Analysis
-
max time kernel
119s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
02-03-2024 20:51
General
-
Target
dcrat/data/dotNET_Reactor.Console.exe
-
Size
14KB
-
MD5
0b4dbf61a98f3e34cdd3a1b08a6a4609
-
SHA1
73587f1f5d040541b230513d22d696513dbd4cf9
-
SHA256
e817802f166662a7df0b144571354d74b10e34d120f91ae9d84ca3ba925241c6
-
SHA512
7cca370890e4e245c84507623531b5f54b76ced3e8c6b87cdfc47ed16560b6a0a5cf9e0556075cd0d9266908e445b854114edd69d50870839624589676c0e688
-
SSDEEP
192:8jY53csvsqHwrHEdSAejbMfDn1Gp78dsKGXOdlWW1ksTkwy:8jEnskskQlm1GRJKGXOdlWW1XTR
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dcrat\data\dotNET_Reactor.Console.exe"C:\Users\Admin\AppData\Local\Temp\dcrat\data\dotNET_Reactor.Console.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dcrat\data\dotNET_Reactor.exe"C:\Users\Admin\AppData\Local\Temp\dcrat\data\dotNET_Reactor.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD5bc6887aa21e7794a2c27e3ffd3dc3ed0
SHA12b845941c93094d7203553582f69d0c61a9fcee4
SHA256919130e16d33fd58d0370b06b7fb0fc253f5b571fc33ad5c21eb8dafe4760c94
SHA5129e952ae72851ba081809ea5d7a86108b0355f0882bae912e0ecf931fde2e878994142b6c16094473305392981439e49d9a32aa6aaf94edd07238a0ecb787e834
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.0MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
160KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
256KB
-
Filesize
40KB
-
Filesize
9.9MB
-
Filesize
9.9MB