Analysis
- max time kernel
123s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
12/05/2024, 01:02
General
- Target 0bb1f1573597153cfc103837c100ad94a69b1ec04b16d71ad37c5ae30b7fd5a6.exe
- Size 632KB
- Sample240512-bdv7labh83
- SHA256 0bb1f1573597153cfc103837c100ad94a69b1ec04b16d71ad37c5ae30b7fd5a6
Malware Config
Signatures
- Detect ZGRat V1 1 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Executes dropped EXE 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0bb1f1573597153cfc103837c100ad94a69b1ec04b16d71ad37c5ae30b7fd5a6.exe"C:\Users\Admin\AppData\Local\Temp\0bb1f1573597153cfc103837c100ad94a69b1ec04b16d71ad37c5ae30b7fd5a6.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\HasCurrent\Handle.exeC:\Users\Admin\AppData\Roaming\HasCurrent\Handle.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Handle.exe
memory/2344-17-0x00007FFEFB380000-0x00007FFEFBE41000-memory.dmp
memory/2344-16-0x00007FFEFB380000-0x00007FFEFBE41000-memory.dmp
memory/2344-15-0x00007FFEFB380000-0x00007FFEFBE41000-memory.dmp
memory/2344-14-0x00007FFEFB380000-0x00007FFEFBE41000-memory.dmp
memory/2344-13-0x00007FFEFB380000-0x00007FFEFBE41000-memory.dmp
memory/5060-3-0x00007FFEFB380000-0x00007FFEFBE41000-memory.dmp
memory/5060-10-0x00007FFEFB380000-0x00007FFEFBE41000-memory.dmp
memory/5060-6-0x00000287FC7E0000-0x00000287FC834000-memory.dmp
memory/5060-4-0x00000287FC5F0000-0x00000287FC646000-memory.dmp
memory/5060-5-0x00000287FC650000-0x00000287FC69C000-memory.dmp
memory/5060-0-0x00000287E2040000-0x00000287E20E2000-memory.dmp
memory/5060-2-0x00000287E3DA0000-0x00000287E3EA4000-memory.dmp
memory/5060-1-0x00007FFEFB383000-0x00007FFEFB385000-memory.dmp