zgrat | 5ccb31ec6aaf7cbfd7b8b4d5817e11e616e99e3d21e376b510ea0afce19f518d

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08-01-2024 14:27

Target

ORDER PDF.exe
Size

297KB
MD5

2cabd312ceecf306fb34337b1cec6b60
SHA1

651fcedd94b87db0d563feb34f5c45441bf58b19
SHA256

c075f5ed220d8525319769df7c13636da0b1811cb0497af91ea53b2473711bd2
SHA512

dea464a949077b54ca4bab96b78f4910851ddd69a637b2f8ac23bfea8027eb8cf02c6710f252a6960d9db83641b485ff200a36b8cfc43a8a1c9b12df362793a2
SSDEEP

6144:RJR/V8Jj0klDyNSj4mr8KZyvsanCdU9IbQXFWNIDScwzih:RJZV8Jj0klDyEjpr86yvsYC+GkXFWYwu

Score

10^/10

zgrat rat

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral1/memory/2004-4-0x0000000000480000-0x0000000000496000-memory.dmp	family_zgrat_v1

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2004	ORDER PDF.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2036	2004	ORDER PDF.exe	28
PID 2004 wrote to memory of 2036	2004	ORDER PDF.exe	28
PID 2004 wrote to memory of 2036	2004	ORDER PDF.exe	28
PID 2004 wrote to memory of 2036	2004	ORDER PDF.exe	28
PID 2004 wrote to memory of 2660	2004	ORDER PDF.exe	29
PID 2004 wrote to memory of 2660	2004	ORDER PDF.exe	29
PID 2004 wrote to memory of 2660	2004	ORDER PDF.exe	29
PID 2004 wrote to memory of 2660	2004	ORDER PDF.exe	29
PID 2004 wrote to memory of 2140	2004	ORDER PDF.exe	30
PID 2004 wrote to memory of 2140	2004	ORDER PDF.exe	30
PID 2004 wrote to memory of 2140	2004	ORDER PDF.exe	30
PID 2004 wrote to memory of 2140	2004	ORDER PDF.exe	30
PID 2004 wrote to memory of 1068	2004	ORDER PDF.exe	31
PID 2004 wrote to memory of 1068	2004	ORDER PDF.exe	31
PID 2004 wrote to memory of 1068	2004	ORDER PDF.exe	31
PID 2004 wrote to memory of 1068	2004	ORDER PDF.exe	31
PID 2004 wrote to memory of 2144	2004	ORDER PDF.exe	32
PID 2004 wrote to memory of 2144	2004	ORDER PDF.exe	32
PID 2004 wrote to memory of 2144	2004	ORDER PDF.exe	32
PID 2004 wrote to memory of 2144	2004	ORDER PDF.exe	32

C:\Users\Admin\AppData\Local\Temp\ORDER PDF.exe
"C:\Users\Admin\AppData\Local\Temp\ORDER PDF.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Users\Admin\AppData\Local\Temp\ORDER PDF.exe
  "C:\Users\Admin\AppData\Local\Temp\ORDER PDF.exe"
  2⤵
  PID:2036
- C:\Users\Admin\AppData\Local\Temp\ORDER PDF.exe
  "C:\Users\Admin\AppData\Local\Temp\ORDER PDF.exe"
  2⤵
  PID:2660
- C:\Users\Admin\AppData\Local\Temp\ORDER PDF.exe
  "C:\Users\Admin\AppData\Local\Temp\ORDER PDF.exe"
  2⤵
  PID:2140
- C:\Users\Admin\AppData\Local\Temp\ORDER PDF.exe
  "C:\Users\Admin\AppData\Local\Temp\ORDER PDF.exe"
  2⤵
  PID:1068
- C:\Users\Admin\AppData\Local\Temp\ORDER PDF.exe
  "C:\Users\Admin\AppData\Local\Temp\ORDER PDF.exe"
  2⤵
  PID:2144

memory/2004-0-0x0000000000FC0000-0x0000000001010000-memory.dmp

Filesize
320KB

Download
memory/2004-1-0x0000000074CA0000-0x000000007538E000-memory.dmp

Filesize
6.9MB

Download
memory/2004-2-0x0000000000330000-0x000000000034E000-memory.dmp

Filesize
120KB

Download
memory/2004-3-0x0000000004C30000-0x0000000004C70000-memory.dmp

Filesize
256KB

Download
memory/2004-4-0x0000000000480000-0x0000000000496000-memory.dmp

Filesize
88KB

Download
memory/2004-5-0x0000000074CA0000-0x000000007538E000-memory.dmp

Filesize
6.9MB

Download