Analysis
-
max time kernel
128s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
20-04-2024 11:11
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20240221-en
General
-
Target
tmp.exe
-
Size
4.6MB
-
MD5
397926927bca55be4a77839b1c44de6e
-
SHA1
e10f3434ef3021c399dbba047832f02b3c898dbd
-
SHA256
4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7
-
SHA512
cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954
-
SSDEEP
49152:1ZRCckM8wwGbtBiRFWSGqCW4FL5wslsAEL1ksS2NHsF3TjZ1I6bqmHC0Jg:1ZRCwrb64XwWsAwFaFXxg
Malware Config
Signatures
-
Detect ZGRat V1 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1108-40-0x00000180172E0000-0x000001801ABD8000-memory.dmp family_zgrat_v1 behavioral2/memory/1108-42-0x00000180363D0000-0x00000180364E0000-memory.dmp family_zgrat_v1 behavioral2/memory/1108-46-0x000001801C990000-0x000001801C9B4000-memory.dmp family_zgrat_v1 -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
tmp.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation tmp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
tmp.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI tmp.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI tmp.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI tmp.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exepid process 1108 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1108 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1108 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1108 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1108 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1108 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1108 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1108 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1108 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1108 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1108 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1108 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1108 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1108 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1108 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1108 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1108 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1108 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1108 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1108 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1108 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1108 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1108 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1108 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1108 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1108 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exedescription pid process Token: SeDebugPrivilege 1108 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
Processes:
tmp.exepid process 3760 tmp.exe 3760 tmp.exe 3760 tmp.exe 3760 tmp.exe 3760 tmp.exe 3760 tmp.exe 3760 tmp.exe -
Suspicious use of SendNotifyMessage 7 IoCs
Processes:
tmp.exepid process 3760 tmp.exe 3760 tmp.exe 3760 tmp.exe 3760 tmp.exe 3760 tmp.exe 3760 tmp.exe 3760 tmp.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
tmp.exedescription pid process target process PID 3760 wrote to memory of 1108 3760 tmp.exe SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe PID 3760 wrote to memory of 1108 3760 tmp.exe SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Checks computer location settings
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1108-52-0x0000018036720000-0x0000018036796000-memory.dmpFilesize
472KB
-
memory/1108-77-0x0000018036200000-0x0000018036210000-memory.dmpFilesize
64KB
-
memory/1108-78-0x0000018036200000-0x0000018036210000-memory.dmpFilesize
64KB
-
memory/1108-53-0x0000018035180000-0x000001803518A000-memory.dmpFilesize
40KB
-
memory/1108-76-0x0000018036200000-0x0000018036210000-memory.dmpFilesize
64KB
-
memory/1108-39-0x00007FFA823E0000-0x00007FFA82EA1000-memory.dmpFilesize
10.8MB
-
memory/1108-40-0x00000180172E0000-0x000001801ABD8000-memory.dmpFilesize
57.0MB
-
memory/1108-41-0x0000018036200000-0x0000018036210000-memory.dmpFilesize
64KB
-
memory/1108-75-0x00007FFA823E0000-0x00007FFA82EA1000-memory.dmpFilesize
10.8MB
-
memory/1108-43-0x000001801C960000-0x000001801C970000-memory.dmpFilesize
64KB
-
memory/1108-44-0x000001801C980000-0x000001801C98C000-memory.dmpFilesize
48KB
-
memory/1108-45-0x000001801C970000-0x000001801C984000-memory.dmpFilesize
80KB
-
memory/1108-46-0x000001801C990000-0x000001801C9B4000-memory.dmpFilesize
144KB
-
memory/1108-47-0x0000018035170000-0x000001803517A000-memory.dmpFilesize
40KB
-
memory/1108-48-0x0000018036050000-0x000001803607A000-memory.dmpFilesize
168KB
-
memory/1108-49-0x0000018036210000-0x00000180362C2000-memory.dmpFilesize
712KB
-
memory/1108-50-0x0000018036620000-0x000001803669A000-memory.dmpFilesize
488KB
-
memory/1108-51-0x0000018036190000-0x00000180361F2000-memory.dmpFilesize
392KB
-
memory/1108-42-0x00000180363D0000-0x00000180364E0000-memory.dmpFilesize
1.1MB
-
memory/1108-73-0x000001803BA60000-0x000001803BA7E000-memory.dmpFilesize
120KB
-
memory/1108-63-0x000001803AAB0000-0x000001803AAE8000-memory.dmpFilesize
224KB
-
memory/1108-59-0x0000018036200000-0x0000018036210000-memory.dmpFilesize
64KB
-
memory/1108-60-0x0000018036200000-0x0000018036210000-memory.dmpFilesize
64KB
-
memory/1108-62-0x000001803B170000-0x000001803B178000-memory.dmpFilesize
32KB
-
memory/1108-61-0x0000018036200000-0x0000018036210000-memory.dmpFilesize
64KB
-
memory/1108-57-0x00000180367A0000-0x0000018036AA0000-memory.dmpFilesize
3.0MB
-
memory/1108-64-0x000001803AA80000-0x000001803AA8E000-memory.dmpFilesize
56KB
-
memory/1108-65-0x000001803BC10000-0x000001803BC1A000-memory.dmpFilesize
40KB
-
memory/1108-66-0x000001803BC20000-0x000001803BC42000-memory.dmpFilesize
136KB
-
memory/1108-67-0x000001803C170000-0x000001803C698000-memory.dmpFilesize
5.2MB
-
memory/1108-70-0x000001803B9E0000-0x000001803BA30000-memory.dmpFilesize
320KB
-
memory/1108-71-0x000001803B990000-0x000001803B99C000-memory.dmpFilesize
48KB
-
memory/1108-72-0x000001803BA30000-0x000001803BA52000-memory.dmpFilesize
136KB
-
memory/3760-24-0x0000000000400000-0x00000000008AD000-memory.dmpFilesize
4.7MB
-
memory/3760-0-0x00000000028F0000-0x00000000028F1000-memory.dmpFilesize
4KB
-
memory/3760-38-0x0000000000400000-0x00000000008AD000-memory.dmpFilesize
4.7MB
-
memory/3760-37-0x00000000028F0000-0x00000000028F1000-memory.dmpFilesize
4KB
-
memory/3760-36-0x0000000000400000-0x00000000008AD000-memory.dmpFilesize
4.7MB