zgrat | a209c55478f217066ba1babd44459d2b0a4da6ed90aa5928280eaf6ac2f0457b

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-03-2024 12:36

Target

SecuriteInfo.com.Win32.PWSX-gen.22132.9761.exe
Size

499KB
MD5

764f801b0842d8fe564f01a81cfe4526
SHA1

d3cd929c42f808c1ddfdef4d8b528f1e1d981bba
SHA256

a209c55478f217066ba1babd44459d2b0a4da6ed90aa5928280eaf6ac2f0457b
SHA512

5019550b6c11df7f466531f0564d6f7bfb214a92f0d508bc631e8f0a39b38a4c09611241b87bc74f509e9851c68657363d77d93436b8b2c604d9ed6e6202dc21
SSDEEP

12288:OvnWvqHe7UF6q12BlW7872GOXYtKFlK1CJsIk:UWvUGBlW787+zK1jD

Score

10^/10

zgrat rat

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral1/memory/2296-0-0x0000000000840000-0x00000000008C4000-memory.dmp	family_zgrat_v1

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2296 set thread context of 2888	2296	SecuriteInfo.com.Win32.PWSX-gen.22132.9761.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2576	2888	WerFault.exe	29

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2888	2296	SecuriteInfo.com.Win32.PWSX-gen.22132.9761.exe	29
PID 2296 wrote to memory of 2888	2296	SecuriteInfo.com.Win32.PWSX-gen.22132.9761.exe	29
PID 2296 wrote to memory of 2888	2296	SecuriteInfo.com.Win32.PWSX-gen.22132.9761.exe	29
PID 2296 wrote to memory of 2888	2296	SecuriteInfo.com.Win32.PWSX-gen.22132.9761.exe	29
PID 2296 wrote to memory of 2888	2296	SecuriteInfo.com.Win32.PWSX-gen.22132.9761.exe	29
PID 2296 wrote to memory of 2888	2296	SecuriteInfo.com.Win32.PWSX-gen.22132.9761.exe	29
PID 2296 wrote to memory of 2888	2296	SecuriteInfo.com.Win32.PWSX-gen.22132.9761.exe	29
PID 2296 wrote to memory of 2888	2296	SecuriteInfo.com.Win32.PWSX-gen.22132.9761.exe	29
PID 2296 wrote to memory of 2888	2296	SecuriteInfo.com.Win32.PWSX-gen.22132.9761.exe	29
PID 2296 wrote to memory of 2888	2296	SecuriteInfo.com.Win32.PWSX-gen.22132.9761.exe	29
PID 2296 wrote to memory of 2888	2296	SecuriteInfo.com.Win32.PWSX-gen.22132.9761.exe	29
PID 2296 wrote to memory of 2888	2296	SecuriteInfo.com.Win32.PWSX-gen.22132.9761.exe	29
PID 2296 wrote to memory of 2888	2296	SecuriteInfo.com.Win32.PWSX-gen.22132.9761.exe	29
PID 2888 wrote to memory of 2576	2888	RegAsm.exe	30
PID 2888 wrote to memory of 2576	2888	RegAsm.exe	30
PID 2888 wrote to memory of 2576	2888	RegAsm.exe	30
PID 2888 wrote to memory of 2576	2888	RegAsm.exe	30

memory/2296-0-0x0000000000840000-0x00000000008C4000-memory.dmp

Filesize
528KB

Download
memory/2296-1-0x0000000073CB0000-0x000000007439E000-memory.dmp

Filesize
6.9MB

Download
memory/2296-16-0x0000000073CB0000-0x000000007439E000-memory.dmp

Filesize
6.9MB

Download
memory/2296-13-0x00000000023E0000-0x00000000043E0000-memory.dmp

Filesize
32.0MB

Download
memory/2888-11-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2888-6-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2888-8-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2888-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2888-5-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2888-4-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2888-15-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2888-7-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2888-17-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download