zgrat | ed4ef6ea5bca41f50f9300b0c0527ff04a1bb54150202d6e357a92433bda46cf

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231130-en
resource tags

arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
submitted
11-12-2023 13:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

r1210DEC-GIG.exe
Size

627KB
MD5

35092b310e4d2832d81b8f5d9ef1e094
SHA1

ec3a6137aedb5c7b056d51ce653f10c094a4ef14
SHA256

ed4ef6ea5bca41f50f9300b0c0527ff04a1bb54150202d6e357a92433bda46cf
SHA512

8739c9deac4df2c9b20e9f9207f600bfb83c364f3c1bcdd098e878a2ba3969de2c348c5084a3d772b03683dce4d240510822db280c2565735ecc4368328ec725
SSDEEP

12288:ApEmQepZshyxfbCErYeNWDUuZv7IgKM7Uvj5Z+62Tp1Lnly4hdw:ApE0bCcWDUynKM7H31Xy/

Score

10^/10

zgrat rat

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral2/memory/1724-7-0x00000000053E0000-0x00000000053F8000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1724 set thread context of 1796	1724	r1210DEC-GIG.exe	90
PID 1796 set thread context of 3268	1796	r1210DEC-GIG.exe	56
PID 1796 set thread context of 400	1796	r1210DEC-GIG.exe	98
PID 400 set thread context of 3268	400	netiougc.exe	56

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
1796	r1210DEC-GIG.exe
1796	r1210DEC-GIG.exe
1796	r1210DEC-GIG.exe
1796	r1210DEC-GIG.exe
1796	r1210DEC-GIG.exe
1796	r1210DEC-GIG.exe
1796	r1210DEC-GIG.exe
1796	r1210DEC-GIG.exe
1796	r1210DEC-GIG.exe
1796	r1210DEC-GIG.exe
1796	r1210DEC-GIG.exe
1796	r1210DEC-GIG.exe
1796	r1210DEC-GIG.exe
1796	r1210DEC-GIG.exe
1796	r1210DEC-GIG.exe
1796	r1210DEC-GIG.exe
400	netiougc.exe
400	netiougc.exe
400	netiougc.exe
400	netiougc.exe
400	netiougc.exe
400	netiougc.exe
400	netiougc.exe
400	netiougc.exe
400	netiougc.exe
400	netiougc.exe
400	netiougc.exe
400	netiougc.exe
400	netiougc.exe
400	netiougc.exe
400	netiougc.exe
400	netiougc.exe
400	netiougc.exe
400	netiougc.exe
400	netiougc.exe
400	netiougc.exe
400	netiougc.exe
400	netiougc.exe
400	netiougc.exe
400	netiougc.exe
400	netiougc.exe
400	netiougc.exe
400	netiougc.exe
400	netiougc.exe
400	netiougc.exe
400	netiougc.exe
400	netiougc.exe
400	netiougc.exe
400	netiougc.exe
400	netiougc.exe
400	netiougc.exe
400	netiougc.exe
400	netiougc.exe
400	netiougc.exe
400	netiougc.exe
400	netiougc.exe
400	netiougc.exe
400	netiougc.exe
400	netiougc.exe
400	netiougc.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
1796	r1210DEC-GIG.exe
3268	Explorer.EXE
3268	Explorer.EXE
400	netiougc.exe
400	netiougc.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3268	Explorer.EXE

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1796	1724	r1210DEC-GIG.exe	90
PID 1724 wrote to memory of 1796	1724	r1210DEC-GIG.exe	90
PID 1724 wrote to memory of 1796	1724	r1210DEC-GIG.exe	90
PID 1724 wrote to memory of 1796	1724	r1210DEC-GIG.exe	90
PID 1724 wrote to memory of 1796	1724	r1210DEC-GIG.exe	90
PID 1724 wrote to memory of 1796	1724	r1210DEC-GIG.exe	90
PID 3268 wrote to memory of 400	3268	Explorer.EXE	98
PID 3268 wrote to memory of 400	3268	Explorer.EXE	98
PID 3268 wrote to memory of 400	3268	Explorer.EXE	98

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Users\Admin\AppData\Local\Temp\r1210DEC-GIG.exe
  "C:\Users\Admin\AppData\Local\Temp\r1210DEC-GIG.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Users\Admin\AppData\Local\Temp\r1210DEC-GIG.exe
    "C:\Users\Admin\AppData\Local\Temp\r1210DEC-GIG.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:1796
- C:\Windows\SysWOW64\netiougc.exe
  "C:\Windows\SysWOW64\netiougc.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/400-20-0x0000000000540000-0x000000000057A000-memory.dmp

Filesize
232KB

Download
memory/400-21-0x0000000000540000-0x000000000057A000-memory.dmp

Filesize
232KB

Download
memory/400-23-0x0000000001080000-0x00000000013CA000-memory.dmp

Filesize
3.3MB

Download
memory/400-24-0x0000000000540000-0x000000000057A000-memory.dmp

Filesize
232KB

Download
memory/400-25-0x0000000000EC0000-0x0000000000F5C000-memory.dmp

Filesize
624KB

Download
memory/400-27-0x0000000000540000-0x000000000057A000-memory.dmp

Filesize
232KB

Download
memory/1724-8-0x00000000056E0000-0x00000000056E8000-memory.dmp

Filesize
32KB

Download
memory/1724-7-0x00000000053E0000-0x00000000053F8000-memory.dmp

Filesize
96KB

Download
memory/1724-6-0x0000000005440000-0x00000000054DC000-memory.dmp

Filesize
624KB

Download
memory/1724-9-0x00000000063B0000-0x00000000063BA000-memory.dmp

Filesize
40KB

Download
memory/1724-10-0x00000000029D0000-0x0000000002A4C000-memory.dmp

Filesize
496KB

Download
memory/1724-5-0x00000000052F0000-0x00000000052FA000-memory.dmp

Filesize
40KB

Download
memory/1724-13-0x0000000075150000-0x0000000075900000-memory.dmp

Filesize
7.7MB

Download
memory/1724-4-0x0000000005390000-0x00000000053A0000-memory.dmp

Filesize
64KB

Download
memory/1724-0-0x00000000006C0000-0x0000000000762000-memory.dmp

Filesize
648KB

Download
memory/1724-3-0x0000000005140000-0x00000000051D2000-memory.dmp

Filesize
584KB

Download
memory/1724-2-0x00000000056F0000-0x0000000005C94000-memory.dmp

Filesize
5.6MB

Download
memory/1724-1-0x0000000075150000-0x0000000075900000-memory.dmp

Filesize
7.7MB

Download
memory/1796-15-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1796-17-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1796-22-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1796-18-0x0000000000FA0000-0x0000000000FBD000-memory.dmp

Filesize
116KB

Download
memory/1796-16-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1796-14-0x00000000010E0000-0x000000000142A000-memory.dmp

Filesize
3.3MB

Download
memory/1796-11-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3268-19-0x000000000D6C0000-0x000000000FF81000-memory.dmp

Filesize
40.8MB

Download
memory/3268-26-0x000000000D6C0000-0x000000000FF81000-memory.dmp

Filesize
40.8MB

Download
memory/3268-28-0x0000000004810000-0x00000000048CF000-memory.dmp

Filesize
764KB

Download
memory/3268-29-0x0000000004810000-0x00000000048CF000-memory.dmp

Filesize
764KB

Download
memory/3268-30-0x0000000004810000-0x00000000048CF000-memory.dmp

Filesize
764KB

Download