Analysis
- max time kernel
133s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20231127-en - resource tags
- submitted
11/12/2023, 15:36
General
- Target PO_CW2899670-A & CW201.exe
- Size 694KB
- Sample231211-s2d2naahcp
- SHA256 44b93183c3adf1687380f0c5dc8af00571fb0f882fef49f5d649ecc8149d98d3
Score
10/10
Malware Config
Signatures
- Detect ZGRat V1 1 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO_CW2899670-A & CW201.exe"C:\Users\Admin\AppData\Local\Temp\PO_CW2899670-A & CW201.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5048-0-0x0000000000D80000-0x0000000000E34000-memory.dmp
memory/5048-1-0x00007FFDDCC10000-0x00007FFDDD6D1000-memory.dmp
memory/5048-2-0x000000001BA30000-0x000000001BA40000-memory.dmp
memory/5048-3-0x0000000003020000-0x0000000003038000-memory.dmp
memory/5048-4-0x0000000003040000-0x0000000003048000-memory.dmp
memory/5048-5-0x00007FFDDCC10000-0x00007FFDDD6D1000-memory.dmp
memory/5048-6-0x000000001B970000-0x000000001B97A000-memory.dmp
memory/5048-7-0x000000001C740000-0x000000001C7BC000-memory.dmp
memory/5048-8-0x00007FFDDCC10000-0x00007FFDDD6D1000-memory.dmp