zgrat | 1933f809c3459991a94f70f1381e2e26335207959a9cef0fad842f53331462a6

Analysis

max time kernel
5s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 09:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

412cd1f80bd9c600e3b4dc093e917f00.exe
Size

736KB
MD5

412cd1f80bd9c600e3b4dc093e917f00
SHA1

00afca16a90495345bc729115ef7bf6d69d25577
SHA256

1933f809c3459991a94f70f1381e2e26335207959a9cef0fad842f53331462a6
SHA512

0a4ed04d17b350cdf9cb7b36182caa5c2e14118338914735cf38754ce0ee745f58b11f7accc735e1d56c6ebcf21a00625b0360e467e370ffd4ba12cbad6c92fd
SSDEEP

12288:kPIyPKREnm9jLV2QjcZpF2w4qkzR9leeW1ZwiTVmFZDr4tsb9c5kjIMC1m+UT49R:uXCRpPjcH/4pRicFB0tsb9cUJi2TSR

Score

10^/10

zgrat rat

Malware Config

Signatures

Detect ZGRat V1 35 IoCs

resource	yara_rule
behavioral1/memory/2512-45-0x00000000083D0000-0x0000000008440000-memory.dmp	family_zgrat_v1
behavioral1/memory/2512-67-0x00000000083D0000-0x000000000843A000-memory.dmp	family_zgrat_v1
behavioral1/memory/2512-97-0x00000000083D0000-0x000000000843A000-memory.dmp	family_zgrat_v1
behavioral1/memory/2512-109-0x00000000083D0000-0x000000000843A000-memory.dmp	family_zgrat_v1
behavioral1/memory/2512-107-0x00000000083D0000-0x000000000843A000-memory.dmp	family_zgrat_v1
behavioral1/memory/2512-105-0x00000000083D0000-0x000000000843A000-memory.dmp	family_zgrat_v1
behavioral1/memory/2512-103-0x00000000083D0000-0x000000000843A000-memory.dmp	family_zgrat_v1
behavioral1/memory/2512-101-0x00000000083D0000-0x000000000843A000-memory.dmp	family_zgrat_v1
behavioral1/memory/2512-99-0x00000000083D0000-0x000000000843A000-memory.dmp	family_zgrat_v1
behavioral1/memory/2512-95-0x00000000083D0000-0x000000000843A000-memory.dmp	family_zgrat_v1
behavioral1/memory/2512-93-0x00000000083D0000-0x000000000843A000-memory.dmp	family_zgrat_v1
behavioral1/memory/2512-91-0x00000000083D0000-0x000000000843A000-memory.dmp	family_zgrat_v1
behavioral1/memory/2512-89-0x00000000083D0000-0x000000000843A000-memory.dmp	family_zgrat_v1
behavioral1/memory/2512-87-0x00000000083D0000-0x000000000843A000-memory.dmp	family_zgrat_v1
behavioral1/memory/2512-85-0x00000000083D0000-0x000000000843A000-memory.dmp	family_zgrat_v1
behavioral1/memory/2512-83-0x00000000083D0000-0x000000000843A000-memory.dmp	family_zgrat_v1
behavioral1/memory/2512-81-0x00000000083D0000-0x000000000843A000-memory.dmp	family_zgrat_v1
behavioral1/memory/2512-79-0x00000000083D0000-0x000000000843A000-memory.dmp	family_zgrat_v1
behavioral1/memory/2512-77-0x00000000083D0000-0x000000000843A000-memory.dmp	family_zgrat_v1
behavioral1/memory/2512-75-0x00000000083D0000-0x000000000843A000-memory.dmp	family_zgrat_v1
behavioral1/memory/2512-73-0x00000000083D0000-0x000000000843A000-memory.dmp	family_zgrat_v1
behavioral1/memory/2512-71-0x00000000083D0000-0x000000000843A000-memory.dmp	family_zgrat_v1
behavioral1/memory/2512-69-0x00000000083D0000-0x000000000843A000-memory.dmp	family_zgrat_v1
behavioral1/memory/2512-65-0x00000000083D0000-0x000000000843A000-memory.dmp	family_zgrat_v1
behavioral1/memory/2512-63-0x00000000083D0000-0x000000000843A000-memory.dmp	family_zgrat_v1
behavioral1/memory/2512-61-0x00000000083D0000-0x000000000843A000-memory.dmp	family_zgrat_v1
behavioral1/memory/2512-59-0x00000000083D0000-0x000000000843A000-memory.dmp	family_zgrat_v1
behavioral1/memory/2512-57-0x00000000083D0000-0x000000000843A000-memory.dmp	family_zgrat_v1
behavioral1/memory/2512-55-0x00000000083D0000-0x000000000843A000-memory.dmp	family_zgrat_v1
behavioral1/memory/2512-53-0x00000000083D0000-0x000000000843A000-memory.dmp	family_zgrat_v1
behavioral1/memory/2512-51-0x00000000083D0000-0x000000000843A000-memory.dmp	family_zgrat_v1
behavioral1/memory/2512-49-0x00000000083D0000-0x000000000843A000-memory.dmp	family_zgrat_v1
behavioral1/memory/2512-47-0x00000000083D0000-0x000000000843A000-memory.dmp	family_zgrat_v1
behavioral1/memory/2512-46-0x00000000083D0000-0x000000000843A000-memory.dmp	family_zgrat_v1
behavioral1/memory/1260-2072-0x0000000000400000-0x000000000042A000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery

T1018

pid	Process
2140	PING.EXE
2904	PING.EXE
2864	PING.EXE
2496	PING.EXE

C:\Users\Admin\AppData\Local\Temp\412cd1f80bd9c600e3b4dc093e917f00.exe
"C:\Users\Admin\AppData\Local\Temp\412cd1f80bd9c600e3b4dc093e917f00.exe"
1⤵
PID:2512
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping gooogle.com
  2⤵
  PID:1404
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\system32\PING.EXE" gooogle.com
    3⤵
    - Runs ping.exe
    PID:2140
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping gooogle.com
  2⤵
  PID:2644
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping gooogle.com
  2⤵
  PID:2552
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping gooogle.com
  2⤵
  PID:1756
- C:\Users\Admin\AppData\Local\Temp\412cd1f80bd9c600e3b4dc093e917f00.exe
  C:\Users\Admin\AppData\Local\Temp\412cd1f80bd9c600e3b4dc093e917f00.exe
  2⤵
  PID:1260
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Zwoqghbfujejrlbnxyxjpk.vbs"
  2⤵
  PID:2204
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\zan.exe'
    3⤵
    PID:488

C:\Windows\SysWOW64\PING.EXE
"C:\Windows\system32\PING.EXE" gooogle.com
1⤵
- Runs ping.exe
PID:2904

C:\Windows\SysWOW64\PING.EXE
"C:\Windows\system32\PING.EXE" gooogle.com
1⤵
- Runs ping.exe
PID:2864

C:\Windows\SysWOW64\PING.EXE
"C:\Windows\system32\PING.EXE" gooogle.com
1⤵
- Runs ping.exe
PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
fa279d2220149f2fe87c38762c558d6f

SHA1
f506f109ed86b7db14dc4b4320d37b35c7dc4a57

SHA256
fed4840eceadcb1d5af71fa857bc9ba9287fda1ba189be17fc390448303485d6

SHA512
32838aa037f3e57191521f1d7114a3db9c992fe08a2db033fb3f6147a23df15f1b2e28e5885daaf773c9d53bbbdb30ec616c25ac849ef1897e108221eb5a86f1

Download Submit
memory/488-2085-0x0000000001C00000-0x0000000001C40000-memory.dmp

Filesize
256KB

Download
memory/488-2088-0x000000006FB00000-0x00000000700AB000-memory.dmp

Filesize
5.7MB

Download
memory/488-2087-0x0000000001C00000-0x0000000001C40000-memory.dmp

Filesize
256KB

Download
memory/488-2086-0x000000006FB00000-0x00000000700AB000-memory.dmp

Filesize
5.7MB

Download
memory/488-2084-0x000000006FB00000-0x00000000700AB000-memory.dmp

Filesize
5.7MB

Download
memory/488-2080-0x0000000001C00000-0x0000000001C40000-memory.dmp

Filesize
256KB

Download
memory/1260-2075-0x0000000074BF0000-0x00000000752DE000-memory.dmp

Filesize
6.9MB

Download
memory/1260-2089-0x0000000074BF0000-0x00000000752DE000-memory.dmp

Filesize
6.9MB

Download
memory/1260-2072-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1260-2091-0x0000000000340000-0x0000000000364000-memory.dmp

Filesize
144KB

Download
memory/1260-2082-0x0000000000D60000-0x0000000000DA0000-memory.dmp

Filesize
256KB

Download
memory/1260-2090-0x0000000000D60000-0x0000000000DA0000-memory.dmp

Filesize
256KB

Download
memory/1404-9-0x0000000002A10000-0x0000000002A50000-memory.dmp

Filesize
256KB

Download
memory/1404-8-0x0000000002A10000-0x0000000002A50000-memory.dmp

Filesize
256KB

Download
memory/1404-19-0x000000006FDD0000-0x000000007037B000-memory.dmp

Filesize
5.7MB

Download
memory/1404-6-0x000000006FDD0000-0x000000007037B000-memory.dmp

Filesize
5.7MB

Download
memory/1404-7-0x000000006FDD0000-0x000000007037B000-memory.dmp

Filesize
5.7MB

Download
memory/1756-38-0x0000000002DA0000-0x0000000002DE0000-memory.dmp

Filesize
256KB

Download
memory/1756-786-0x000000006FDD0000-0x000000007037B000-memory.dmp

Filesize
5.7MB

Download
memory/1756-37-0x000000006FDD0000-0x000000007037B000-memory.dmp

Filesize
5.7MB

Download
memory/1756-42-0x0000000002DA0000-0x0000000002DE0000-memory.dmp

Filesize
256KB

Download
memory/1756-41-0x0000000002DA0000-0x0000000002DE0000-memory.dmp

Filesize
256KB

Download
memory/1756-40-0x000000006FDD0000-0x000000007037B000-memory.dmp

Filesize
5.7MB

Download
memory/1756-39-0x000000006FDD0000-0x000000007037B000-memory.dmp

Filesize
5.7MB

Download
memory/2512-51-0x00000000083D0000-0x000000000843A000-memory.dmp

Filesize
424KB

Download
memory/2512-65-0x00000000083D0000-0x000000000843A000-memory.dmp

Filesize
424KB

Download
memory/2512-0-0x00000000010F0000-0x00000000011AE000-memory.dmp

Filesize
760KB

Download
memory/2512-44-0x0000000004B20000-0x0000000004B7C000-memory.dmp

Filesize
368KB

Download
memory/2512-45-0x00000000083D0000-0x0000000008440000-memory.dmp

Filesize
448KB

Download
memory/2512-67-0x00000000083D0000-0x000000000843A000-memory.dmp

Filesize
424KB

Download
memory/2512-97-0x00000000083D0000-0x000000000843A000-memory.dmp

Filesize
424KB

Download
memory/2512-109-0x00000000083D0000-0x000000000843A000-memory.dmp

Filesize
424KB

Download
memory/2512-107-0x00000000083D0000-0x000000000843A000-memory.dmp

Filesize
424KB

Download
memory/2512-105-0x00000000083D0000-0x000000000843A000-memory.dmp

Filesize
424KB

Download
memory/2512-103-0x00000000083D0000-0x000000000843A000-memory.dmp

Filesize
424KB

Download
memory/2512-101-0x00000000083D0000-0x000000000843A000-memory.dmp

Filesize
424KB

Download
memory/2512-99-0x00000000083D0000-0x000000000843A000-memory.dmp

Filesize
424KB

Download
memory/2512-95-0x00000000083D0000-0x000000000843A000-memory.dmp

Filesize
424KB

Download
memory/2512-93-0x00000000083D0000-0x000000000843A000-memory.dmp

Filesize
424KB

Download
memory/2512-91-0x00000000083D0000-0x000000000843A000-memory.dmp

Filesize
424KB

Download
memory/2512-89-0x00000000083D0000-0x000000000843A000-memory.dmp

Filesize
424KB

Download
memory/2512-87-0x00000000083D0000-0x000000000843A000-memory.dmp

Filesize
424KB

Download
memory/2512-85-0x00000000083D0000-0x000000000843A000-memory.dmp

Filesize
424KB

Download
memory/2512-83-0x00000000083D0000-0x000000000843A000-memory.dmp

Filesize
424KB

Download
memory/2512-81-0x00000000083D0000-0x000000000843A000-memory.dmp

Filesize
424KB

Download
memory/2512-79-0x00000000083D0000-0x000000000843A000-memory.dmp

Filesize
424KB

Download
memory/2512-77-0x00000000083D0000-0x000000000843A000-memory.dmp

Filesize
424KB

Download
memory/2512-75-0x00000000083D0000-0x000000000843A000-memory.dmp

Filesize
424KB

Download
memory/2512-73-0x00000000083D0000-0x000000000843A000-memory.dmp

Filesize
424KB

Download
memory/2512-71-0x00000000083D0000-0x000000000843A000-memory.dmp

Filesize
424KB

Download
memory/2512-69-0x00000000083D0000-0x000000000843A000-memory.dmp

Filesize
424KB

Download
memory/2512-2-0x00000000010A0000-0x00000000010E0000-memory.dmp

Filesize
256KB

Download
memory/2512-63-0x00000000083D0000-0x000000000843A000-memory.dmp

Filesize
424KB

Download
memory/2512-3-0x00000000010A0000-0x00000000010E0000-memory.dmp

Filesize
256KB

Download
memory/2512-61-0x00000000083D0000-0x000000000843A000-memory.dmp

Filesize
424KB

Download
memory/2512-59-0x00000000083D0000-0x000000000843A000-memory.dmp

Filesize
424KB

Download
memory/2512-57-0x00000000083D0000-0x000000000843A000-memory.dmp

Filesize
424KB

Download
memory/2512-55-0x00000000083D0000-0x000000000843A000-memory.dmp

Filesize
424KB

Download
memory/2512-53-0x00000000083D0000-0x000000000843A000-memory.dmp

Filesize
424KB

Download
memory/2512-1-0x0000000074BF0000-0x00000000752DE000-memory.dmp

Filesize
6.9MB

Download
memory/2512-49-0x00000000083D0000-0x000000000843A000-memory.dmp

Filesize
424KB

Download
memory/2512-47-0x00000000083D0000-0x000000000843A000-memory.dmp

Filesize
424KB

Download
memory/2512-46-0x00000000083D0000-0x000000000843A000-memory.dmp

Filesize
424KB

Download
memory/2512-2051-0x00000000010A0000-0x00000000010E0000-memory.dmp

Filesize
256KB

Download
memory/2512-2052-0x00000000010A0000-0x00000000010E0000-memory.dmp

Filesize
256KB

Download
memory/2512-17-0x0000000074BF0000-0x00000000752DE000-memory.dmp

Filesize
6.9MB

Download
memory/2512-2081-0x0000000074BF0000-0x00000000752DE000-memory.dmp

Filesize
6.9MB

Download
memory/2512-2083-0x00000000010A0000-0x00000000010E0000-memory.dmp

Filesize
256KB

Download
memory/2512-20-0x00000000010A0000-0x00000000010E0000-memory.dmp

Filesize
256KB

Download
memory/2552-30-0x0000000002710000-0x0000000002750000-memory.dmp

Filesize
256KB

Download
memory/2552-26-0x000000006FDD0000-0x000000007037B000-memory.dmp

Filesize
5.7MB

Download
memory/2552-29-0x0000000002710000-0x0000000002750000-memory.dmp

Filesize
256KB

Download
memory/2552-28-0x000000006FDD0000-0x000000007037B000-memory.dmp

Filesize
5.7MB

Download
memory/2552-27-0x0000000002710000-0x0000000002750000-memory.dmp

Filesize
256KB

Download
memory/2552-43-0x000000006FDD0000-0x000000007037B000-memory.dmp

Filesize
5.7MB

Download
memory/2644-15-0x000000006FDD0000-0x000000007037B000-memory.dmp

Filesize
5.7MB

Download
memory/2644-18-0x0000000002B80000-0x0000000002BC0000-memory.dmp

Filesize
256KB

Download
memory/2644-16-0x000000006FDD0000-0x000000007037B000-memory.dmp

Filesize
5.7MB

Download
memory/2644-31-0x000000006FDD0000-0x000000007037B000-memory.dmp

Filesize
5.7MB

Download