zgrat | 53cef565077e1ba82825cd96017ff7e5d43ab9ba1ab9885d70fd129ec1f57020

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 16:41

Target

53cef565077e1ba82825cd96017ff7e5d43ab9ba1ab9885d70fd129ec1f57020.exe
Size

6.8MB
MD5

02b0a64fe2784c334a5a7d835b301c95
SHA1

3a8eadba100c38378fbd0b3f22bad47a363fcdda
SHA256

53cef565077e1ba82825cd96017ff7e5d43ab9ba1ab9885d70fd129ec1f57020
SHA512

2d1b91593636c736faec83867c2688b65befd4357320ed8e5e903d09dd682b2626602eac6ff1b6fe13967a3f2dc30db8d4521a795d18e707f92d880d28f541bf
SSDEEP

49152:wd1k+vecp3VHOr38IHn60Mel24xLxMPS1Abr8GsFTULqrfAOtf:wdpGcp3Qr8IHn44xIJbnef

Score

10^/10

zgrat rat

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral1/memory/3000-1-0x0000000000390000-0x0000000000A4C000-memory.dmp	family_zgrat_v1

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2612	3000	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2612	3000	53cef565077e1ba82825cd96017ff7e5d43ab9ba1ab9885d70fd129ec1f57020.exe	28
PID 3000 wrote to memory of 2612	3000	53cef565077e1ba82825cd96017ff7e5d43ab9ba1ab9885d70fd129ec1f57020.exe	28
PID 3000 wrote to memory of 2612	3000	53cef565077e1ba82825cd96017ff7e5d43ab9ba1ab9885d70fd129ec1f57020.exe	28
PID 3000 wrote to memory of 2612	3000	53cef565077e1ba82825cd96017ff7e5d43ab9ba1ab9885d70fd129ec1f57020.exe	28

C:\Users\Admin\AppData\Local\Temp\53cef565077e1ba82825cd96017ff7e5d43ab9ba1ab9885d70fd129ec1f57020.exe
"C:\Users\Admin\AppData\Local\Temp\53cef565077e1ba82825cd96017ff7e5d43ab9ba1ab9885d70fd129ec1f57020.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 564
  2⤵
  - Program crash
  PID:2612

memory/3000-0-0x00000000745A0000-0x0000000074C8E000-memory.dmp

Filesize
6.9MB

Download
memory/3000-1-0x0000000000390000-0x0000000000A4C000-memory.dmp

Filesize
6.7MB

Download
memory/3000-2-0x00000000051F0000-0x0000000005230000-memory.dmp

Filesize
256KB

Download
memory/3000-3-0x00000000745A0000-0x0000000074C8E000-memory.dmp

Filesize
6.9MB

Download
memory/3000-4-0x00000000051F0000-0x0000000005230000-memory.dmp

Filesize
256KB

Download