Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
-
submitted
09-12-2023 20:58
General
-
Target
bg.exe
-
Size
688KB
-
MD5
054b2bae2fde2432570c1e201915d5c2
-
SHA1
f6ff9c425953a09c43952b7e50287eb9b2962e69
-
SHA256
aa7d7ea346331c9c6967d59a073ee7ae81d11613680f28dee831ca9fbf1fe7fb
-
SHA512
a62a9301a53504284a0d3596429c16887ba95809e28753df86d5cc9a57c5a2fcbe91dd83748678408f4406214b3ab7395b449755c92173577f6f7d588d30a904
-
SSDEEP
12288:QoPCLS7hVU4xHribMZXK7RfXpqHRcSD5RyyBEAge1sMKB/VdmRxuweSG0:Qo02bhKZpqyuUo8/k1eSx
Score
10/10
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bg.exe"C:\Users\Admin\AppData\Local\Temp\bg.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4868-0-0x00000000001F0000-0x00000000002A6000-memory.dmpFilesize
728KB
-
memory/4868-1-0x00000000748F0000-0x00000000750A0000-memory.dmpFilesize
7.7MB
-
memory/4868-3-0x00000000092B0000-0x00000000092CA000-memory.dmpFilesize
104KB
-
memory/4868-5-0x0000000002740000-0x0000000002762000-memory.dmpFilesize
136KB
-
memory/4868-4-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/4868-2-0x0000000007120000-0x00000000072B0000-memory.dmpFilesize
1.6MB
-
memory/4868-7-0x0000000009EA0000-0x0000000009F32000-memory.dmpFilesize
584KB
-
memory/4868-6-0x000000000A360000-0x000000000A904000-memory.dmpFilesize
5.6MB
-
memory/4868-9-0x00000000748F0000-0x00000000750A0000-memory.dmpFilesize
7.7MB