zgrat | 96cfe1f8439e918428f1c8a3f05b4b1d7c6273a6588eef884647b9657e421d3a

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 05:08

Target

96cfe1f8439e918428f1c8a3f05b4b1d7c6273a6588eef884647b9657e421d3a.exe
Size

6.1MB
MD5

feb071c8537cd643bc31d36b4728396b
SHA1

c3df5098a0bdef492b5767f2df5bba375782a029
SHA256

96cfe1f8439e918428f1c8a3f05b4b1d7c6273a6588eef884647b9657e421d3a
SHA512

953f7f913e0d4dbbff3c87de912950e6aafb4fbea710298dc38d4fc9b30c171e0d07f7a043e17d5480c87f77cae69fc140df47c4cb5921f2e5683e31b3811b4c
SSDEEP

98304:8FB+nSX4sEpIwmfGvMeTwus8SwW3XWZuJrtW:c22uIXS0vX7W

Score

10^/10

zgrat rat

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral1/memory/1068-1-0x0000000000DC0000-0x00000000013C6000-memory.dmp	family_zgrat_v1

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2496	1068	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 2496	1068	96cfe1f8439e918428f1c8a3f05b4b1d7c6273a6588eef884647b9657e421d3a.exe	28
PID 1068 wrote to memory of 2496	1068	96cfe1f8439e918428f1c8a3f05b4b1d7c6273a6588eef884647b9657e421d3a.exe	28
PID 1068 wrote to memory of 2496	1068	96cfe1f8439e918428f1c8a3f05b4b1d7c6273a6588eef884647b9657e421d3a.exe	28
PID 1068 wrote to memory of 2496	1068	96cfe1f8439e918428f1c8a3f05b4b1d7c6273a6588eef884647b9657e421d3a.exe	28

C:\Users\Admin\AppData\Local\Temp\96cfe1f8439e918428f1c8a3f05b4b1d7c6273a6588eef884647b9657e421d3a.exe
"C:\Users\Admin\AppData\Local\Temp\96cfe1f8439e918428f1c8a3f05b4b1d7c6273a6588eef884647b9657e421d3a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1068 -s 584
  2⤵
  - Program crash
  PID:2496

memory/1068-0-0x0000000073F30000-0x000000007461E000-memory.dmp

Filesize
6.9MB

Download
memory/1068-1-0x0000000000DC0000-0x00000000013C6000-memory.dmp

Filesize
6.0MB

Download
memory/1068-2-0x00000000050F0000-0x0000000005130000-memory.dmp

Filesize
256KB

Download
memory/1068-3-0x0000000006540000-0x00000000067EC000-memory.dmp

Filesize
2.7MB

Download
memory/1068-4-0x0000000073F30000-0x000000007461E000-memory.dmp

Filesize
6.9MB

Download
memory/1068-5-0x00000000050F0000-0x0000000005130000-memory.dmp

Filesize
256KB

Download