zgrat | 6a103e31e7c1990a5f21e6ad483805b01fdbabe9fd9454f42aab0eda9b5d67cf

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 16:20

Target

file.exe
Size

530KB
MD5

756931963ef47d8261e3090770710355
SHA1

074e49a53dc0dea819a2ce9b487982f0ac114d86
SHA256

6a103e31e7c1990a5f21e6ad483805b01fdbabe9fd9454f42aab0eda9b5d67cf
SHA512

231458212051567f7549a7d24d0d956219e33480fbba3428b2259d571265802aa9b8727998f6c5bf62e30c1ec673619506b5cb9d1220c738af0685be2ec397ce
SSDEEP

12288:6L8s73bmtO4RH1ROUguWO3t0u6ZwevUDRHuGN19v/BQa/muUiq9uxzrwy/ZW+Ln7:6gqDdPofMR/TWOSKY0Emo

Score

10^/10

zgrat rat

Detect ZGRat V1 2 IoCs

resource	yara_rule
behavioral1/memory/2980-0-0x0000000000FF0000-0x0000000001076000-memory.dmp	family_zgrat_v1
behavioral1/memory/2980-2-0x0000000004DC0000-0x0000000004E00000-memory.dmp	family_zgrat_v1

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2980 set thread context of 2744	2980	file.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2672	2744	WerFault.exe	29

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2744	2980	file.exe	29
PID 2980 wrote to memory of 2744	2980	file.exe	29
PID 2980 wrote to memory of 2744	2980	file.exe	29
PID 2980 wrote to memory of 2744	2980	file.exe	29
PID 2980 wrote to memory of 2744	2980	file.exe	29
PID 2980 wrote to memory of 2744	2980	file.exe	29
PID 2980 wrote to memory of 2744	2980	file.exe	29
PID 2980 wrote to memory of 2744	2980	file.exe	29
PID 2980 wrote to memory of 2744	2980	file.exe	29
PID 2980 wrote to memory of 2744	2980	file.exe	29
PID 2980 wrote to memory of 2744	2980	file.exe	29
PID 2980 wrote to memory of 2744	2980	file.exe	29
PID 2980 wrote to memory of 2744	2980	file.exe	29
PID 2744 wrote to memory of 2672	2744	RegAsm.exe	30
PID 2744 wrote to memory of 2672	2744	RegAsm.exe	30
PID 2744 wrote to memory of 2672	2744	RegAsm.exe	30
PID 2744 wrote to memory of 2672	2744	RegAsm.exe	30

memory/2744-7-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2744-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2744-11-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2744-9-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2744-8-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2744-15-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2744-5-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2744-18-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2980-1-0x0000000074160000-0x000000007484E000-memory.dmp

Filesize
6.9MB

Download
memory/2980-2-0x0000000004DC0000-0x0000000004E00000-memory.dmp

Filesize
256KB

Download
memory/2980-6-0x0000000002480000-0x0000000004480000-memory.dmp

Filesize
32.0MB

Download
memory/2980-0-0x0000000000FF0000-0x0000000001076000-memory.dmp

Filesize
536KB

Download
memory/2980-19-0x0000000074160000-0x000000007484E000-memory.dmp

Filesize
6.9MB

Download