zgrat | b77f7c59b071608e552cf6ccae6f9e0e3f6790d83ec7d163713b0eedc6eccf25

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 08:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

113f59d0bd4384226e40c17bf899935d.exe
Size

955KB
MD5

113f59d0bd4384226e40c17bf899935d
SHA1

4bf159402cefe87d328182fee0e82297b1fff5c5
SHA256

b77f7c59b071608e552cf6ccae6f9e0e3f6790d83ec7d163713b0eedc6eccf25
SHA512

d8e3717916475013e8ec8cc5a5fef303c4467fe66b944f1031ee73ad964a6a699d3c872a305173ac7565e5000ade605e8cef1cbe3ca9438ac1f85993a69a3b78
SSDEEP

12288:gFrXv++Cjkemhes5D9Bq1U50kb9zU9uRyM3/CsUABjFG3CiEN4/PosRbOt/kUQQj:gFrpCDsz2SCyiJA+O9ENGZOMb

Score

10^/10

zgrat rat

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral1/memory/2236-4-0x0000000000280000-0x0000000000296000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2236	113f59d0bd4384226e40c17bf899935d.exe
2236	113f59d0bd4384226e40c17bf899935d.exe
2236	113f59d0bd4384226e40c17bf899935d.exe
2236	113f59d0bd4384226e40c17bf899935d.exe
2236	113f59d0bd4384226e40c17bf899935d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2236	113f59d0bd4384226e40c17bf899935d.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2812	2236	113f59d0bd4384226e40c17bf899935d.exe	28
PID 2236 wrote to memory of 2812	2236	113f59d0bd4384226e40c17bf899935d.exe	28
PID 2236 wrote to memory of 2812	2236	113f59d0bd4384226e40c17bf899935d.exe	28
PID 2236 wrote to memory of 2812	2236	113f59d0bd4384226e40c17bf899935d.exe	28
PID 2236 wrote to memory of 2816	2236	113f59d0bd4384226e40c17bf899935d.exe	32
PID 2236 wrote to memory of 2816	2236	113f59d0bd4384226e40c17bf899935d.exe	32
PID 2236 wrote to memory of 2816	2236	113f59d0bd4384226e40c17bf899935d.exe	32
PID 2236 wrote to memory of 2816	2236	113f59d0bd4384226e40c17bf899935d.exe	32
PID 2236 wrote to memory of 2828	2236	113f59d0bd4384226e40c17bf899935d.exe	31
PID 2236 wrote to memory of 2828	2236	113f59d0bd4384226e40c17bf899935d.exe	31
PID 2236 wrote to memory of 2828	2236	113f59d0bd4384226e40c17bf899935d.exe	31
PID 2236 wrote to memory of 2828	2236	113f59d0bd4384226e40c17bf899935d.exe	31
PID 2236 wrote to memory of 2848	2236	113f59d0bd4384226e40c17bf899935d.exe	30
PID 2236 wrote to memory of 2848	2236	113f59d0bd4384226e40c17bf899935d.exe	30
PID 2236 wrote to memory of 2848	2236	113f59d0bd4384226e40c17bf899935d.exe	30
PID 2236 wrote to memory of 2848	2236	113f59d0bd4384226e40c17bf899935d.exe	30
PID 2236 wrote to memory of 2800	2236	113f59d0bd4384226e40c17bf899935d.exe	29
PID 2236 wrote to memory of 2800	2236	113f59d0bd4384226e40c17bf899935d.exe	29
PID 2236 wrote to memory of 2800	2236	113f59d0bd4384226e40c17bf899935d.exe	29
PID 2236 wrote to memory of 2800	2236	113f59d0bd4384226e40c17bf899935d.exe	29

C:\Users\Admin\AppData\Local\Temp\113f59d0bd4384226e40c17bf899935d.exe
"C:\Users\Admin\AppData\Local\Temp\113f59d0bd4384226e40c17bf899935d.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Users\Admin\AppData\Local\Temp\113f59d0bd4384226e40c17bf899935d.exe
  "C:\Users\Admin\AppData\Local\Temp\113f59d0bd4384226e40c17bf899935d.exe"
  2⤵
  PID:2812
- C:\Users\Admin\AppData\Local\Temp\113f59d0bd4384226e40c17bf899935d.exe
  "C:\Users\Admin\AppData\Local\Temp\113f59d0bd4384226e40c17bf899935d.exe"
  2⤵
  PID:2800
- C:\Users\Admin\AppData\Local\Temp\113f59d0bd4384226e40c17bf899935d.exe
  "C:\Users\Admin\AppData\Local\Temp\113f59d0bd4384226e40c17bf899935d.exe"
  2⤵
  PID:2848
- C:\Users\Admin\AppData\Local\Temp\113f59d0bd4384226e40c17bf899935d.exe
  "C:\Users\Admin\AppData\Local\Temp\113f59d0bd4384226e40c17bf899935d.exe"
  2⤵
  PID:2828
- C:\Users\Admin\AppData\Local\Temp\113f59d0bd4384226e40c17bf899935d.exe
  "C:\Users\Admin\AppData\Local\Temp\113f59d0bd4384226e40c17bf899935d.exe"
  2⤵
  PID:2816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2236-1-0x0000000074570000-0x0000000074C5E000-memory.dmp

Filesize
6.9MB

Download
memory/2236-0-0x0000000000330000-0x0000000000424000-memory.dmp

Filesize
976KB

Download
memory/2236-2-0x0000000000690000-0x00000000006D0000-memory.dmp

Filesize
256KB

Download
memory/2236-3-0x0000000002230000-0x00000000022A8000-memory.dmp

Filesize
480KB

Download
memory/2236-4-0x0000000000280000-0x0000000000296000-memory.dmp

Filesize
88KB

Download
memory/2236-5-0x0000000074570000-0x0000000074C5E000-memory.dmp

Filesize
6.9MB

Download