zgrat | 0bb1f1573597153cfc103837c100ad94a69b1ec04b16d71ad37c5ae30b7fd5a6

Analysis

max time kernel
144s
max time network
141s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
14-05-2024 04:47

Target

0bb1f1573597153cfc103837c100ad94a69b1ec04b16d71ad37c5ae30b7fd5a6.exe
Size

632KB
MD5

39717fb1aedf9d38856d2e9c94304168
SHA1

8d89cd3746585dccf4e2ab0aa921dac3fbefb638
SHA256

0bb1f1573597153cfc103837c100ad94a69b1ec04b16d71ad37c5ae30b7fd5a6
SHA512

09a5faa343abb0ce19e94418f7221ca6425d9f86ffaaed963f7cca7576f8bb079c38e2e63637924ccc8c2de0618cc8217dee8358a231bcbcab3d5a4c356084fd
SSDEEP

12288:LRHWGJEj1S0yB1dk695iqrV/ou71zs9rfB8KIANImH9gF44Aar:FHZEJfc1dkQ51BRgfB8KD3HSLAar

Score

10^/10

zgrat rat

Detect ZGRat V1 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/724-2-0x000001D52BA70000-0x000001D52BB74000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Executes dropped EXE 1 IoCs

Processes:

Handle.exe

pid process

3880 Handle.exe

pid	process
3880	Handle.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

0bb1f1573597153cfc103837c100ad94a69b1ec04b16d71ad37c5ae30b7fd5a6.exeHandle.exe

description	pid	process
Token: SeDebugPrivilege	724	0bb1f1573597153cfc103837c100ad94a69b1ec04b16d71ad37c5ae30b7fd5a6.exe
Token: SeDebugPrivilege	3880	Handle.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\0bb1f1573597153cfc103837c100ad94a69b1ec04b16d71ad37c5ae30b7fd5a6.exe
"C:\Users\Admin\AppData\Local\Temp\0bb1f1573597153cfc103837c100ad94a69b1ec04b16d71ad37c5ae30b7fd5a6.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:724

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\HasCurrent\Handle.exe
Filesize
632KB

MD5
39717fb1aedf9d38856d2e9c94304168

SHA1
8d89cd3746585dccf4e2ab0aa921dac3fbefb638

SHA256
0bb1f1573597153cfc103837c100ad94a69b1ec04b16d71ad37c5ae30b7fd5a6

SHA512
09a5faa343abb0ce19e94418f7221ca6425d9f86ffaaed963f7cca7576f8bb079c38e2e63637924ccc8c2de0618cc8217dee8358a231bcbcab3d5a4c356084fd

Download Submit
memory/724-1-0x00007FFDA2C73000-0x00007FFDA2C75000-memory.dmp

Filesize
8KB

Download
memory/724-0-0x000001D5114A0000-0x000001D511542000-memory.dmp

Filesize
648KB

Download
memory/724-2-0x000001D52BA70000-0x000001D52BB74000-memory.dmp

Filesize
1.0MB

Download
memory/724-3-0x00007FFDA2C70000-0x00007FFDA3732000-memory.dmp

Filesize
10.8MB

Download
memory/724-4-0x000001D513200000-0x000001D513256000-memory.dmp

Filesize
344KB

Download
memory/724-5-0x000001D511950000-0x000001D51199C000-memory.dmp

Filesize
304KB

Download
memory/724-6-0x000001D52BCB0000-0x000001D52BD04000-memory.dmp

Filesize
336KB

Download
memory/724-10-0x00007FFDA2C70000-0x00007FFDA3732000-memory.dmp

Filesize
10.8MB

Download
memory/3880-13-0x00007FFDA2C70000-0x00007FFDA3732000-memory.dmp

Filesize
10.8MB

Download
memory/3880-14-0x00007FFDA2C70000-0x00007FFDA3732000-memory.dmp

Filesize
10.8MB

Download
memory/3880-15-0x00007FFDA2C70000-0x00007FFDA3732000-memory.dmp

Filesize
10.8MB

Download