zgrat | de08c69d06b2f176058aa6001b9f9195ef9599f1f79b783e21762046258583d3

Resubmissions

04-03-2024 05:33

240304-f84jnsca52 10

04-03-2024 04:18

240304-exd9zahe9z 10

Analysis

max time kernel
441s
max time network
447s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-03-2024 05:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dcrat/data/dotNET_Reactor.Console.exe
Size

14KB
MD5

0b4dbf61a98f3e34cdd3a1b08a6a4609
SHA1

73587f1f5d040541b230513d22d696513dbd4cf9
SHA256

e817802f166662a7df0b144571354d74b10e34d120f91ae9d84ca3ba925241c6
SHA512

7cca370890e4e245c84507623531b5f54b76ced3e8c6b87cdfc47ed16560b6a0a5cf9e0556075cd0d9266908e445b854114edd69d50870839624589676c0e688
SSDEEP

192:8jY53csvsqHwrHEdSAejbMfDn1Gp78dsKGXOdlWW1ksTkwy:8jEnskskQlm1GRJKGXOdlWW1XTR

Score

10^/10

zgrat rat

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

Processes:

resource	yara_rule
behavioral32/memory/3736-3-0x0000000000010000-0x0000000000608000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Loads dropped DLL 1 IoCs

Processes:

dotNET_Reactor.exe

pid process

3736 dotNET_Reactor.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

dotNET_Reactor.exe

pid	process
3736	dotNET_Reactor.exe
3736	dotNET_Reactor.exe
3736	dotNET_Reactor.exe
3736	dotNET_Reactor.exe
3736	dotNET_Reactor.exe
3736	dotNET_Reactor.exe
3736	dotNET_Reactor.exe
3736	dotNET_Reactor.exe
3736	dotNET_Reactor.exe
3736	dotNET_Reactor.exe
3736	dotNET_Reactor.exe
3736	dotNET_Reactor.exe
3736	dotNET_Reactor.exe
3736	dotNET_Reactor.exe
3736	dotNET_Reactor.exe
3736	dotNET_Reactor.exe
3736	dotNET_Reactor.exe
3736	dotNET_Reactor.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

dotNET_Reactor.exe

pid process

3736 dotNET_Reactor.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

dotNET_Reactor.Console.exe

description	pid	process	target process
PID 1316 wrote to memory of 3736	1316	dotNET_Reactor.Console.exe	dotNET_Reactor.exe
PID 1316 wrote to memory of 3736	1316	dotNET_Reactor.Console.exe	dotNET_Reactor.exe
PID 1316 wrote to memory of 3736	1316	dotNET_Reactor.Console.exe	dotNET_Reactor.exe

C:\Users\Admin\AppData\Local\Temp\dcrat\data\dotNET_Reactor.Console.exe
"C:\Users\Admin\AppData\Local\Temp\dcrat\data\dotNET_Reactor.Console.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1316

C:\Users\Admin\AppData\Local\Temp\dcrat\data\dotNET_Reactor.exe
"C:\Users\Admin\AppData\Local\Temp\dcrat\data\dotNET_Reactor.exe"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\SkinSoft\dotNET_Reactor\x86\ssapihook.dll
Filesize
68KB

MD5
bc6887aa21e7794a2c27e3ffd3dc3ed0

SHA1
2b845941c93094d7203553582f69d0c61a9fcee4

SHA256
919130e16d33fd58d0370b06b7fb0fc253f5b571fc33ad5c21eb8dafe4760c94

SHA512
9e952ae72851ba081809ea5d7a86108b0355f0882bae912e0ecf931fde2e878994142b6c16094473305392981439e49d9a32aa6aaf94edd07238a0ecb787e834

Download Submit
memory/1316-1-0x00007FFEFA520000-0x00007FFEFAFE1000-memory.dmp

Filesize
10.8MB

Download
memory/1316-30-0x00007FFEFA520000-0x00007FFEFAFE1000-memory.dmp

Filesize
10.8MB

Download
memory/1316-0-0x0000000000670000-0x000000000067A000-memory.dmp

Filesize
40KB

Download
memory/3736-17-0x00000000090D0000-0x00000000090D1000-memory.dmp

Filesize
4KB

Download
memory/3736-18-0x00000000090E0000-0x00000000090E1000-memory.dmp

Filesize
4KB

Download
memory/3736-6-0x00000000052C0000-0x00000000052D0000-memory.dmp

Filesize
64KB

Download
memory/3736-7-0x0000000005230000-0x000000000523A000-memory.dmp

Filesize
40KB

Download
memory/3736-8-0x0000000008D80000-0x0000000008DA0000-memory.dmp

Filesize
128KB

Download
memory/3736-9-0x00000000052C0000-0x00000000052D0000-memory.dmp

Filesize
64KB

Download
memory/3736-10-0x0000000008F10000-0x0000000008F38000-memory.dmp

Filesize
160KB

Download
memory/3736-4-0x00000000056B0000-0x0000000005C54000-memory.dmp

Filesize
5.6MB

Download
memory/3736-15-0x0000000008FB0000-0x0000000008FB1000-memory.dmp

Filesize
4KB

Download
memory/3736-16-0x00000000090C0000-0x00000000090C1000-memory.dmp

Filesize
4KB

Download
memory/3736-2-0x0000000074DA0000-0x0000000075550000-memory.dmp

Filesize
7.7MB

Download
memory/3736-5-0x0000000005010000-0x00000000050A2000-memory.dmp

Filesize
584KB

Download
memory/3736-19-0x00000000090F0000-0x00000000090F1000-memory.dmp

Filesize
4KB

Download
memory/3736-20-0x0000000009100000-0x0000000009101000-memory.dmp

Filesize
4KB

Download
memory/3736-21-0x0000000009110000-0x0000000009111000-memory.dmp

Filesize
4KB

Download
memory/3736-22-0x0000000009120000-0x0000000009121000-memory.dmp

Filesize
4KB

Download
memory/3736-23-0x0000000009130000-0x0000000009131000-memory.dmp

Filesize
4KB

Download
memory/3736-24-0x0000000009C00000-0x000000000A0CC000-memory.dmp

Filesize
4.8MB

Download
memory/3736-27-0x00000000052C0000-0x00000000052D0000-memory.dmp

Filesize
64KB

Download
memory/3736-3-0x0000000000010000-0x0000000000608000-memory.dmp

Filesize
6.0MB

Download
memory/3736-31-0x0000000074DA0000-0x0000000075550000-memory.dmp

Filesize
7.7MB

Download
memory/3736-32-0x00000000052C0000-0x00000000052D0000-memory.dmp

Filesize
64KB

Download
memory/3736-33-0x00000000052C0000-0x00000000052D0000-memory.dmp

Filesize
64KB

Download
memory/3736-34-0x00000000052C0000-0x00000000052D0000-memory.dmp

Filesize
64KB

Download