zgrat | 1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511

General

Target

1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511.exe
Size

694KB
MD5

9bae6d3afb22e8f8c8aba60f652d55ec
SHA1

9d909c53191dad75c84c75067594bd470cf34dac
SHA256

1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511
SHA512

c664c37247e6a5209581a6be63ced107d98937ba119ca6a2dec2bda9cfb48dea751083f0c4e86026fc9d05c2b5cb76a68375c90095d0491152b695678bccc992
SSDEEP

12288:tsQ4ZUXCJVkKs1Xx83mSsFhtFrnQbWWODTDBAYL/u5cvprvhrmYTl39521aV:todVknRxQBsFrFrnjtDT1AYL/Gkprvh3

Score

10^/10

zgrat rat

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral1/memory/1640-0-0x0000000001250000-0x000000000139A000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Detects executables packed with unregistered version of .NET Reactor 1 IoCs

resource	yara_rule
behavioral1/memory/1640-0-0x0000000001250000-0x000000000139A000-memory.dmp	INDICATOR_EXE_Packed_DotNetReactor

.NET Reactor proctector 2 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/memory/1640-0-0x0000000001250000-0x000000000139A000-memory.dmp	net_reactor
behavioral1/memory/1640-10-0x0000000000E30000-0x0000000000E70000-memory.dmp	net_reactor

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2584	1640	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
1640	1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511.exe
1640	1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511.exe
1640	1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511.exe
1640	1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511.exe
1640	1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511.exe
1640	1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511.exe
1640	1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511.exe
1640	1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511.exe
1640	1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511.exe
1640	1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511.exe
1640	1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511.exe
1640	1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511.exe
1640	1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511.exe
1640	1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511.exe
1640	1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511.exe
1640	1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511.exe
1640	1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511.exe
1640	1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511.exe
1640	1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511.exe
1640	1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511.exe
1640	1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511.exe
1640	1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511.exe
1640	1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511.exe
1640	1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511.exe
1640	1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511.exe
1640	1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511.exe
1640	1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511.exe
1640	1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511.exe
1640	1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1640	1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 2584	1640	1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511.exe	29
PID 1640 wrote to memory of 2584	1640	1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511.exe	29
PID 1640 wrote to memory of 2584	1640	1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511.exe	29
PID 1640 wrote to memory of 2584	1640	1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511.exe	29

C:\Users\Admin\AppData\Local\Temp\1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511.exe
"C:\Users\Admin\AppData\Local\Temp\1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 840
  2⤵
  - Program crash
  PID:2584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1640-0-0x0000000001250000-0x000000000139A000-memory.dmp

Filesize
1.3MB

Download
memory/1640-1-0x00000000749D0000-0x00000000750BE000-memory.dmp

Filesize
6.9MB

Download
memory/1640-2-0x0000000000E30000-0x0000000000E70000-memory.dmp

Filesize
256KB

Download
memory/1640-3-0x0000000000E30000-0x0000000000E70000-memory.dmp

Filesize
256KB

Download
memory/1640-4-0x0000000000E30000-0x0000000000E70000-memory.dmp

Filesize
256KB

Download
memory/1640-5-0x00000000779CF000-0x00000000779D0000-memory.dmp

Filesize
4KB

Download
memory/1640-6-0x00000000749D0000-0x00000000750BE000-memory.dmp

Filesize
6.9MB

Download
memory/1640-7-0x0000000000E30000-0x0000000000E70000-memory.dmp

Filesize
256KB

Download
memory/1640-8-0x0000000000E30000-0x0000000000E70000-memory.dmp

Filesize
256KB

Download
memory/1640-9-0x0000000000E30000-0x0000000000E70000-memory.dmp

Filesize
256KB

Download
memory/1640-10-0x0000000000E30000-0x0000000000E70000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing