zgrat | 5ccb31ec6aaf7cbfd7b8b4d5817e11e616e99e3d21e376b510ea0afce19f518d

Analysis

max time kernel
144s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 14:27

Target

ORDER PDF.exe
Size

297KB
MD5

2cabd312ceecf306fb34337b1cec6b60
SHA1

651fcedd94b87db0d563feb34f5c45441bf58b19
SHA256

c075f5ed220d8525319769df7c13636da0b1811cb0497af91ea53b2473711bd2
SHA512

dea464a949077b54ca4bab96b78f4910851ddd69a637b2f8ac23bfea8027eb8cf02c6710f252a6960d9db83641b485ff200a36b8cfc43a8a1c9b12df362793a2
SSDEEP

6144:RJR/V8Jj0klDyNSj4mr8KZyvsanCdU9IbQXFWNIDScwzih:RJZV8Jj0klDyEjpr86yvsYC+GkXFWYwu

Score

10^/10

zgrat rat

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral2/memory/3836-7-0x00000000049F0000-0x0000000004A06000-memory.dmp	family_zgrat_v1

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3836	ORDER PDF.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3836 wrote to memory of 3444	3836	ORDER PDF.exe	28
PID 3836 wrote to memory of 3444	3836	ORDER PDF.exe	28
PID 3836 wrote to memory of 3444	3836	ORDER PDF.exe	28
PID 3836 wrote to memory of 2760	3836	ORDER PDF.exe	27
PID 3836 wrote to memory of 2760	3836	ORDER PDF.exe	27
PID 3836 wrote to memory of 2760	3836	ORDER PDF.exe	27
PID 3836 wrote to memory of 4816	3836	ORDER PDF.exe	26
PID 3836 wrote to memory of 4816	3836	ORDER PDF.exe	26
PID 3836 wrote to memory of 4816	3836	ORDER PDF.exe	26
PID 3836 wrote to memory of 2452	3836	ORDER PDF.exe	24
PID 3836 wrote to memory of 2452	3836	ORDER PDF.exe	24
PID 3836 wrote to memory of 2452	3836	ORDER PDF.exe	24
PID 3836 wrote to memory of 1536	3836	ORDER PDF.exe	25
PID 3836 wrote to memory of 1536	3836	ORDER PDF.exe	25
PID 3836 wrote to memory of 1536	3836	ORDER PDF.exe	25

C:\Users\Admin\AppData\Local\Temp\ORDER PDF.exe
"C:\Users\Admin\AppData\Local\Temp\ORDER PDF.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3836
- C:\Users\Admin\AppData\Local\Temp\ORDER PDF.exe
  "C:\Users\Admin\AppData\Local\Temp\ORDER PDF.exe"
  2⤵
  PID:2452
- C:\Users\Admin\AppData\Local\Temp\ORDER PDF.exe
  "C:\Users\Admin\AppData\Local\Temp\ORDER PDF.exe"
  2⤵
  PID:1536
- C:\Users\Admin\AppData\Local\Temp\ORDER PDF.exe
  "C:\Users\Admin\AppData\Local\Temp\ORDER PDF.exe"
  2⤵
  PID:4816
- C:\Users\Admin\AppData\Local\Temp\ORDER PDF.exe
  "C:\Users\Admin\AppData\Local\Temp\ORDER PDF.exe"
  2⤵
  PID:2760
- C:\Users\Admin\AppData\Local\Temp\ORDER PDF.exe
  "C:\Users\Admin\AppData\Local\Temp\ORDER PDF.exe"
  2⤵
  PID:3444

memory/3836-0-0x0000000000010000-0x0000000000060000-memory.dmp

Filesize
320KB

Download
memory/3836-1-0x0000000074700000-0x0000000074EB0000-memory.dmp

Filesize
7.7MB

Download
memory/3836-3-0x0000000004AC0000-0x0000000004B52000-memory.dmp

Filesize
584KB

Download
memory/3836-6-0x0000000004D50000-0x0000000004D60000-memory.dmp

Filesize
64KB

Download
memory/3836-5-0x00000000049B0000-0x00000000049CE000-memory.dmp

Filesize
120KB

Download
memory/3836-4-0x0000000004B60000-0x0000000004BFC000-memory.dmp

Filesize
624KB

Download
memory/3836-9-0x0000000074700000-0x0000000074EB0000-memory.dmp

Filesize
7.7MB

Download
memory/3836-7-0x00000000049F0000-0x0000000004A06000-memory.dmp

Filesize
88KB

Download
memory/3836-2-0x0000000004FD0000-0x0000000005574000-memory.dmp

Filesize
5.6MB

Download