zgrat | a10d2a23354cf0130e15d2bf55148e7c34131033b62500615a60bb6f13f0c53a

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08-05-2024 07:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5186cafa1e8ce4e242411acc52996aaa.exe
Size

6.1MB
MD5

5186cafa1e8ce4e242411acc52996aaa
SHA1

c14b7773f62bb601e4f910ae595cbc8d1f641c32
SHA256

a10d2a23354cf0130e15d2bf55148e7c34131033b62500615a60bb6f13f0c53a
SHA512

a351d17942033364fe8e8e48673c25a1b7988c83432961e35a036d54ab08c9a3b095b5784de9d7442e31f42e41401aaec79b3facd96fcd9a9fa93afd283eb42b
SSDEEP

196608:ZwHfJ12mWXFSrOyruZ1e1l+Sc6Z2Fd6GymVVdq:QIFSrOwk0m3a9hMA

Score

10^/10

zgrat evasion rat spyware stealer

Malware Config

Signatures

Detect ZGRat V1 3 IoCs

resource	yara_rule
behavioral2/files/0x000500000002297e-14.dat	family_zgrat_v1
behavioral2/files/0x0012000000023a52-28.dat	family_zgrat_v1
behavioral2/memory/4660-30-0x0000000000FA0000-0x000000000130A000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Disables Task Manager via registry modification
evasion

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation	BridgeChainportWebInto.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation	5186cafa1e8ce4e242411acc52996aaa.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation	MoonHack cfg helper.exe

Executes dropped EXE 3 IoCs

pid	Process
4948	MoonHack cfg helper.exe
4660	BridgeChainportWebInto.exe
1160	SearchApp.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\host\5b884080fd4f94	BridgeChainportWebInto.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\sysmon.exe	BridgeChainportWebInto.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\121e5b5079f7c0	BridgeChainportWebInto.exe
File created	C:\Program Files\dotnet\host\fontdrvhost.exe	BridgeChainportWebInto.exe
File opened for modification	C:\Program Files\dotnet\host\fontdrvhost.exe	BridgeChainportWebInto.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\PrintDialog\Assets\MoUsoCoreWorker.exe	BridgeChainportWebInto.exe
File created	C:\Windows\PrintDialog\Assets\1f93f77a7f4778	BridgeChainportWebInto.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\Local Settings	MoonHack cfg helper.exe
Key created	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\Local Settings	BridgeChainportWebInto.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4852	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2096	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe
4660	BridgeChainportWebInto.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4660	BridgeChainportWebInto.exe
Token: SeDebugPrivilege	1160	SearchApp.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 3660 wrote to memory of 4948	3660	5186cafa1e8ce4e242411acc52996aaa.exe	88
PID 3660 wrote to memory of 4948	3660	5186cafa1e8ce4e242411acc52996aaa.exe	88
PID 3660 wrote to memory of 4948	3660	5186cafa1e8ce4e242411acc52996aaa.exe	88
PID 4948 wrote to memory of 848	4948	MoonHack cfg helper.exe	91
PID 4948 wrote to memory of 848	4948	MoonHack cfg helper.exe	91
PID 4948 wrote to memory of 848	4948	MoonHack cfg helper.exe	91
PID 848 wrote to memory of 4392	848	WScript.exe	99
PID 848 wrote to memory of 4392	848	WScript.exe	99
PID 848 wrote to memory of 4392	848	WScript.exe	99
PID 4392 wrote to memory of 4852	4392	cmd.exe	101
PID 4392 wrote to memory of 4852	4392	cmd.exe	101
PID 4392 wrote to memory of 4852	4392	cmd.exe	101
PID 4392 wrote to memory of 4660	4392	cmd.exe	102
PID 4392 wrote to memory of 4660	4392	cmd.exe	102
PID 4660 wrote to memory of 4308	4660	BridgeChainportWebInto.exe	103
PID 4660 wrote to memory of 4308	4660	BridgeChainportWebInto.exe	103
PID 4308 wrote to memory of 3660	4308	cmd.exe	105
PID 4308 wrote to memory of 3660	4308	cmd.exe	105
PID 4308 wrote to memory of 2096	4308	cmd.exe	106
PID 4308 wrote to memory of 2096	4308	cmd.exe	106
PID 4308 wrote to memory of 1160	4308	cmd.exe	107
PID 4308 wrote to memory of 1160	4308	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\5186cafa1e8ce4e242411acc52996aaa.exe
"C:\Users\Admin\AppData\Local\Temp\5186cafa1e8ce4e242411acc52996aaa.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe
  "C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\componentRuntimehost\qJhC.vbe"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:848
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\componentRuntimehost\ZSAMlm727VnRbcACh79Hay0D7R9lrDKrBu.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4392
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:4852
    - - C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe
        
        "C:\Users\Admin\AppData\Roaming\componentRuntimehost/BridgeChainportWebInto.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4660
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8GrgZnUaQS.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4308
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:3660
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        Runs ping.exe
        
        PID:2096
        
        C:\Users\Default\SendTo\SearchApp.exe
        
        "C:\Users\Default\SendTo\SearchApp.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8GrgZnUaQS.bat

Filesize
165B

MD5
ede4ccd6ed1a967f67917bb39914c14f

SHA1
741baefb370040cfffb85cb380e75aaf9b5f4e64

SHA256
e497ad671fc67ec464d6fa34069e6d87367a4aa3af82a6e1eb68526789563b5a

SHA512
8f57a4dff49280491013f3e2888fcce79e5556f893fe44638c762e9ad13f5e21ba140f6f395da81005dc85bfd9062fd698eeae57b5ef828fe33bc3b6699df990

Download Submit
C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe

Filesize
3.9MB

MD5
2cf0a29383fd0b2054138434eed1b265

SHA1
84138a0182af9ef5c6b31255bd85707e0ad6a0c3

SHA256
e4011f2b2426a6fcb2f48317c8623a9d7583b782b2a4f10caee19f0df70b4185

SHA512
3977b288e3512184bed9ead0947f35cb6e3c95c83a517cadd8c63ed642fbb47a41e9ac30c43a0f877ed33bd13a482e082c308081b387e7d339f71c3582da91ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\injector.exe

Filesize
11.4MB

MD5
af3137e67eabdae073fdc900f863f6a8

SHA1
53d956673d51d05f17374a778fa08c70f3d33372

SHA256
659517254a9b0f0478c4f601326dd9d9afd8f86308179e202fe6b89184b9a0c9

SHA512
4edbdcee2328256a7fa01c0b4aaa18f24a4c392269cefdcdad34bf2b222edd4332b654da36223925dd1769eb463e5163344342da30f1dd2f7fd54fa64c9bb4ad

Download Submit
C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe

Filesize
3.4MB

MD5
51a33d556ce031ad0a5e752f10b00a13

SHA1
f05e11e3034481de8590ee4afd912628cacfde9a

SHA256
eab0d35dc956885b222e69fde419f3974db712c98bbb23f41325388bde0cc341

SHA512
c27a18ebee3e32854e4ad136c3af7de753764a9b44fc024487eb4a197a3f68b506f8578c4beab63e23c64b4e8ce10d63d2987b78175a9691e9aec9fc13887356

Download Submit
C:\Users\Admin\AppData\Roaming\componentRuntimehost\ZSAMlm727VnRbcACh79Hay0D7R9lrDKrBu.bat

Filesize
212B

MD5
f4846b111f4c8ced35bf1ed60502270f

SHA1
625bb8296688ca9cde0c60c60cc17ed83383050c

SHA256
2b20a48f281b60176569332a9e56f5aa7911ba9793f87f9729aafc81aab5a6cd

SHA512
ef77a850b15f988754eb17c48ce84e15bcf824c4bcc64ac7f5f372f86fee5738de67417fd0cf56271d1701b5256edcf4ad8603b5fab28016af8e28359967df67

Download Submit
C:\Users\Admin\AppData\Roaming\componentRuntimehost\qJhC.vbe

Filesize
240B

MD5
cf441f15daf3339180706cf594e97131

SHA1
ca5663745d79bd9196fea24b51d6061f79355d3c

SHA256
9a2afde59f2326a4cfbc827e87c7270da20d4a6e19e8d00b5b3a479c26f8ad13

SHA512
37d2b08ca78ee06fbcc93577a31a243670fd4efce506449e2e4e3b33c2319081e1f905f8651a642112386620f6551c1a598cdc7f69e682ee252fddc2fa9cde74

Download Submit
memory/1160-111-0x000000001D050000-0x000000001D11D000-memory.dmp

Filesize
820KB

Download
memory/3660-0-0x00007FFFB0323000-0x00007FFFB0325000-memory.dmp

Filesize
8KB

Download
memory/3660-1-0x00000000007A0000-0x0000000000DC6000-memory.dmp

Filesize
6.1MB

Download
memory/3660-2-0x00007FFFB0320000-0x00007FFFB0DE1000-memory.dmp

Filesize
10.8MB

Download
memory/3660-16-0x00007FFFB0320000-0x00007FFFB0DE1000-memory.dmp

Filesize
10.8MB

Download
memory/4660-43-0x0000000003540000-0x0000000003550000-memory.dmp

Filesize
64KB

Download
memory/4660-55-0x000000001CD60000-0x000000001CD72000-memory.dmp

Filesize
72KB

Download
memory/4660-37-0x000000001C010000-0x000000001C060000-memory.dmp

Filesize
320KB

Download
memory/4660-39-0x0000000001C00000-0x0000000001C10000-memory.dmp

Filesize
64KB

Download
memory/4660-41-0x000000001BFC0000-0x000000001BFD8000-memory.dmp

Filesize
96KB

Download
memory/4660-34-0x0000000001BF0000-0x0000000001BFE000-memory.dmp

Filesize
56KB

Download
memory/4660-45-0x000000001BF60000-0x000000001BF70000-memory.dmp

Filesize
64KB

Download
memory/4660-47-0x000000001BF70000-0x000000001BF7E000-memory.dmp

Filesize
56KB

Download
memory/4660-49-0x000000001CD20000-0x000000001CD32000-memory.dmp

Filesize
72KB

Download
memory/4660-51-0x000000001BF80000-0x000000001BF90000-memory.dmp

Filesize
64KB

Download
memory/4660-53-0x000000001CD40000-0x000000001CD56000-memory.dmp

Filesize
88KB

Download
memory/4660-36-0x000000001BFA0000-0x000000001BFBC000-memory.dmp

Filesize
112KB

Download
memory/4660-56-0x000000001D2B0000-0x000000001D7D8000-memory.dmp

Filesize
5.2MB

Download
memory/4660-58-0x000000001BFE0000-0x000000001BFF0000-memory.dmp

Filesize
64KB

Download
memory/4660-60-0x000000001BFF0000-0x000000001C000000-memory.dmp

Filesize
64KB

Download
memory/4660-62-0x000000001CDE0000-0x000000001CE3A000-memory.dmp

Filesize
360KB

Download
memory/4660-64-0x000000001C000000-0x000000001C00E000-memory.dmp

Filesize
56KB

Download
memory/4660-66-0x000000001CDA0000-0x000000001CDB8000-memory.dmp

Filesize
96KB

Download
memory/4660-68-0x000000001CD80000-0x000000001CD8C000-memory.dmp

Filesize
48KB

Download
memory/4660-70-0x000000001CE90000-0x000000001CEDE000-memory.dmp

Filesize
312KB

Download
memory/4660-87-0x000000001D7E0000-0x000000001D8AD000-memory.dmp

Filesize
820KB

Download
memory/4660-32-0x000000001BF30000-0x000000001BF56000-memory.dmp

Filesize
152KB

Download
memory/4660-30-0x0000000000FA0000-0x000000000130A000-memory.dmp

Filesize
3.4MB

Download