Analysis

  • max time kernel
    190s
  • max time network
    209s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/11/2023, 13:02

General

  • Target

    cdf8661bfba3b34c9c876c216db9bac1.exe

  • Size

    767KB

  • MD5

    cdf8661bfba3b34c9c876c216db9bac1

  • SHA1

    30dc311efcb113155f32b818b171e7e3ffa03b88

  • SHA256

    7bb1a4ceb5f46fa0a8313404d39bfe9838bd8ec84ee1d2f8ab9ddb41de92e8c4

  • SHA512

    d8acd7b9080991994883dfe414fc5af888c06cc86aee1a74802adb17a854d9e53ddfc1ddf625b94eccd936ca0c99b7574bca532a9152cc2ac9dfafd65b359afb

  • SSDEEP

    12288:WYIZYFeueRy5KPtlaA3OK4nwFpJaKdpkyoQGqUerMvcL7eiKEXqXdVFSZ2:BIZYFjkyYPtsAN4nwjJ/kvQRbK4qXdVF

Score
10/10

Malware Config

Signatures

  • Detect ZGRat V1 1 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

Processes

  • C:\Users\Admin\AppData\Local\Temp\cdf8661bfba3b34c9c876c216db9bac1.exe
    "C:\Users\Admin\AppData\Local\Temp\cdf8661bfba3b34c9c876c216db9bac1.exe"
    1⤵
      PID:4988

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4988-0-0x0000000074D70000-0x0000000075520000-memory.dmp

      Filesize

      7.7MB

    • memory/4988-1-0x0000000074D70000-0x0000000075520000-memory.dmp

      Filesize

      7.7MB

    • memory/4988-2-0x0000000000A00000-0x0000000000AC6000-memory.dmp

      Filesize

      792KB

    • memory/4988-3-0x0000000005D80000-0x0000000006324000-memory.dmp

      Filesize

      5.6MB

    • memory/4988-4-0x00000000058B0000-0x0000000005942000-memory.dmp

      Filesize

      584KB

    • memory/4988-5-0x0000000006330000-0x0000000006684000-memory.dmp

      Filesize

      3.3MB

    • memory/4988-6-0x0000000005AE0000-0x0000000005AF0000-memory.dmp

      Filesize

      64KB

    • memory/4988-7-0x0000000005A60000-0x0000000005A6A000-memory.dmp

      Filesize

      40KB

    • memory/4988-8-0x0000000005B90000-0x0000000005B9C000-memory.dmp

      Filesize

      48KB

    • memory/4988-9-0x0000000005AE0000-0x0000000005AF0000-memory.dmp

      Filesize

      64KB

    • memory/4988-10-0x0000000000BC0000-0x0000000000BCC000-memory.dmp

      Filesize

      48KB

    • memory/4988-11-0x00000000014B0000-0x000000000153A000-memory.dmp

      Filesize

      552KB