Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    14-05-2024 04:45

General

  • Target

    db537a09e0185f8b941af6a5d2ceda40.exe

  • Size

    596KB

  • MD5

    db537a09e0185f8b941af6a5d2ceda40

  • SHA1

    8747013070a23b3d9dd386c1baab0cb79cff3786

  • SHA256

    2a111b1a6650ea6e6b369583f8afe1bf8c5bb6164cb12f8e833d0638c1c2deaf

  • SHA512

    1ecd816a35c50ccbb78a3911d517fe292c4ac8431cc54446ffd3136657dc0d1cc793800c5c5bef31cd76847c0c2cf1968c87f68b841a4bd245e1ced7ab3a37c7

  • SSDEEP

    12288:Z48Xz4N3jJuKiMGejML/ldDKdgM/pMp00TIhmP8mWdCcLxUX0M39F+n:ePNT0KR/MqdgMhr6IhmkmWXuEM3Cn

Malware Config

Signatures

  • Detect ZGRat V1 34 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Downloads MZ/PE file
  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Suspicious use of SetThreadContext 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\db537a09e0185f8b941af6a5d2ceda40.exe
    "C:\Users\Admin\AppData\Local\Temp\db537a09e0185f8b941af6a5d2ceda40.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2364
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {ADF40CD1-EED2-4AA0-B62F-DDC0F450DBFA} S-1-5-21-3452737119-3959686427-228443150-1000:QGTQZTRE\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:7568
    • C:\Users\Admin\AppData\Local\Temp\ajgdmb.exe
      C:\Users\Admin\AppData\Local\Temp\ajgdmb.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:7600
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
        "Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\ajgdmb.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ajgdmb.exe' -Force
        3⤵
        • Drops startup file
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:7720
      • C:\Users\Admin\AppData\Local\Temp\ajgdmb.exe
        "C:\Users\Admin\AppData\Local\Temp\ajgdmb.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of AdjustPrivilegeToken
        PID:7768

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ajgdmb.exe

    Filesize

    26KB

    MD5

    1f90151f3470f316a645a6617534a0be

    SHA1

    80dd3641418ff22c353b2d1f0f4c86990cfdaee1

    SHA256

    aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c

    SHA512

    5609219d6a7ece553032589d9765e7fcf394253fa4df5d64539e231a4350bf9c8b3bfd2ec5ca1904a6584b793f3a174353261e23983f7ac428b7957379eccbcf

  • memory/2364-0-0x00000000744DE000-0x00000000744DF000-memory.dmp

    Filesize

    4KB

  • memory/2364-1-0x0000000000190000-0x000000000022C000-memory.dmp

    Filesize

    624KB

  • memory/2364-2-0x0000000004790000-0x0000000004878000-memory.dmp

    Filesize

    928KB

  • memory/2364-3-0x00000000744D0000-0x0000000074BBE000-memory.dmp

    Filesize

    6.9MB

  • memory/2364-4-0x0000000004790000-0x0000000004872000-memory.dmp

    Filesize

    904KB

  • memory/2364-5-0x0000000004790000-0x0000000004872000-memory.dmp

    Filesize

    904KB

  • memory/2364-25-0x0000000004790000-0x0000000004872000-memory.dmp

    Filesize

    904KB

  • memory/2364-7-0x0000000004790000-0x0000000004872000-memory.dmp

    Filesize

    904KB

  • memory/2364-44-0x0000000004790000-0x0000000004872000-memory.dmp

    Filesize

    904KB

  • memory/2364-48-0x0000000004790000-0x0000000004872000-memory.dmp

    Filesize

    904KB

  • memory/2364-42-0x0000000004790000-0x0000000004872000-memory.dmp

    Filesize

    904KB

  • memory/2364-9-0x0000000004790000-0x0000000004872000-memory.dmp

    Filesize

    904KB

  • memory/2364-61-0x0000000004790000-0x0000000004872000-memory.dmp

    Filesize

    904KB

  • memory/2364-63-0x0000000004790000-0x0000000004872000-memory.dmp

    Filesize

    904KB

  • memory/2364-11-0x0000000004790000-0x0000000004872000-memory.dmp

    Filesize

    904KB

  • memory/2364-13-0x0000000004790000-0x0000000004872000-memory.dmp

    Filesize

    904KB

  • memory/2364-15-0x0000000004790000-0x0000000004872000-memory.dmp

    Filesize

    904KB

  • memory/2364-17-0x0000000004790000-0x0000000004872000-memory.dmp

    Filesize

    904KB

  • memory/2364-21-0x0000000004790000-0x0000000004872000-memory.dmp

    Filesize

    904KB

  • memory/2364-27-0x0000000004790000-0x0000000004872000-memory.dmp

    Filesize

    904KB

  • memory/2364-31-0x0000000004790000-0x0000000004872000-memory.dmp

    Filesize

    904KB

  • memory/2364-51-0x0000000004790000-0x0000000004872000-memory.dmp

    Filesize

    904KB

  • memory/2364-67-0x0000000004790000-0x0000000004872000-memory.dmp

    Filesize

    904KB

  • memory/2364-65-0x0000000004790000-0x0000000004872000-memory.dmp

    Filesize

    904KB

  • memory/2364-59-0x0000000004790000-0x0000000004872000-memory.dmp

    Filesize

    904KB

  • memory/2364-57-0x0000000004790000-0x0000000004872000-memory.dmp

    Filesize

    904KB

  • memory/2364-55-0x0000000004790000-0x0000000004872000-memory.dmp

    Filesize

    904KB

  • memory/2364-54-0x0000000004790000-0x0000000004872000-memory.dmp

    Filesize

    904KB

  • memory/2364-49-0x0000000004790000-0x0000000004872000-memory.dmp

    Filesize

    904KB

  • memory/2364-46-0x0000000004790000-0x0000000004872000-memory.dmp

    Filesize

    904KB

  • memory/2364-39-0x0000000004790000-0x0000000004872000-memory.dmp

    Filesize

    904KB

  • memory/2364-37-0x0000000004790000-0x0000000004872000-memory.dmp

    Filesize

    904KB

  • memory/2364-35-0x0000000004790000-0x0000000004872000-memory.dmp

    Filesize

    904KB

  • memory/2364-33-0x0000000004790000-0x0000000004872000-memory.dmp

    Filesize

    904KB

  • memory/2364-29-0x0000000004790000-0x0000000004872000-memory.dmp

    Filesize

    904KB

  • memory/2364-23-0x0000000004790000-0x0000000004872000-memory.dmp

    Filesize

    904KB

  • memory/2364-19-0x0000000004790000-0x0000000004872000-memory.dmp

    Filesize

    904KB

  • memory/2364-2204-0x00000000021A0000-0x00000000021F6000-memory.dmp

    Filesize

    344KB

  • memory/2364-2205-0x00000000008B0000-0x00000000008FC000-memory.dmp

    Filesize

    304KB

  • memory/2364-2206-0x0000000004880000-0x00000000048D4000-memory.dmp

    Filesize

    336KB

  • memory/2364-2213-0x00000000744DE000-0x00000000744DF000-memory.dmp

    Filesize

    4KB

  • memory/2364-2215-0x00000000744D0000-0x0000000074BBE000-memory.dmp

    Filesize

    6.9MB

  • memory/7600-2211-0x00000000744D0000-0x0000000074BBE000-memory.dmp

    Filesize

    6.9MB

  • memory/7600-2212-0x00000000009A0000-0x00000000009AC000-memory.dmp

    Filesize

    48KB

  • memory/7600-2214-0x00000000744D0000-0x0000000074BBE000-memory.dmp

    Filesize

    6.9MB

  • memory/7600-2216-0x0000000005930000-0x0000000005A04000-memory.dmp

    Filesize

    848KB

  • memory/7600-2239-0x00000000744D0000-0x0000000074BBE000-memory.dmp

    Filesize

    6.9MB

  • memory/7768-2233-0x0000000000400000-0x00000000004A8000-memory.dmp

    Filesize

    672KB

  • memory/7768-2234-0x0000000004450000-0x0000000004516000-memory.dmp

    Filesize

    792KB

  • memory/7768-3088-0x0000000000910000-0x0000000000966000-memory.dmp

    Filesize

    344KB