zgrat | 833821dfd2eef37f7624dd227e49484c20bad5d474b251e1d9fd04ef0476544c

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 19:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
doingCTIrocks_crypted_LAB.exe
Size 425KB
Sample240307-yh3tkacc72
SHA256 833821dfd2eef37f7624dd227e49484c20bad5d474b251e1d9fd04ef0476544c
MD5 40f173d5b3066b6e39c7ce4632256679
SHA1 d9f7f4913dd007225a3ada4b5dc06ac267f8f106
SHA512 76d260e4435035395dc8fd539112b0a3fe127b54fdea49ad8e70577769afc0714845e5fc119f64dca5ee076c501159d09ba03054a7d7361d4538eda93cd10e94
SSDEEP 12288:kEUPXHzUxr5lHwINjPiisbKpqp0YN24cE5XBrspSMGdvO9/LrnVQ/8VzKvy6wx/H:5lkFhSYW3LGLFHcE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

zgrat rat

Malware Config

Signatures

Detect ZGRat V1 2 IoCs

resource	yara_rule
behavioral1/memory/1032-0-0x0000000001360000-0x00000000013D0000-memory.dmp	family_zgrat_v1
behavioral1/memory/1032-2-0x0000000000B40000-0x0000000000B80000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1032 set thread context of 1028	1032	doingCTIrocks_crypted_LAB.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2524	1028	WerFault.exe	29

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 1028	1032	doingCTIrocks_crypted_LAB.exe	29
PID 1032 wrote to memory of 1028	1032	doingCTIrocks_crypted_LAB.exe	29
PID 1032 wrote to memory of 1028	1032	doingCTIrocks_crypted_LAB.exe	29
PID 1032 wrote to memory of 1028	1032	doingCTIrocks_crypted_LAB.exe	29
PID 1032 wrote to memory of 1028	1032	doingCTIrocks_crypted_LAB.exe	29
PID 1032 wrote to memory of 1028	1032	doingCTIrocks_crypted_LAB.exe	29
PID 1032 wrote to memory of 1028	1032	doingCTIrocks_crypted_LAB.exe	29
PID 1032 wrote to memory of 1028	1032	doingCTIrocks_crypted_LAB.exe	29
PID 1032 wrote to memory of 1028	1032	doingCTIrocks_crypted_LAB.exe	29
PID 1032 wrote to memory of 1028	1032	doingCTIrocks_crypted_LAB.exe	29
PID 1032 wrote to memory of 1028	1032	doingCTIrocks_crypted_LAB.exe	29
PID 1032 wrote to memory of 1028	1032	doingCTIrocks_crypted_LAB.exe	29
PID 1032 wrote to memory of 1028	1032	doingCTIrocks_crypted_LAB.exe	29
PID 1028 wrote to memory of 2524	1028	RegAsm.exe	30
PID 1028 wrote to memory of 2524	1028	RegAsm.exe	30
PID 1028 wrote to memory of 2524	1028	RegAsm.exe	30
PID 1028 wrote to memory of 2524	1028	RegAsm.exe	30

C:\Users\Admin\AppData\Local\Temp\doingCTIrocks_crypted_LAB.exe
"C:\Users\Admin\AppData\Local\Temp\doingCTIrocks_crypted_LAB.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 252
    3⤵
    - Program crash
    PID:2524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1028-7-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/1028-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/1028-10-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/1028-9-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/1028-14-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/1028-8-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/1028-5-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/1028-17-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/1032-1-0x0000000074B40000-0x000000007522E000-memory.dmp

Download

memory/1032-2-0x0000000000B40000-0x0000000000B80000-memory.dmp

Download

memory/1032-6-0x00000000027D0000-0x00000000047D0000-memory.dmp

Download

memory/1032-0-0x0000000001360000-0x00000000013D0000-memory.dmp

Download

memory/1032-18-0x0000000074B40000-0x000000007522E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads