zgrat | a209c55478f217066ba1babd44459d2b0a4da6ed90aa5928280eaf6ac2f0457b

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-03-2024 12:37

Target

SecuriteInfo.com.Win32.PWSX-gen.22132.exe
Size

499KB
MD5

764f801b0842d8fe564f01a81cfe4526
SHA1

d3cd929c42f808c1ddfdef4d8b528f1e1d981bba
SHA256

a209c55478f217066ba1babd44459d2b0a4da6ed90aa5928280eaf6ac2f0457b
SHA512

5019550b6c11df7f466531f0564d6f7bfb214a92f0d508bc631e8f0a39b38a4c09611241b87bc74f509e9851c68657363d77d93436b8b2c604d9ed6e6202dc21
SSDEEP

12288:OvnWvqHe7UF6q12BlW7872GOXYtKFlK1CJsIk:UWvUGBlW787+zK1jD

Score

10^/10

zgrat rat

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral1/memory/1720-0-0x0000000000A70000-0x0000000000AF4000-memory.dmp	family_zgrat_v1

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1720 set thread context of 2976	1720	SecuriteInfo.com.Win32.PWSX-gen.22132.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2604	2976	WerFault.exe	29

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2976	1720	SecuriteInfo.com.Win32.PWSX-gen.22132.exe	29
PID 1720 wrote to memory of 2976	1720	SecuriteInfo.com.Win32.PWSX-gen.22132.exe	29
PID 1720 wrote to memory of 2976	1720	SecuriteInfo.com.Win32.PWSX-gen.22132.exe	29
PID 1720 wrote to memory of 2976	1720	SecuriteInfo.com.Win32.PWSX-gen.22132.exe	29
PID 1720 wrote to memory of 2976	1720	SecuriteInfo.com.Win32.PWSX-gen.22132.exe	29
PID 1720 wrote to memory of 2976	1720	SecuriteInfo.com.Win32.PWSX-gen.22132.exe	29
PID 1720 wrote to memory of 2976	1720	SecuriteInfo.com.Win32.PWSX-gen.22132.exe	29
PID 1720 wrote to memory of 2976	1720	SecuriteInfo.com.Win32.PWSX-gen.22132.exe	29
PID 1720 wrote to memory of 2976	1720	SecuriteInfo.com.Win32.PWSX-gen.22132.exe	29
PID 1720 wrote to memory of 2976	1720	SecuriteInfo.com.Win32.PWSX-gen.22132.exe	29
PID 1720 wrote to memory of 2976	1720	SecuriteInfo.com.Win32.PWSX-gen.22132.exe	29
PID 1720 wrote to memory of 2976	1720	SecuriteInfo.com.Win32.PWSX-gen.22132.exe	29
PID 1720 wrote to memory of 2976	1720	SecuriteInfo.com.Win32.PWSX-gen.22132.exe	29
PID 2976 wrote to memory of 2604	2976	RegAsm.exe	30
PID 2976 wrote to memory of 2604	2976	RegAsm.exe	30
PID 2976 wrote to memory of 2604	2976	RegAsm.exe	30
PID 2976 wrote to memory of 2604	2976	RegAsm.exe	30

memory/1720-6-0x00000000022D0000-0x00000000042D0000-memory.dmp

Filesize
32.0MB

Download
memory/1720-1-0x00000000746C0000-0x0000000074DAE000-memory.dmp

Filesize
6.9MB

Download
memory/1720-16-0x00000000746C0000-0x0000000074DAE000-memory.dmp

Filesize
6.9MB

Download
memory/1720-0-0x0000000000A70000-0x0000000000AF4000-memory.dmp

Filesize
528KB

Download
memory/2976-8-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2976-7-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2976-5-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2976-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2976-9-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2976-12-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2976-4-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2976-15-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2976-17-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download