zgrat | de08c69d06b2f176058aa6001b9f9195ef9599f1f79b783e21762046258583d3

Resubmissions

04-03-2024 05:33

240304-f84jnsca52 10

04-03-2024 04:18

240304-exd9zahe9z 10

Analysis

max time kernel
118s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-03-2024 04:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dcrat/data/dotNET_Reactor.Console.exe
Size

14KB
MD5

0b4dbf61a98f3e34cdd3a1b08a6a4609
SHA1

73587f1f5d040541b230513d22d696513dbd4cf9
SHA256

e817802f166662a7df0b144571354d74b10e34d120f91ae9d84ca3ba925241c6
SHA512

7cca370890e4e245c84507623531b5f54b76ced3e8c6b87cdfc47ed16560b6a0a5cf9e0556075cd0d9266908e445b854114edd69d50870839624589676c0e688
SSDEEP

192:8jY53csvsqHwrHEdSAejbMfDn1Gp78dsKGXOdlWW1ksTkwy:8jEnskskQlm1GRJKGXOdlWW1XTR

Score

10^/10

zgrat rat

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

Processes:

resource	yara_rule
behavioral31/memory/2300-3-0x0000000000390000-0x0000000000988000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Loads dropped DLL 1 IoCs

Processes:

dotNET_Reactor.exe

pid process

2300 dotNET_Reactor.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

dotNET_Reactor.exe

pid	process
2300	dotNET_Reactor.exe
2300	dotNET_Reactor.exe
2300	dotNET_Reactor.exe
2300	dotNET_Reactor.exe
2300	dotNET_Reactor.exe
2300	dotNET_Reactor.exe
2300	dotNET_Reactor.exe
2300	dotNET_Reactor.exe
2300	dotNET_Reactor.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

dotNET_Reactor.exe

pid process

2300 dotNET_Reactor.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

dotNET_Reactor.Console.exe

description	pid	process	target process
PID 1100 wrote to memory of 2300	1100	dotNET_Reactor.Console.exe	dotNET_Reactor.exe
PID 1100 wrote to memory of 2300	1100	dotNET_Reactor.Console.exe	dotNET_Reactor.exe
PID 1100 wrote to memory of 2300	1100	dotNET_Reactor.Console.exe	dotNET_Reactor.exe
PID 1100 wrote to memory of 2300	1100	dotNET_Reactor.Console.exe	dotNET_Reactor.exe

C:\Users\Admin\AppData\Local\Temp\dcrat\data\dotNET_Reactor.Console.exe
"C:\Users\Admin\AppData\Local\Temp\dcrat\data\dotNET_Reactor.Console.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1100

C:\Users\Admin\AppData\Local\Temp\dcrat\data\dotNET_Reactor.exe
"C:\Users\Admin\AppData\Local\Temp\dcrat\data\dotNET_Reactor.exe"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2300

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\SkinSoft\dotNET_Reactor\x86\ssapihook.dll
Filesize
68KB

MD5
bc6887aa21e7794a2c27e3ffd3dc3ed0

SHA1
2b845941c93094d7203553582f69d0c61a9fcee4

SHA256
919130e16d33fd58d0370b06b7fb0fc253f5b571fc33ad5c21eb8dafe4760c94

SHA512
9e952ae72851ba081809ea5d7a86108b0355f0882bae912e0ecf931fde2e878994142b6c16094473305392981439e49d9a32aa6aaf94edd07238a0ecb787e834

Download Submit
memory/1100-1-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

Filesize
9.9MB

Download
memory/1100-24-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

Filesize
9.9MB

Download
memory/1100-0-0x0000000000E30000-0x0000000000E3A000-memory.dmp

Filesize
40KB

Download
memory/2300-12-0x0000000005480000-0x0000000005481000-memory.dmp

Filesize
4KB

Download
memory/2300-15-0x00000000054C0000-0x00000000054C1000-memory.dmp

Filesize
4KB

Download
memory/2300-6-0x00000000052C0000-0x00000000052E8000-memory.dmp

Filesize
160KB

Download
memory/2300-4-0x00000000052F0000-0x0000000005330000-memory.dmp

Filesize
256KB

Download
memory/2300-10-0x0000000002620000-0x0000000002621000-memory.dmp

Filesize
4KB

Download
memory/2300-11-0x0000000005470000-0x0000000005471000-memory.dmp

Filesize
4KB

Download
memory/2300-2-0x0000000074700000-0x0000000074DEE000-memory.dmp

Filesize
6.9MB

Download
memory/2300-13-0x00000000054A0000-0x00000000054A1000-memory.dmp

Filesize
4KB

Download
memory/2300-14-0x00000000054B0000-0x00000000054B1000-memory.dmp

Filesize
4KB

Download
memory/2300-5-0x00000000052F0000-0x0000000005330000-memory.dmp

Filesize
256KB

Download
memory/2300-16-0x00000000054D0000-0x00000000054D1000-memory.dmp

Filesize
4KB

Download
memory/2300-17-0x00000000054E0000-0x00000000054E1000-memory.dmp

Filesize
4KB

Download
memory/2300-18-0x00000000054F0000-0x00000000054F1000-memory.dmp

Filesize
4KB

Download
memory/2300-21-0x00000000052F0000-0x0000000005330000-memory.dmp

Filesize
256KB

Download
memory/2300-3-0x0000000000390000-0x0000000000988000-memory.dmp

Filesize
6.0MB

Download
memory/2300-25-0x0000000074700000-0x0000000074DEE000-memory.dmp

Filesize
6.9MB

Download
memory/2300-26-0x00000000052F0000-0x0000000005330000-memory.dmp

Filesize
256KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads