Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
16/01/2024, 01:24
General
- Target ama.exe
- Size 5.0MB
- Sample240116-bsdk4aadek
- SHA256 22eb695c324270e56f16f129142a77f0ef297eb657eca436c85733aca7eb24d9
Malware Config
Signatures
- Detect ZGRat V1 1 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Loads dropped DLL 1 IoCs
- Program crash 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ama.exe"C:\Users\Admin\AppData\Local\Temp\ama.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 10522⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3016 -ip 30161⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
Protect544cd51a.dll
memory/3016-14-0x0000000002A70000-0x0000000002A80000-memory.dmp
memory/3016-21-0x0000000006B90000-0x0000000006C90000-memory.dmp
memory/3016-3-0x0000000075040000-0x00000000757F0000-memory.dmp
memory/3016-4-0x0000000002A70000-0x0000000002A80000-memory.dmp
memory/3016-5-0x0000000005280000-0x00000000054A0000-memory.dmp
memory/3016-0-0x0000000075040000-0x00000000757F0000-memory.dmp
memory/3016-6-0x00000000065D0000-0x0000000006762000-memory.dmp
memory/3016-1-0x0000000000190000-0x0000000000698000-memory.dmp
memory/3016-2-0x00000000050A0000-0x000000000513C000-memory.dmp
memory/3016-15-0x0000000005260000-0x0000000005270000-memory.dmp
memory/3016-18-0x0000000002A70000-0x0000000002A80000-memory.dmp
memory/3016-20-0x0000000006B90000-0x0000000006C90000-memory.dmp
memory/3016-19-0x0000000006B90000-0x0000000006C90000-memory.dmp
memory/3016-17-0x0000000002A70000-0x0000000002A80000-memory.dmp
memory/3016-16-0x0000000002A70000-0x0000000002A80000-memory.dmp
memory/3016-13-0x0000000002A70000-0x0000000002A80000-memory.dmp
memory/3016-12-0x0000000002A70000-0x0000000002A80000-memory.dmp
memory/3016-22-0x0000000075040000-0x00000000757F0000-memory.dmp