Analysis
- max time kernel
83s - max time network
87s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
23/04/2024, 15:47
General
- Target Roblox hack.exe
- Size 3.5MB
- Sample240423-s8hneshf49
- SHA256 098f72956ae628945752499efc5539872ddb05ddd19e1acfaf5514bf8dbbb421
Malware Config
Signatures
- Detect ZGRat V1 2 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Disables Task Manager via registry modification
- Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 3 IoCs
- Modifies registry key 1 TTPs 1 IoCs
- Runs ping.exe 1 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 25 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Roblox hack.exe"C:\Users\Admin\AppData\Local\Temp\Roblox hack.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\componentWinref\4aXYQx.vbe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\componentWinref\oXrN2aaWIh7WYBOgkj9cgqJYBi7d.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f4⤵
- Modifies registry key
-
-
C:\componentWinref\portRuntimedllsvc.exe"C:\componentWinref/portRuntimedllsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9TaT0MrFFo.bat"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650016⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost6⤵
- Runs ping.exe
-
-
C:\componentWinref\SppExtComObj.exe"C:\componentWinref\SppExtComObj.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Jlvf1Vq2YP.bat"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost8⤵
- Runs ping.exe
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
27d1bcfc3c54e0
eddb19405b7ce1
9TaT0MrFFo.bat
Jlvf1Vq2YP.bat
088424020bedd6
0a1fd5f707cd16
4aXYQx.vbe
e1ef82546f0b02
oXrN2aaWIh7WYBOgkj9cgqJYBi7d.bat
portRuntimedllsvc.exe
memory/3140-54-0x000000001B170000-0x000000001B180000-memory.dmp
memory/3140-61-0x00007FF88BC50000-0x00007FF88BD0E000-memory.dmp
memory/3140-16-0x000000001B170000-0x000000001B180000-memory.dmp
memory/3140-17-0x000000001B170000-0x000000001B180000-memory.dmp
memory/3140-21-0x00007FF88BBA0000-0x00007FF88BBA1000-memory.dmp
memory/3140-20-0x00007FF88BC50000-0x00007FF88BD0E000-memory.dmp
memory/3140-19-0x0000000000DE0000-0x0000000000E06000-memory.dmp
memory/3140-22-0x00007FF88BC50000-0x00007FF88BD0E000-memory.dmp
memory/3140-25-0x0000000000B50000-0x0000000000B5E000-memory.dmp
memory/3140-23-0x00007FF88BB90000-0x00007FF88BB91000-memory.dmp
memory/3140-28-0x00007FF88BB80000-0x00007FF88BB81000-memory.dmp
memory/3140-27-0x0000000000E10000-0x0000000000E2C000-memory.dmp
memory/3140-29-0x000000001BC30000-0x000000001BC80000-memory.dmp
memory/3140-31-0x0000000000DB0000-0x0000000000DC0000-memory.dmp
memory/3140-32-0x00007FF88BB70000-0x00007FF88BB71000-memory.dmp
memory/3140-34-0x0000000000E30000-0x0000000000E48000-memory.dmp
memory/3140-36-0x0000000000DC0000-0x0000000000DD0000-memory.dmp
memory/3140-37-0x00007FF86D730000-0x00007FF86E1F1000-memory.dmp
memory/3140-39-0x0000000000DD0000-0x0000000000DE0000-memory.dmp
memory/3140-41-0x00007FF88BB40000-0x00007FF88BB41000-memory.dmp
memory/3140-40-0x00007FF88BB60000-0x00007FF88BB61000-memory.dmp
memory/3140-44-0x0000000000E50000-0x0000000000E5E000-memory.dmp
memory/3140-42-0x00007FF88BB50000-0x00007FF88BB51000-memory.dmp
memory/3140-45-0x000000001B170000-0x000000001B180000-memory.dmp
memory/3140-46-0x00007FF88BB30000-0x00007FF88BB31000-memory.dmp
memory/3140-49-0x00007FF88BB20000-0x00007FF88BB21000-memory.dmp
memory/3140-48-0x0000000002710000-0x000000000271C000-memory.dmp
memory/3140-50-0x000000001B170000-0x000000001B180000-memory.dmp
memory/3140-51-0x00007FF88BB10000-0x00007FF88BB11000-memory.dmp
memory/3140-53-0x0000000002740000-0x0000000002752000-memory.dmp
memory/3140-14-0x000000001B170000-0x000000001B180000-memory.dmp
memory/3140-57-0x0000000002720000-0x000000000272C000-memory.dmp
memory/3140-55-0x00007FF88BC50000-0x00007FF88BD0E000-memory.dmp
memory/3140-58-0x00007FF88BB00000-0x00007FF88BB01000-memory.dmp
memory/3140-60-0x0000000002730000-0x0000000002740000-memory.dmp
memory/3140-15-0x0000000000AD0000-0x0000000000AD1000-memory.dmp
memory/3140-62-0x00007FF88AFA0000-0x00007FF88AFA1000-memory.dmp
memory/3140-64-0x000000001BC80000-0x000000001BC96000-memory.dmp
memory/3140-65-0x00007FF88AF90000-0x00007FF88AF91000-memory.dmp
memory/3140-67-0x000000001BCA0000-0x000000001BCB2000-memory.dmp
memory/3140-68-0x00007FF88AF80000-0x00007FF88AF81000-memory.dmp
memory/3140-69-0x000000001C1F0000-0x000000001C718000-memory.dmp
memory/3140-70-0x00007FF88AF70000-0x00007FF88AF71000-memory.dmp
memory/3140-72-0x0000000002760000-0x000000000276E000-memory.dmp
memory/3140-75-0x00007FF88AF60000-0x00007FF88AF61000-memory.dmp
memory/3140-74-0x0000000002770000-0x0000000002780000-memory.dmp
memory/3140-76-0x00007FF88AF50000-0x00007FF88AF51000-memory.dmp
memory/3140-78-0x000000001BCC0000-0x000000001BCD0000-memory.dmp
memory/3140-79-0x00007FF88AF40000-0x00007FF88AF41000-memory.dmp
memory/3140-81-0x000000001BD30000-0x000000001BD8A000-memory.dmp
memory/3140-83-0x000000001BCD0000-0x000000001BCDE000-memory.dmp
memory/3140-84-0x00007FF88AF30000-0x00007FF88AF31000-memory.dmp
memory/3140-86-0x000000001BCE0000-0x000000001BCF0000-memory.dmp
memory/3140-87-0x00007FF88AF20000-0x00007FF88AF21000-memory.dmp
memory/3140-90-0x000000001BCF0000-0x000000001BCFE000-memory.dmp
memory/3140-88-0x00007FF88AE80000-0x00007FF88AE81000-memory.dmp
memory/3140-92-0x000000001BD90000-0x000000001BDA8000-memory.dmp
memory/3140-93-0x00007FF88AE70000-0x00007FF88AE71000-memory.dmp
memory/3140-95-0x000000001BD00000-0x000000001BD0C000-memory.dmp
memory/3140-96-0x00007FF88AE60000-0x00007FF88AE61000-memory.dmp
memory/3140-97-0x00007FF88AE50000-0x00007FF88AE51000-memory.dmp
memory/3140-99-0x000000001BE00000-0x000000001BE4E000-memory.dmp
memory/3140-13-0x00007FF86D730000-0x00007FF86E1F1000-memory.dmp
memory/3140-115-0x000000001C820000-0x000000001C8C9000-memory.dmp
memory/3140-116-0x000000001BDB0000-0x000000001BDFE000-memory.dmp
memory/3140-12-0x00000000000B0000-0x0000000000450000-memory.dmp
memory/3852-217-0x000000001DF80000-0x000000001DFCE000-memory.dmp
memory/3852-237-0x000000001CC50000-0x000000001CCF9000-memory.dmp
memory/3852-238-0x000000001DF80000-0x000000001DFCE000-memory.dmp
memory/3852-216-0x000000001CC50000-0x000000001CCF9000-memory.dmp