Analysis
- max time kernel
137s - max time network
129s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
12/05/2024, 13:31
General
- Target 776e97dad3071bc1fd1ac1365cf8c743.exe
- Size 3.3MB
- Sample240512-qsc2wsbf97
- SHA256 94e42c4fee044a71b982054b06a77bc335aaf1e542f66422a75de3ea207dd77a
Malware Config
Signatures
- Detect ZGRat V1 3 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 3 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Delays execution with timeout.exe 1 IoCs
- Modifies registry class 2 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 23 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\776e97dad3071bc1fd1ac1365cf8c743.exe"C:\Users\Admin\AppData\Local\Temp\776e97dad3071bc1fd1ac1365cf8c743.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\мой билд (2).exe"C:\Users\Admin\AppData\Local\Temp\мой билд (2).exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\мой билд.exe"C:\Users\Admin\AppData\Local\Temp\мой билд.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\surrogateFontWin\FxEsHofdY3CkZxo9NE8wRbgFeALKgU47U7PRpcYvRm.vbe"4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\surrogateFontWin\eZnqBD8zv5t5.bat" "5⤵
- Suspicious use of WriteProcessMemory
-
C:\surrogateFontWin\surrogateRuntime.exe"C:\surrogateFontWin/surrogateRuntime.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vlZZCFJNsh.bat"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost8⤵
- Runs ping.exe
-
-
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp48A2.tmp.bat""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
tmp48A2.tmp.bat
vlZZCFJNsh.bat
мой билд (2).exe
мой билд.exe
FxEsHofdY3CkZxo9NE8wRbgFeALKgU47U7PRpcYvRm.vbe
eZnqBD8zv5t5.bat
surrogateRuntime.exe
memory/2680-16-0x00007FFA54790000-0x00007FFA55251000-memory.dmp
memory/2680-17-0x0000000000170000-0x00000000004C8000-memory.dmp
memory/2680-18-0x00007FFA54790000-0x00007FFA55251000-memory.dmp
memory/2680-30-0x00007FFA54790000-0x00007FFA55251000-memory.dmp
memory/3456-50-0x000000001BC80000-0x000000001BC9C000-memory.dmp
memory/3456-67-0x000000001CA70000-0x000000001CA86000-memory.dmp
memory/3456-131-0x000000001D510000-0x000000001D5B9000-memory.dmp
memory/3456-44-0x0000000000CC0000-0x000000000104E000-memory.dmp
memory/3456-46-0x000000001C660000-0x000000001C686000-memory.dmp
memory/3456-48-0x000000001BC50000-0x000000001BC5E000-memory.dmp
memory/3456-51-0x000000001C9E0000-0x000000001CA30000-memory.dmp
memory/3456-53-0x000000001BC60000-0x000000001BC70000-memory.dmp
memory/3456-55-0x000000001C9B0000-0x000000001C9C8000-memory.dmp
memory/3456-91-0x000000001D510000-0x000000001D5B9000-memory.dmp
memory/3456-57-0x000000001BC70000-0x000000001BC80000-memory.dmp
memory/3456-59-0x000000001C990000-0x000000001C9A0000-memory.dmp
memory/3456-61-0x000000001C9A0000-0x000000001C9AE000-memory.dmp
memory/3456-63-0x000000001CA50000-0x000000001CA62000-memory.dmp
memory/3456-65-0x000000001C9D0000-0x000000001C9E0000-memory.dmp
memory/3456-90-0x000000001CDF0000-0x000000001CE3E000-memory.dmp
memory/3456-69-0x000000001CA90000-0x000000001CAA2000-memory.dmp
memory/3456-70-0x000000001CFE0000-0x000000001D508000-memory.dmp
memory/3456-72-0x000000001CA30000-0x000000001CA3E000-memory.dmp
memory/3456-74-0x000000001CA40000-0x000000001CA50000-memory.dmp
memory/3456-76-0x000000001CAB0000-0x000000001CAC0000-memory.dmp
memory/3456-78-0x000000001CB20000-0x000000001CB7A000-memory.dmp
memory/3456-80-0x000000001CAC0000-0x000000001CACE000-memory.dmp
memory/3456-82-0x000000001CAD0000-0x000000001CAE0000-memory.dmp
memory/3456-84-0x000000001CAE0000-0x000000001CAEE000-memory.dmp
memory/3456-86-0x000000001CD80000-0x000000001CD98000-memory.dmp
memory/3456-88-0x000000001CAF0000-0x000000001CAFC000-memory.dmp
memory/3900-15-0x00007FFA54790000-0x00007FFA55251000-memory.dmp
memory/3900-0-0x00007FFA54793000-0x00007FFA54795000-memory.dmp
memory/3900-3-0x00007FFA54790000-0x00007FFA55251000-memory.dmp
memory/3900-1-0x00000000009A0000-0x0000000000CF8000-memory.dmp