Analysis
- max time kernel
142s - max time network
128s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
14/05/2024, 01:18
General
- Target 62990bd81297a42bf5348c15a196e488a531420d12869392c5bd0724ca997c9d.exe
- Size 439KB
- Sample240514-bpec8adc71
- SHA256 62990bd81297a42bf5348c15a196e488a531420d12869392c5bd0724ca997c9d
Malware Config
Signatures
- Detect ZGRat V1 34 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\62990bd81297a42bf5348c15a196e488a531420d12869392c5bd0724ca997c9d.exe"C:\Users\Admin\AppData\Local\Temp\62990bd81297a42bf5348c15a196e488a531420d12869392c5bd0724ca997c9d.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name '62990bd81297a42bf5348c15a196e488a531420d12869392c5bd0724ca997c9d';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name '62990bd81297a42bf5348c15a196e488a531420d12869392c5bd0724ca997c9d' -Value '"C:\Users\Admin\AppData\Roaming\62990bd81297a42bf5348c15a196e488a531420d12869392c5bd0724ca997c9d.exe"' -PropertyType 'String'2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_u4wfrznw.ddt.ps1
memory/1320-53-0x000000001B950000-0x000000001BA27000-memory.dmp
memory/1320-31-0x000000001B950000-0x000000001BA27000-memory.dmp
memory/1320-4-0x000000001B950000-0x000000001BA27000-memory.dmp
memory/1320-11-0x000000001B950000-0x000000001BA27000-memory.dmp
memory/1320-27-0x000000001B950000-0x000000001BA27000-memory.dmp
memory/1320-29-0x000000001B950000-0x000000001BA27000-memory.dmp
memory/1320-25-0x000000001B950000-0x000000001BA27000-memory.dmp
memory/1320-23-0x000000001B950000-0x000000001BA27000-memory.dmp
memory/1320-21-0x000000001B950000-0x000000001BA27000-memory.dmp
memory/1320-51-0x000000001B950000-0x000000001BA27000-memory.dmp
memory/1320-0-0x00007FFC36DE3000-0x00007FFC36DE5000-memory.dmp
memory/1320-45-0x000000001B950000-0x000000001BA27000-memory.dmp
memory/1320-47-0x000000001B950000-0x000000001BA27000-memory.dmp
memory/1320-67-0x000000001B950000-0x000000001BA27000-memory.dmp
memory/1320-65-0x000000001B950000-0x000000001BA27000-memory.dmp
memory/1320-63-0x000000001B950000-0x000000001BA27000-memory.dmp
memory/1320-61-0x000000001B950000-0x000000001BA27000-memory.dmp
memory/1320-57-0x000000001B950000-0x000000001BA27000-memory.dmp
memory/1320-55-0x000000001B950000-0x000000001BA27000-memory.dmp
memory/1320-49-0x000000001B950000-0x000000001BA27000-memory.dmp
memory/1320-41-0x000000001B950000-0x000000001BA27000-memory.dmp
memory/1320-35-0x000000001B950000-0x000000001BA27000-memory.dmp
memory/1320-2-0x000000001B950000-0x000000001BA2C000-memory.dmp
memory/1320-59-0x000000001B950000-0x000000001BA27000-memory.dmp
memory/1320-19-0x000000001B950000-0x000000001BA27000-memory.dmp
memory/1320-43-0x000000001B950000-0x000000001BA27000-memory.dmp
memory/1320-39-0x000000001B950000-0x000000001BA27000-memory.dmp
memory/1320-37-0x000000001B950000-0x000000001BA27000-memory.dmp
memory/1320-33-0x000000001B950000-0x000000001BA27000-memory.dmp
memory/1320-15-0x000000001B950000-0x000000001BA27000-memory.dmp
memory/1320-13-0x000000001B950000-0x000000001BA27000-memory.dmp
memory/1320-9-0x000000001B950000-0x000000001BA27000-memory.dmp
memory/1320-7-0x000000001B950000-0x000000001BA27000-memory.dmp
memory/1320-5-0x000000001B950000-0x000000001BA27000-memory.dmp
memory/1320-17-0x000000001B950000-0x000000001BA27000-memory.dmp
memory/1320-3-0x00007FFC36DE0000-0x00007FFC378A1000-memory.dmp
memory/1320-1-0x0000000000C90000-0x0000000000D04000-memory.dmp
memory/1320-6342-0x00007FFC36DE0000-0x00007FFC378A1000-memory.dmp
memory/1320-6341-0x00007FFC36DE0000-0x00007FFC378A1000-memory.dmp
memory/1320-6340-0x00007FFC36DE3000-0x00007FFC36DE5000-memory.dmp
memory/1320-6339-0x00007FFC36DE0000-0x00007FFC378A1000-memory.dmp
memory/1320-6336-0x00007FFC36DE0000-0x00007FFC378A1000-memory.dmp
memory/5564-6334-0x00007FFC36DE0000-0x00007FFC378A1000-memory.dmp
memory/5564-6333-0x00007FFC36DE0000-0x00007FFC378A1000-memory.dmp
memory/5564-6323-0x000001B0D54D0000-0x000001B0D54F2000-memory.dmp
memory/5564-6330-0x00007FFC36DE0000-0x00007FFC378A1000-memory.dmp
memory/5564-6329-0x00007FFC36DE0000-0x00007FFC378A1000-memory.dmp
memory/5564-6328-0x00007FFC36DE0000-0x00007FFC378A1000-memory.dmp