1fe1948fe8b06459d62fbb2bb0857

Download Submit
memory/2700-15-0x0000000000170000-0x00000000002BA000-memory.dmp

Filesize
1.3MB

Download
memory/2700-17-0x000007FEF5DA0000-0x000007FEF678C000-memory.dmp

Filesize
9.9MB

Download
memory/2700-18-0x000007FEF5DA0000-0x000007FEF678C000-memory.dmp

Filesize
9.9MB

Download
memory/2956-0-0x0000000000E90000-0x0000000000FDA000-memory.dmp

Filesize
1.3MB

Download
memory/2956-1-0x000007FEF5DA0000-0x000007FEF678C000-memory.dmp

Filesize
9.9MB

Download
memory/2956-2-0x000000001ADA0000-0x000000001AE20000-memory.dmp

Filesize
512KB

Download
memory/2956-16-0x000007FEF5DA0000-0x000007FEF678C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads