zgrat | de08c69d06b2f176058aa6001b9f9195ef9599f1f79b783e21762046258583d3

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02-03-2024 20:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dcrat/data/dotNET_Reactor.Console.exe
Size

14KB
MD5

0b4dbf61a98f3e34cdd3a1b08a6a4609
SHA1

73587f1f5d040541b230513d22d696513dbd4cf9
SHA256

e817802f166662a7df0b144571354d74b10e34d120f91ae9d84ca3ba925241c6
SHA512

7cca370890e4e245c84507623531b5f54b76ced3e8c6b87cdfc47ed16560b6a0a5cf9e0556075cd0d9266908e445b854114edd69d50870839624589676c0e688
SSDEEP

192:8jY53csvsqHwrHEdSAejbMfDn1Gp78dsKGXOdlWW1ksTkwy:8jEnskskQlm1GRJKGXOdlWW1XTR

Score

10^/10

zgrat rat

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

Processes:

resource	yara_rule
behavioral32/memory/3032-3-0x00000000004F0000-0x0000000000AE8000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Loads dropped DLL 1 IoCs

Processes:

dotNET_Reactor.exe

pid process

3032 dotNET_Reactor.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

dotNET_Reactor.exe

pid	process
3032	dotNET_Reactor.exe
3032	dotNET_Reactor.exe
3032	dotNET_Reactor.exe
3032	dotNET_Reactor.exe
3032	dotNET_Reactor.exe
3032	dotNET_Reactor.exe
3032	dotNET_Reactor.exe
3032	dotNET_Reactor.exe
3032	dotNET_Reactor.exe
3032	dotNET_Reactor.exe
3032	dotNET_Reactor.exe
3032	dotNET_Reactor.exe
3032	dotNET_Reactor.exe
3032	dotNET_Reactor.exe
3032	dotNET_Reactor.exe
3032	dotNET_Reactor.exe
3032	dotNET_Reactor.exe
3032	dotNET_Reactor.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

dotNET_Reactor.exe

pid process

3032 dotNET_Reactor.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

dotNET_Reactor.Console.exe

description	pid	process	target process
PID 768 wrote to memory of 3032	768	dotNET_Reactor.Console.exe	dotNET_Reactor.exe
PID 768 wrote to memory of 3032	768	dotNET_Reactor.Console.exe	dotNET_Reactor.exe
PID 768 wrote to memory of 3032	768	dotNET_Reactor.Console.exe	dotNET_Reactor.exe

C:\Users\Admin\AppData\Local\Temp\dcrat\data\dotNET_Reactor.Console.exe
"C:\Users\Admin\AppData\Local\Temp\dcrat\data\dotNET_Reactor.Console.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:768
- C:\Users\Admin\AppData\Local\Temp\dcrat\data\dotNET_Reactor.exe
  "C:\Users\Admin\AppData\Local\Temp\dcrat\data\dotNET_Reactor.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\SkinSoft\dotNET_Reactor\x86\ssapihook.dll

Filesize
68KB

MD5
bc6887aa21e7794a2c27e3ffd3dc3ed0

SHA1
2b845941c93094d7203553582f69d0c61a9fcee4

SHA256
919130e16d33fd58d0370b06b7fb0fc253f5b571fc33ad5c21eb8dafe4760c94

SHA512
9e952ae72851ba081809ea5d7a86108b0355f0882bae912e0ecf931fde2e878994142b6c16094473305392981439e49d9a32aa6aaf94edd07238a0ecb787e834

Download Submit
memory/768-0-0x00000000007B0000-0x00000000007BA000-memory.dmp

Filesize
40KB

Download
memory/768-1-0x00007FFD92DE0000-0x00007FFD938A1000-memory.dmp

Filesize
10.8MB

Download
memory/768-38-0x00007FFD92DE0000-0x00007FFD938A1000-memory.dmp

Filesize
10.8MB

Download
memory/768-30-0x00007FFD92DE0000-0x00007FFD938A1000-memory.dmp

Filesize
10.8MB

Download
memory/3032-18-0x0000000000040000-0x0000000000041000-memory.dmp

Filesize
4KB

Download
memory/3032-20-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/3032-7-0x0000000005710000-0x000000000571A000-memory.dmp

Filesize
40KB

Download
memory/3032-8-0x0000000009260000-0x0000000009280000-memory.dmp

Filesize
128KB

Download
memory/3032-9-0x0000000005780000-0x0000000005790000-memory.dmp

Filesize
64KB

Download
memory/3032-10-0x00000000093F0000-0x0000000009418000-memory.dmp

Filesize
160KB

Download
memory/3032-16-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/3032-15-0x0000000000010000-0x0000000000011000-memory.dmp

Filesize
4KB

Download
memory/3032-17-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/3032-5-0x0000000005520000-0x00000000055B2000-memory.dmp

Filesize
584KB

Download
memory/3032-21-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/3032-22-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/3032-23-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/3032-6-0x0000000005780000-0x0000000005790000-memory.dmp

Filesize
64KB

Download
memory/3032-19-0x0000000000050000-0x0000000000051000-memory.dmp

Filesize
4KB

Download
memory/3032-4-0x0000000005A30000-0x0000000005FD4000-memory.dmp

Filesize
5.6MB

Download
memory/3032-24-0x000000000A050000-0x000000000A51C000-memory.dmp

Filesize
4.8MB

Download
memory/3032-27-0x0000000005780000-0x0000000005790000-memory.dmp

Filesize
64KB

Download
memory/3032-3-0x00000000004F0000-0x0000000000AE8000-memory.dmp

Filesize
6.0MB

Download
memory/3032-31-0x0000000075290000-0x0000000075A40000-memory.dmp

Filesize
7.7MB

Download
memory/3032-32-0x0000000005780000-0x0000000005790000-memory.dmp

Filesize
64KB

Download
memory/3032-33-0x0000000005780000-0x0000000005790000-memory.dmp

Filesize
64KB

Download
memory/3032-34-0x0000000005780000-0x0000000005790000-memory.dmp

Filesize
64KB

Download
memory/3032-36-0x0000000075290000-0x0000000075A40000-memory.dmp

Filesize
7.7MB

Download
memory/3032-2-0x0000000075290000-0x0000000075A40000-memory.dmp

Filesize
7.7MB

Download