Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15-05-2024 01:25
Static task
static1
Behavioral task
behavioral1
Sample
6bc8675f1ecde91d6e90535aa18a328288ee6b3f09f68d2c159eb271e817f638.exe
Resource
win7-20240508-en
General
-
Target
6bc8675f1ecde91d6e90535aa18a328288ee6b3f09f68d2c159eb271e817f638.exe
-
Size
5.9MB
-
MD5
cea3bd36e98356634a90abb7e89a7c87
-
SHA1
18d9dcea711835f80d7a5a42ae8d1011afa211d9
-
SHA256
6bc8675f1ecde91d6e90535aa18a328288ee6b3f09f68d2c159eb271e817f638
-
SHA512
4db4d6d462837674ce9c1525974e82faec4c982515072ff6e55a84796edc2252e39f9776a2e1cf0a278c7226d7d86cde5bf2e305e7442e1f1cba6dc8c5b3aed0
-
SSDEEP
24576:n+c2eZywo6zluOifT5VaXTKlw665Y9jdPXpBRYsHkDVhlYj0FOcwJQigeIE4L51S:
Malware Config
Signatures
-
Detect ZGRat V1 34 IoCs
Processes:
resource yara_rule behavioral2/memory/1144-3-0x0000000007460000-0x000000000774A000-memory.dmp family_zgrat_v1 behavioral2/memory/1144-6-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral2/memory/1144-7-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral2/memory/1144-15-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral2/memory/1144-11-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral2/memory/1144-9-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral2/memory/1144-13-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral2/memory/1144-17-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral2/memory/1144-29-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral2/memory/1144-27-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral2/memory/1144-35-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral2/memory/1144-39-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral2/memory/1144-45-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral2/memory/1144-51-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral2/memory/1144-49-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral2/memory/1144-47-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral2/memory/1144-43-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral2/memory/1144-41-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral2/memory/1144-37-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral2/memory/1144-33-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral2/memory/1144-31-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral2/memory/1144-25-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral2/memory/1144-23-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral2/memory/1144-21-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral2/memory/1144-19-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral2/memory/1144-53-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral2/memory/1144-63-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral2/memory/1144-67-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral2/memory/1144-69-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral2/memory/1144-61-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral2/memory/1144-59-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral2/memory/1144-65-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral2/memory/1144-57-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 behavioral2/memory/1144-55-0x0000000007460000-0x0000000007744000-memory.dmp family_zgrat_v1 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6bc8675f1ecde91d6e90535aa18a328288ee6b3f09f68d2c159eb271e817f638.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation 6bc8675f1ecde91d6e90535aa18a328288ee6b3f09f68d2c159eb271e817f638.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
6bc8675f1ecde91d6e90535aa18a328288ee6b3f09f68d2c159eb271e817f638.exedescription pid process target process PID 1144 set thread context of 2416 1144 6bc8675f1ecde91d6e90535aa18a328288ee6b3f09f68d2c159eb271e817f638.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 3392 powershell.exe 3392 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
6bc8675f1ecde91d6e90535aa18a328288ee6b3f09f68d2c159eb271e817f638.exeMSBuild.exepowershell.exedescription pid process Token: SeDebugPrivilege 1144 6bc8675f1ecde91d6e90535aa18a328288ee6b3f09f68d2c159eb271e817f638.exe Token: SeDebugPrivilege 1144 6bc8675f1ecde91d6e90535aa18a328288ee6b3f09f68d2c159eb271e817f638.exe Token: SeDebugPrivilege 2416 MSBuild.exe Token: SeDebugPrivilege 3392 powershell.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
6bc8675f1ecde91d6e90535aa18a328288ee6b3f09f68d2c159eb271e817f638.exedescription pid process target process PID 1144 wrote to memory of 3392 1144 6bc8675f1ecde91d6e90535aa18a328288ee6b3f09f68d2c159eb271e817f638.exe powershell.exe PID 1144 wrote to memory of 3392 1144 6bc8675f1ecde91d6e90535aa18a328288ee6b3f09f68d2c159eb271e817f638.exe powershell.exe PID 1144 wrote to memory of 3392 1144 6bc8675f1ecde91d6e90535aa18a328288ee6b3f09f68d2c159eb271e817f638.exe powershell.exe PID 1144 wrote to memory of 2416 1144 6bc8675f1ecde91d6e90535aa18a328288ee6b3f09f68d2c159eb271e817f638.exe MSBuild.exe PID 1144 wrote to memory of 2416 1144 6bc8675f1ecde91d6e90535aa18a328288ee6b3f09f68d2c159eb271e817f638.exe MSBuild.exe PID 1144 wrote to memory of 2416 1144 6bc8675f1ecde91d6e90535aa18a328288ee6b3f09f68d2c159eb271e817f638.exe MSBuild.exe PID 1144 wrote to memory of 2416 1144 6bc8675f1ecde91d6e90535aa18a328288ee6b3f09f68d2c159eb271e817f638.exe MSBuild.exe PID 1144 wrote to memory of 2416 1144 6bc8675f1ecde91d6e90535aa18a328288ee6b3f09f68d2c159eb271e817f638.exe MSBuild.exe PID 1144 wrote to memory of 2416 1144 6bc8675f1ecde91d6e90535aa18a328288ee6b3f09f68d2c159eb271e817f638.exe MSBuild.exe PID 1144 wrote to memory of 2416 1144 6bc8675f1ecde91d6e90535aa18a328288ee6b3f09f68d2c159eb271e817f638.exe MSBuild.exe PID 1144 wrote to memory of 2416 1144 6bc8675f1ecde91d6e90535aa18a328288ee6b3f09f68d2c159eb271e817f638.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6bc8675f1ecde91d6e90535aa18a328288ee6b3f09f68d2c159eb271e817f638.exe"C:\Users\Admin\AppData\Local\Temp\6bc8675f1ecde91d6e90535aa18a328288ee6b3f09f68d2c159eb271e817f638.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwANgBiAGMAOAA2ADcANQBmADEAZQBjAGQAZQA5ADEAZAA2AGUAOQAwADUAMwA1AGEAYQAxADgAYQAzADIAOAAyADgAOABlAGUANgBiADMAZgAwADkAZgA2ADgAZAAyAGMAMQA1ADkAZQBiADIANwAxAGUAOAAxADcAZgA2ADMAOAAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAANgBiAGMAOAA2ADcANQBmADEAZQBjAGQAZQA5ADEAZAA2AGUAOQAwADUAMwA1AGEAYQAxADgAYQAzADIAOAAyADgAOABlAGUANgBiADMAZgAwADkAZgA2ADgAZAAyAGMAMQA1ADkAZQBiADIANwAxAGUAOAAxADcAZgA2ADMAOAAuAGUAeABlADsA2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y5lrenpj.xsg.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/1144-55-0x0000000007460000-0x0000000007744000-memory.dmpFilesize
2.9MB
-
memory/1144-41-0x0000000007460000-0x0000000007744000-memory.dmpFilesize
2.9MB
-
memory/1144-3-0x0000000007460000-0x000000000774A000-memory.dmpFilesize
2.9MB
-
memory/1144-4-0x0000000007D00000-0x00000000082A4000-memory.dmpFilesize
5.6MB
-
memory/1144-5-0x00000000077F0000-0x0000000007882000-memory.dmpFilesize
584KB
-
memory/1144-6-0x0000000007460000-0x0000000007744000-memory.dmpFilesize
2.9MB
-
memory/1144-7-0x0000000007460000-0x0000000007744000-memory.dmpFilesize
2.9MB
-
memory/1144-15-0x0000000007460000-0x0000000007744000-memory.dmpFilesize
2.9MB
-
memory/1144-11-0x0000000007460000-0x0000000007744000-memory.dmpFilesize
2.9MB
-
memory/1144-9-0x0000000007460000-0x0000000007744000-memory.dmpFilesize
2.9MB
-
memory/1144-13-0x0000000007460000-0x0000000007744000-memory.dmpFilesize
2.9MB
-
memory/1144-17-0x0000000007460000-0x0000000007744000-memory.dmpFilesize
2.9MB
-
memory/1144-29-0x0000000007460000-0x0000000007744000-memory.dmpFilesize
2.9MB
-
memory/1144-27-0x0000000007460000-0x0000000007744000-memory.dmpFilesize
2.9MB
-
memory/1144-35-0x0000000007460000-0x0000000007744000-memory.dmpFilesize
2.9MB
-
memory/1144-57-0x0000000007460000-0x0000000007744000-memory.dmpFilesize
2.9MB
-
memory/1144-45-0x0000000007460000-0x0000000007744000-memory.dmpFilesize
2.9MB
-
memory/1144-51-0x0000000007460000-0x0000000007744000-memory.dmpFilesize
2.9MB
-
memory/1144-49-0x0000000007460000-0x0000000007744000-memory.dmpFilesize
2.9MB
-
memory/1144-47-0x0000000007460000-0x0000000007744000-memory.dmpFilesize
2.9MB
-
memory/1144-43-0x0000000007460000-0x0000000007744000-memory.dmpFilesize
2.9MB
-
memory/1144-4897-0x00000000743C0000-0x0000000074B70000-memory.dmpFilesize
7.7MB
-
memory/1144-37-0x0000000007460000-0x0000000007744000-memory.dmpFilesize
2.9MB
-
memory/1144-33-0x0000000007460000-0x0000000007744000-memory.dmpFilesize
2.9MB
-
memory/1144-31-0x0000000007460000-0x0000000007744000-memory.dmpFilesize
2.9MB
-
memory/1144-25-0x0000000007460000-0x0000000007744000-memory.dmpFilesize
2.9MB
-
memory/1144-23-0x0000000007460000-0x0000000007744000-memory.dmpFilesize
2.9MB
-
memory/1144-21-0x0000000007460000-0x0000000007744000-memory.dmpFilesize
2.9MB
-
memory/1144-19-0x0000000007460000-0x0000000007744000-memory.dmpFilesize
2.9MB
-
memory/1144-53-0x0000000007460000-0x0000000007744000-memory.dmpFilesize
2.9MB
-
memory/1144-63-0x0000000007460000-0x0000000007744000-memory.dmpFilesize
2.9MB
-
memory/1144-67-0x0000000007460000-0x0000000007744000-memory.dmpFilesize
2.9MB
-
memory/1144-69-0x0000000007460000-0x0000000007744000-memory.dmpFilesize
2.9MB
-
memory/1144-61-0x0000000007460000-0x0000000007744000-memory.dmpFilesize
2.9MB
-
memory/1144-59-0x0000000007460000-0x0000000007744000-memory.dmpFilesize
2.9MB
-
memory/1144-65-0x0000000007460000-0x0000000007744000-memory.dmpFilesize
2.9MB
-
memory/1144-39-0x0000000007460000-0x0000000007744000-memory.dmpFilesize
2.9MB
-
memory/1144-0-0x00000000743CE000-0x00000000743CF000-memory.dmpFilesize
4KB
-
memory/1144-2-0x00000000743C0000-0x0000000074B70000-memory.dmpFilesize
7.7MB
-
memory/1144-4887-0x0000000007910000-0x0000000007A38000-memory.dmpFilesize
1.2MB
-
memory/1144-4888-0x0000000006130000-0x000000000617C000-memory.dmpFilesize
304KB
-
memory/1144-4889-0x0000000007B90000-0x0000000007BE4000-memory.dmpFilesize
336KB
-
memory/1144-1-0x0000000000B60000-0x0000000001150000-memory.dmpFilesize
5.9MB
-
memory/1144-4886-0x00000000743C0000-0x0000000074B70000-memory.dmpFilesize
7.7MB
-
memory/2416-4893-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/2416-7235-0x0000000005310000-0x00000000053AE000-memory.dmpFilesize
632KB
-
memory/2416-5019-0x00000000743C0000-0x0000000074B70000-memory.dmpFilesize
7.7MB
-
memory/2416-4895-0x0000000005190000-0x00000000052A6000-memory.dmpFilesize
1.1MB
-
memory/2416-7263-0x00000000743C0000-0x0000000074B70000-memory.dmpFilesize
7.7MB
-
memory/3392-7248-0x00000000743C0000-0x0000000074B70000-memory.dmpFilesize
7.7MB
-
memory/3392-7249-0x0000000007880000-0x0000000007923000-memory.dmpFilesize
652KB
-
memory/3392-6317-0x0000000006050000-0x00000000060B6000-memory.dmpFilesize
408KB
-
memory/3392-6510-0x00000000060C0000-0x0000000006414000-memory.dmpFilesize
3.3MB
-
memory/3392-6310-0x00000000057C0000-0x00000000057E2000-memory.dmpFilesize
136KB
-
memory/3392-4892-0x00000000030E0000-0x0000000003116000-memory.dmpFilesize
216KB
-
memory/3392-7233-0x00000000066A0000-0x00000000066BE000-memory.dmpFilesize
120KB
-
memory/3392-7234-0x00000000066D0000-0x000000000671C000-memory.dmpFilesize
304KB
-
memory/3392-4894-0x0000000005A20000-0x0000000006048000-memory.dmpFilesize
6.2MB
-
memory/3392-7237-0x0000000071BC0000-0x0000000071C0C000-memory.dmpFilesize
304KB
-
memory/3392-4896-0x00000000743C0000-0x0000000074B70000-memory.dmpFilesize
7.7MB
-
memory/3392-7247-0x0000000006C50000-0x0000000006C6E000-memory.dmpFilesize
120KB
-
memory/3392-7236-0x0000000007640000-0x0000000007672000-memory.dmpFilesize
200KB
-
memory/3392-6316-0x0000000005960000-0x00000000059C6000-memory.dmpFilesize
408KB
-
memory/3392-7252-0x00000000079B0000-0x00000000079CA000-memory.dmpFilesize
104KB
-
memory/3392-7251-0x0000000008000000-0x000000000867A000-memory.dmpFilesize
6.5MB
-
memory/3392-7250-0x00000000743C0000-0x0000000074B70000-memory.dmpFilesize
7.7MB
-
memory/3392-7253-0x0000000007A50000-0x0000000007A5A000-memory.dmpFilesize
40KB
-
memory/3392-7254-0x0000000007C50000-0x0000000007CE6000-memory.dmpFilesize
600KB
-
memory/3392-7255-0x0000000007BD0000-0x0000000007BE1000-memory.dmpFilesize
68KB
-
memory/3392-7256-0x0000000007C00000-0x0000000007C0E000-memory.dmpFilesize
56KB
-
memory/3392-7257-0x0000000007C10000-0x0000000007C24000-memory.dmpFilesize
80KB
-
memory/3392-7258-0x0000000007D10000-0x0000000007D2A000-memory.dmpFilesize
104KB
-
memory/3392-7259-0x0000000007CF0000-0x0000000007CF8000-memory.dmpFilesize
32KB
-
memory/3392-7262-0x00000000743C0000-0x0000000074B70000-memory.dmpFilesize
7.7MB
-
memory/3392-5166-0x00000000743C0000-0x0000000074B70000-memory.dmpFilesize
7.7MB