zgrat | 2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/01/2024, 22:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe
Size

3.3MB
MD5

d85db0293e61428cd24a074f48a2281f
SHA1

37d5a69706a41b1ed301da11c6e58a332588ffd3
SHA256

2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98
SHA512

aaf2c30f11007c37e2a9dfd7fdd8e4cc98770169a7941ba5a9ce6915b37b1877dd7933f90d38dd77fe5772f505fb0a12d00e3f04966bb4f4a2eb6ff967db6d75
SSDEEP

49152:hO1ACC+PI8HZMMuumQaoLG+xSp+hTT2aaH4uf2ecLujhj:U1ACC+PRUf0ujV

Score

10^/10

zgrat rat

Malware Config

Signatures

Detect ZGRat V1 34 IoCs

resource	yara_rule
behavioral1/memory/2996-2-0x000000001BC10000-0x000000001BCF2000-memory.dmp	family_zgrat_v1
behavioral1/memory/2996-3-0x000000001BC10000-0x000000001BCED000-memory.dmp	family_zgrat_v1
behavioral1/memory/2996-4-0x000000001BC10000-0x000000001BCED000-memory.dmp	family_zgrat_v1
behavioral1/memory/2996-6-0x000000001BC10000-0x000000001BCED000-memory.dmp	family_zgrat_v1
behavioral1/memory/2996-8-0x000000001BC10000-0x000000001BCED000-memory.dmp	family_zgrat_v1
behavioral1/memory/2996-10-0x000000001BC10000-0x000000001BCED000-memory.dmp	family_zgrat_v1
behavioral1/memory/2996-12-0x000000001BC10000-0x000000001BCED000-memory.dmp	family_zgrat_v1
behavioral1/memory/2996-16-0x000000001BC10000-0x000000001BCED000-memory.dmp	family_zgrat_v1
behavioral1/memory/2996-14-0x000000001BC10000-0x000000001BCED000-memory.dmp	family_zgrat_v1
behavioral1/memory/2996-18-0x000000001BC10000-0x000000001BCED000-memory.dmp	family_zgrat_v1
behavioral1/memory/2996-20-0x000000001BC10000-0x000000001BCED000-memory.dmp	family_zgrat_v1
behavioral1/memory/2996-22-0x000000001BC10000-0x000000001BCED000-memory.dmp	family_zgrat_v1
behavioral1/memory/2996-24-0x000000001BC10000-0x000000001BCED000-memory.dmp	family_zgrat_v1
behavioral1/memory/2996-26-0x000000001BC10000-0x000000001BCED000-memory.dmp	family_zgrat_v1
behavioral1/memory/2996-28-0x000000001BC10000-0x000000001BCED000-memory.dmp	family_zgrat_v1
behavioral1/memory/2996-30-0x000000001BC10000-0x000000001BCED000-memory.dmp	family_zgrat_v1
behavioral1/memory/2996-32-0x000000001BC10000-0x000000001BCED000-memory.dmp	family_zgrat_v1
behavioral1/memory/2996-36-0x000000001BC10000-0x000000001BCED000-memory.dmp	family_zgrat_v1
behavioral1/memory/2996-40-0x000000001BC10000-0x000000001BCED000-memory.dmp	family_zgrat_v1
behavioral1/memory/2996-38-0x000000001BC10000-0x000000001BCED000-memory.dmp	family_zgrat_v1
behavioral1/memory/2996-34-0x000000001BC10000-0x000000001BCED000-memory.dmp	family_zgrat_v1
behavioral1/memory/2996-44-0x000000001BC10000-0x000000001BCED000-memory.dmp	family_zgrat_v1
behavioral1/memory/2996-50-0x000000001BC10000-0x000000001BCED000-memory.dmp	family_zgrat_v1
behavioral1/memory/2996-48-0x000000001BC10000-0x000000001BCED000-memory.dmp	family_zgrat_v1
behavioral1/memory/2996-52-0x000000001BC10000-0x000000001BCED000-memory.dmp	family_zgrat_v1
behavioral1/memory/2996-46-0x000000001BC10000-0x000000001BCED000-memory.dmp	family_zgrat_v1
behavioral1/memory/2996-42-0x000000001BC10000-0x000000001BCED000-memory.dmp	family_zgrat_v1
behavioral1/memory/2996-54-0x000000001BC10000-0x000000001BCED000-memory.dmp	family_zgrat_v1
behavioral1/memory/2996-56-0x000000001BC10000-0x000000001BCED000-memory.dmp	family_zgrat_v1
behavioral1/memory/2996-58-0x000000001BC10000-0x000000001BCED000-memory.dmp	family_zgrat_v1
behavioral1/memory/2996-60-0x000000001BC10000-0x000000001BCED000-memory.dmp	family_zgrat_v1
behavioral1/memory/2996-62-0x000000001BC10000-0x000000001BCED000-memory.dmp	family_zgrat_v1
behavioral1/memory/2996-64-0x000000001BC10000-0x000000001BCED000-memory.dmp	family_zgrat_v1
behavioral1/memory/2996-66-0x000000001BC10000-0x000000001BCED000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2996	2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe
2996	2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe
2996	2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe
2996	2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe
2996	2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe
2996	2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe
2996	2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe
2996	2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe
2996	2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe
2996	2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2996	2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 1952	2996	2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe	28
PID 2996 wrote to memory of 1952	2996	2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe	28
PID 2996 wrote to memory of 1952	2996	2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe	28
PID 2996 wrote to memory of 2008	2996	2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe	29
PID 2996 wrote to memory of 2008	2996	2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe	29
PID 2996 wrote to memory of 2008	2996	2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe	29
PID 2996 wrote to memory of 1844	2996	2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe	30
PID 2996 wrote to memory of 1844	2996	2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe	30
PID 2996 wrote to memory of 1844	2996	2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe	30
PID 2996 wrote to memory of 2252	2996	2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe	31
PID 2996 wrote to memory of 2252	2996	2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe	31
PID 2996 wrote to memory of 2252	2996	2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe	31
PID 2996 wrote to memory of 1976	2996	2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe	32
PID 2996 wrote to memory of 1976	2996	2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe	32
PID 2996 wrote to memory of 1976	2996	2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe	32
PID 2996 wrote to memory of 1520	2996	2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe	33
PID 2996 wrote to memory of 1520	2996	2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe	33
PID 2996 wrote to memory of 1520	2996	2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe	33
PID 2996 wrote to memory of 1984	2996	2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe	34
PID 2996 wrote to memory of 1984	2996	2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe	34
PID 2996 wrote to memory of 1984	2996	2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe	34
PID 2996 wrote to memory of 884	2996	2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe	35
PID 2996 wrote to memory of 884	2996	2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe	35
PID 2996 wrote to memory of 884	2996	2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe	35
PID 2996 wrote to memory of 1440	2996	2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe	36
PID 2996 wrote to memory of 1440	2996	2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe	36
PID 2996 wrote to memory of 1440	2996	2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe	36
PID 2996 wrote to memory of 1416	2996	2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe	37
PID 2996 wrote to memory of 1416	2996	2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe	37
PID 2996 wrote to memory of 1416	2996	2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe	37

C:\Users\Admin\AppData\Local\Temp\2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe
"C:\Users\Admin\AppData\Local\Temp\2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Users\Admin\AppData\Local\Temp\2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe
  C:\Users\Admin\AppData\Local\Temp\2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe
  2⤵
  PID:1952
- C:\Users\Admin\AppData\Local\Temp\2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe
  C:\Users\Admin\AppData\Local\Temp\2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe
  2⤵
  PID:2008
- C:\Users\Admin\AppData\Local\Temp\2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe
  C:\Users\Admin\AppData\Local\Temp\2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe
  2⤵
  PID:1844
- C:\Users\Admin\AppData\Local\Temp\2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe
  C:\Users\Admin\AppData\Local\Temp\2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe
  2⤵
  PID:2252
- C:\Users\Admin\AppData\Local\Temp\2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe
  C:\Users\Admin\AppData\Local\Temp\2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe
  2⤵
  PID:1976
- C:\Users\Admin\AppData\Local\Temp\2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe
  C:\Users\Admin\AppData\Local\Temp\2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe
  2⤵
  PID:1520
- C:\Users\Admin\AppData\Local\Temp\2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe
  C:\Users\Admin\AppData\Local\Temp\2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe
  2⤵
  PID:1984
- C:\Users\Admin\AppData\Local\Temp\2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe
  C:\Users\Admin\AppData\Local\Temp\2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe
  2⤵
  PID:884
- C:\Users\Admin\AppData\Local\Temp\2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe
  C:\Users\Admin\AppData\Local\Temp\2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe
  2⤵
  PID:1440
- C:\Users\Admin\AppData\Local\Temp\2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe
  C:\Users\Admin\AppData\Local\Temp\2ab6e685fe22e01e59346cb80619d266b67cc63b732ef0fe1e3cf190d095ef98.exe
  2⤵
  PID:1416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2996-0-0x00000000012A0000-0x00000000015E8000-memory.dmp

Filesize
3.3MB

Download
memory/2996-1-0x000007FEF4FD0000-0x000007FEF59BC000-memory.dmp

Filesize
9.9MB

Download
memory/2996-2-0x000000001BC10000-0x000000001BCF2000-memory.dmp

Filesize
904KB

Download
memory/2996-3-0x000000001BC10000-0x000000001BCED000-memory.dmp

Filesize
884KB

Download
memory/2996-4-0x000000001BC10000-0x000000001BCED000-memory.dmp

Filesize
884KB

Download
memory/2996-6-0x000000001BC10000-0x000000001BCED000-memory.dmp

Filesize
884KB

Download
memory/2996-8-0x000000001BC10000-0x000000001BCED000-memory.dmp

Filesize
884KB

Download
memory/2996-10-0x000000001BC10000-0x000000001BCED000-memory.dmp

Filesize
884KB

Download
memory/2996-12-0x000000001BC10000-0x000000001BCED000-memory.dmp

Filesize
884KB

Download
memory/2996-16-0x000000001BC10000-0x000000001BCED000-memory.dmp

Filesize
884KB

Download
memory/2996-14-0x000000001BC10000-0x000000001BCED000-memory.dmp

Filesize
884KB

Download
memory/2996-18-0x000000001BC10000-0x000000001BCED000-memory.dmp

Filesize
884KB

Download
memory/2996-20-0x000000001BC10000-0x000000001BCED000-memory.dmp

Filesize
884KB

Download
memory/2996-22-0x000000001BC10000-0x000000001BCED000-memory.dmp

Filesize
884KB

Download
memory/2996-24-0x000000001BC10000-0x000000001BCED000-memory.dmp

Filesize
884KB

Download
memory/2996-26-0x000000001BC10000-0x000000001BCED000-memory.dmp

Filesize
884KB

Download
memory/2996-28-0x000000001BC10000-0x000000001BCED000-memory.dmp

Filesize
884KB

Download
memory/2996-30-0x000000001BC10000-0x000000001BCED000-memory.dmp

Filesize
884KB

Download
memory/2996-32-0x000000001BC10000-0x000000001BCED000-memory.dmp

Filesize
884KB

Download
memory/2996-36-0x000000001BC10000-0x000000001BCED000-memory.dmp

Filesize
884KB

Download
memory/2996-40-0x000000001BC10000-0x000000001BCED000-memory.dmp

Filesize
884KB

Download
memory/2996-38-0x000000001BC10000-0x000000001BCED000-memory.dmp

Filesize
884KB

Download
memory/2996-34-0x000000001BC10000-0x000000001BCED000-memory.dmp

Filesize
884KB

Download
memory/2996-44-0x000000001BC10000-0x000000001BCED000-memory.dmp

Filesize
884KB

Download
memory/2996-50-0x000000001BC10000-0x000000001BCED000-memory.dmp

Filesize
884KB

Download
memory/2996-48-0x000000001BC10000-0x000000001BCED000-memory.dmp

Filesize
884KB

Download
memory/2996-52-0x000000001BC10000-0x000000001BCED000-memory.dmp

Filesize
884KB

Download
memory/2996-46-0x000000001BC10000-0x000000001BCED000-memory.dmp

Filesize
884KB

Download
memory/2996-42-0x000000001BC10000-0x000000001BCED000-memory.dmp

Filesize
884KB

Download
memory/2996-54-0x000000001BC10000-0x000000001BCED000-memory.dmp

Filesize
884KB

Download
memory/2996-56-0x000000001BC10000-0x000000001BCED000-memory.dmp

Filesize
884KB

Download
memory/2996-58-0x000000001BC10000-0x000000001BCED000-memory.dmp

Filesize
884KB

Download
memory/2996-60-0x000000001BC10000-0x000000001BCED000-memory.dmp

Filesize
884KB

Download
memory/2996-62-0x000000001BC10000-0x000000001BCED000-memory.dmp

Filesize
884KB

Download
memory/2996-64-0x000000001BC10000-0x000000001BCED000-memory.dmp

Filesize
884KB

Download
memory/2996-66-0x000000001BC10000-0x000000001BCED000-memory.dmp

Filesize
884KB

Download
memory/2996-935-0x000000001BB90000-0x000000001BC10000-memory.dmp

Filesize
512KB

Download
memory/2996-936-0x00000000006B0000-0x00000000006B1000-memory.dmp

Filesize
4KB

Download
memory/2996-937-0x00000000029F0000-0x0000000002A6A000-memory.dmp

Filesize
488KB

Download
memory/2996-938-0x000000001BAE0000-0x000000001BB2C000-memory.dmp

Filesize
304KB

Download
memory/2996-939-0x000007FEF4FD0000-0x000007FEF59BC000-memory.dmp

Filesize
9.9MB

Download