Resubmissions

02-11-2023 07:46

231102-jl2cksba89 10

02-11-2023 04:52

231102-fhl7pshg66 10

Analysis

  • max time kernel
    71s
  • max time network
    87s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-11-2023 07:46

General

  • Target

    93c9a22d4c887be2f5558aa1fc8a809ef03549cc6a3241ee8fccae1f199ac0e5.exe

  • Size

    4.1MB

  • MD5

    ca4b4a453bd6ce61fb70cc8ec70aad4b

  • SHA1

    7c13390a6a6f8fd3232b7f4348fc631c32713301

  • SHA256

    93c9a22d4c887be2f5558aa1fc8a809ef03549cc6a3241ee8fccae1f199ac0e5

  • SHA512

    35d83f0a1defce25b71a24fed773905a84d9c479fb749e049ddf532c3a3b637de1ba7cd39fb01fa8a732aced416ec3ad80f494629e515e3f7acbb493bd3d3675

  • SSDEEP

    49152:bBtjBhz6OfiQc66RTsS01TEhZ1ApkmBJEzOwcsOfkCVVIEhSuDG0fdmO:FhzjfhlbTEhLYECwcZs+VhhS6fcO

Score
10/10

Malware Config

Signatures

  • Detect ZGRat V1 1 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

Processes

  • C:\Users\Admin\AppData\Local\Temp\93c9a22d4c887be2f5558aa1fc8a809ef03549cc6a3241ee8fccae1f199ac0e5.exe
    "C:\Users\Admin\AppData\Local\Temp\93c9a22d4c887be2f5558aa1fc8a809ef03549cc6a3241ee8fccae1f199ac0e5.exe"
    1⤵
      PID:652

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/652-0-0x0000000074BF0000-0x00000000753A0000-memory.dmp

      Filesize

      7.7MB

    • memory/652-1-0x0000000000710000-0x0000000000B20000-memory.dmp

      Filesize

      4.1MB

    • memory/652-2-0x0000000005B20000-0x00000000060C4000-memory.dmp

      Filesize

      5.6MB

    • memory/652-3-0x0000000005570000-0x0000000005602000-memory.dmp

      Filesize

      584KB

    • memory/652-4-0x0000000074BF0000-0x00000000753A0000-memory.dmp

      Filesize

      7.7MB

    • memory/652-5-0x0000000005710000-0x00000000057AC000-memory.dmp

      Filesize

      624KB

    • memory/652-6-0x0000000005970000-0x0000000005980000-memory.dmp

      Filesize

      64KB

    • memory/652-7-0x0000000005550000-0x000000000555A000-memory.dmp

      Filesize

      40KB