zgrat | 18f17375402cffe877271fdeedb0e78ebf492ba954da3bfcbc742fd5fd567492

Analysis

max time kernel
142s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
19-03-2024 18:50

Target

18f17375402cffe877271fdeedb0e78ebf492ba954da3bfcbc742fd5fd567492.exe
Size

468KB
MD5

40dd510795e82f9a51301896809c2d95
SHA1

5bc4f3a04dae16cd6c69dd442551a795c9caa9ef
SHA256

18f17375402cffe877271fdeedb0e78ebf492ba954da3bfcbc742fd5fd567492
SHA512

c2fa10356790136e1bacbf0bc26eb015d6ceae49d2fb953fc80cb3085375d050000b2672cf15bc97fd633a31e6012e0fe47e282f31a614192840f85624b693c8
SSDEEP

6144:sR0tQjTAMFGf1nAB9/huXDttKkDklFuktsferJ/f7UF3HfuXeZWquoQ:sRK1y5IDnKkDxkme5f6HfuurHQ

Score

10^/10

zgrat rat

Detect ZGRat V1 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3040-1-0x0000000000960000-0x00000000009D6000-memory.dmp	family_zgrat_v1

Suspicious use of SetThreadContext 1 IoCs

Processes:

18f17375402cffe877271fdeedb0e78ebf492ba954da3bfcbc742fd5fd567492.exe

description	pid	process	target process
PID 3040 set thread context of 1284	3040	18f17375402cffe877271fdeedb0e78ebf492ba954da3bfcbc742fd5fd567492.exe	RegAsm.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

18f17375402cffe877271fdeedb0e78ebf492ba954da3bfcbc742fd5fd567492.exe

description	pid	process	target process
PID 3040 wrote to memory of 1284	3040	18f17375402cffe877271fdeedb0e78ebf492ba954da3bfcbc742fd5fd567492.exe	RegAsm.exe
PID 3040 wrote to memory of 1284	3040	18f17375402cffe877271fdeedb0e78ebf492ba954da3bfcbc742fd5fd567492.exe	RegAsm.exe
PID 3040 wrote to memory of 1284	3040	18f17375402cffe877271fdeedb0e78ebf492ba954da3bfcbc742fd5fd567492.exe	RegAsm.exe
PID 3040 wrote to memory of 1284	3040	18f17375402cffe877271fdeedb0e78ebf492ba954da3bfcbc742fd5fd567492.exe	RegAsm.exe
PID 3040 wrote to memory of 1284	3040	18f17375402cffe877271fdeedb0e78ebf492ba954da3bfcbc742fd5fd567492.exe	RegAsm.exe
PID 3040 wrote to memory of 1284	3040	18f17375402cffe877271fdeedb0e78ebf492ba954da3bfcbc742fd5fd567492.exe	RegAsm.exe
PID 3040 wrote to memory of 1284	3040	18f17375402cffe877271fdeedb0e78ebf492ba954da3bfcbc742fd5fd567492.exe	RegAsm.exe
PID 3040 wrote to memory of 1284	3040	18f17375402cffe877271fdeedb0e78ebf492ba954da3bfcbc742fd5fd567492.exe	RegAsm.exe
PID 3040 wrote to memory of 1284	3040	18f17375402cffe877271fdeedb0e78ebf492ba954da3bfcbc742fd5fd567492.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:1284

memory/1284-5-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1284-8-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1284-12-0x00000000010D0000-0x00000000010D1000-memory.dmp

Filesize
4KB

Download
memory/1284-13-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/3040-0-0x0000000074810000-0x0000000074FC1000-memory.dmp

Filesize
7.7MB

Download
memory/3040-1-0x0000000000960000-0x00000000009D6000-memory.dmp

Filesize
472KB

Download
memory/3040-2-0x0000000005510000-0x0000000005520000-memory.dmp

Filesize
64KB

Download
memory/3040-10-0x0000000074810000-0x0000000074FC1000-memory.dmp

Filesize
7.7MB

Download
memory/3040-11-0x0000000002E60000-0x0000000004E60000-memory.dmp

Filesize
32.0MB

Download
memory/3040-14-0x0000000002E60000-0x0000000004E60000-memory.dmp

Filesize
32.0MB

Download