Analysis

  • max time kernel
    120s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    27/01/2024, 03:01 UTC

General

  • Target

    791a6e32072b1ba9a04cba08ea2ed6bd.exe

  • Size

    2.4MB

  • MD5

    791a6e32072b1ba9a04cba08ea2ed6bd

  • SHA1

    64c8d9dda10494e48241eea9f27f255df5100746

  • SHA256

    5c892da90bd999b35cc59bb05f241ce94aef00a392a87bd44384655a393e686c

  • SHA512

    ef161b54627e1b68121c9df6b83e1e3c55ca53d5d6f1fe8e03317ecb7fe010f9f49f05020b90894e9433769d497ab65cae55c7702e311e66dc9208187e54aba4

  • SSDEEP

    49152:bAmz4YMLZcVNoBTHsYfCdd2c8ZrVBVyADVvl0ivmmvziEPeoW:kmz4tYoBTHsYfbrbEaeWmmvzikeoW

Score
10/10

Malware Config

Signatures

  • Detect ZGRat V1 1 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

Processes

  • C:\Users\Admin\AppData\Local\Temp\791a6e32072b1ba9a04cba08ea2ed6bd.exe
    "C:\Users\Admin\AppData\Local\Temp\791a6e32072b1ba9a04cba08ea2ed6bd.exe"
    1⤵
      PID:2544

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2544-1-0x0000000074C50000-0x000000007533E000-memory.dmp

      Filesize

      6.9MB

    • memory/2544-0-0x0000000001170000-0x00000000013DA000-memory.dmp

      Filesize

      2.4MB

    • memory/2544-2-0x00000000002F0000-0x0000000000330000-memory.dmp

      Filesize

      256KB

    • memory/2544-3-0x0000000006DF0000-0x0000000007180000-memory.dmp

      Filesize

      3.6MB

    • memory/2544-4-0x0000000007180000-0x0000000007260000-memory.dmp

      Filesize

      896KB

    • memory/2544-5-0x0000000000B30000-0x0000000000B72000-memory.dmp

      Filesize

      264KB

    • memory/2544-6-0x00000000002F0000-0x0000000000330000-memory.dmp

      Filesize

      256KB

    • memory/2544-7-0x0000000074C50000-0x000000007533E000-memory.dmp

      Filesize

      6.9MB

    • memory/2544-8-0x00000000002F0000-0x0000000000330000-memory.dmp

      Filesize

      256KB

    • memory/2544-9-0x00000000002F0000-0x0000000000330000-memory.dmp

      Filesize

      256KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.