zgrat | 859f296afcad7531a5e2ee4b5b8346da0d5ac0ba33700804216aa7365920f7cb

General

Target

859f296afcad7531a5e2ee4b5b8346da0d5ac0ba33700804216aa7365920f7cb.exe
Size

4.5MB
MD5

c66b1f6942762649c44bca726995a227
SHA1

d22eba1dd78f3ab676afd3442a4b2a24c9342bf8
SHA256

859f296afcad7531a5e2ee4b5b8346da0d5ac0ba33700804216aa7365920f7cb
SHA512

1785bc2becad09b83aa98fe5d1191328f7f8336615144c07974ff4aeb61ec4a72940ba5d10cc9b91185a9f644b093ae74abef22531c0dc191839613369a23144
SSDEEP

98304:AaHg3Vqv+AigbRik7kZ3srMw2FX+qK60L:AaH0VqhiKj7kZ3U+FuqA

Score

10^/10

zgrat rat

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral2/memory/3264-0-0x0000000000920000-0x0000000000D9C000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/memory/3264-0-0x0000000000920000-0x0000000000D9C000-memory.dmp	net_reactor

Loads dropped DLL 1 IoCs

pid	Process
3264	859f296afcad7531a5e2ee4b5b8346da0d5ac0ba33700804216aa7365920f7cb.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5004	3264	WerFault.exe	71

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 5100	3264	859f296afcad7531a5e2ee4b5b8346da0d5ac0ba33700804216aa7365920f7cb.exe	72
PID 3264 wrote to memory of 5100	3264	859f296afcad7531a5e2ee4b5b8346da0d5ac0ba33700804216aa7365920f7cb.exe	72
PID 3264 wrote to memory of 5100	3264	859f296afcad7531a5e2ee4b5b8346da0d5ac0ba33700804216aa7365920f7cb.exe	72
PID 3264 wrote to memory of 5108	3264	859f296afcad7531a5e2ee4b5b8346da0d5ac0ba33700804216aa7365920f7cb.exe	73
PID 3264 wrote to memory of 5108	3264	859f296afcad7531a5e2ee4b5b8346da0d5ac0ba33700804216aa7365920f7cb.exe	73
PID 3264 wrote to memory of 5108	3264	859f296afcad7531a5e2ee4b5b8346da0d5ac0ba33700804216aa7365920f7cb.exe	73
PID 3264 wrote to memory of 5108	3264	859f296afcad7531a5e2ee4b5b8346da0d5ac0ba33700804216aa7365920f7cb.exe	73
PID 3264 wrote to memory of 5108	3264	859f296afcad7531a5e2ee4b5b8346da0d5ac0ba33700804216aa7365920f7cb.exe	73
PID 3264 wrote to memory of 5108	3264	859f296afcad7531a5e2ee4b5b8346da0d5ac0ba33700804216aa7365920f7cb.exe	73
PID 3264 wrote to memory of 5108	3264	859f296afcad7531a5e2ee4b5b8346da0d5ac0ba33700804216aa7365920f7cb.exe	73
PID 3264 wrote to memory of 5108	3264	859f296afcad7531a5e2ee4b5b8346da0d5ac0ba33700804216aa7365920f7cb.exe	73
PID 3264 wrote to memory of 5108	3264	859f296afcad7531a5e2ee4b5b8346da0d5ac0ba33700804216aa7365920f7cb.exe	73
PID 3264 wrote to memory of 5108	3264	859f296afcad7531a5e2ee4b5b8346da0d5ac0ba33700804216aa7365920f7cb.exe	73

C:\Users\Admin\AppData\Local\Temp\859f296afcad7531a5e2ee4b5b8346da0d5ac0ba33700804216aa7365920f7cb.exe
"C:\Users\Admin\AppData\Local\Temp\859f296afcad7531a5e2ee4b5b8346da0d5ac0ba33700804216aa7365920f7cb.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  2⤵
  PID:5100
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  2⤵
  PID:5108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3264 -s 976
  2⤵
  - Program crash
  PID:5004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\Protect544cd51a.dll

Filesize
742KB

MD5
544cd51a596619b78e9b54b70088307d

SHA1
4769ddd2dbc1dc44b758964ed0bd231b85880b65

SHA256
dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd

SHA512
f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719

Download Submit
memory/3264-13-0x0000000005920000-0x0000000005930000-memory.dmp

Filesize
64KB

Download
memory/3264-15-0x0000000005160000-0x0000000005170000-memory.dmp

Filesize
64KB

Download
memory/3264-3-0x0000000073920000-0x000000007400E000-memory.dmp

Filesize
6.9MB

Download
memory/3264-4-0x0000000005920000-0x0000000005930000-memory.dmp

Filesize
64KB

Download
memory/3264-5-0x0000000005A30000-0x0000000005C28000-memory.dmp

Filesize
2.0MB

Download
memory/3264-6-0x0000000006D60000-0x0000000006EF2000-memory.dmp

Filesize
1.6MB

Download
memory/3264-1-0x0000000073920000-0x000000007400E000-memory.dmp

Filesize
6.9MB

Download
memory/3264-11-0x0000000005920000-0x0000000005930000-memory.dmp

Filesize
64KB

Download
memory/3264-12-0x0000000005920000-0x0000000005930000-memory.dmp

Filesize
64KB

Download
memory/3264-16-0x0000000005920000-0x0000000005930000-memory.dmp

Filesize
64KB

Download
memory/3264-2-0x0000000005650000-0x00000000056EC000-memory.dmp

Filesize
624KB

Download
memory/3264-14-0x0000000005920000-0x0000000005930000-memory.dmp

Filesize
64KB

Download
memory/3264-0-0x0000000000920000-0x0000000000D9C000-memory.dmp

Filesize
4.5MB

Download
memory/3264-17-0x00000000071F0000-0x00000000072F0000-memory.dmp

Filesize
1024KB

Download
memory/3264-18-0x00000000071F0000-0x00000000072F0000-memory.dmp

Filesize
1024KB

Download
memory/3264-19-0x00000000071F0000-0x00000000072F0000-memory.dmp

Filesize
1024KB

Download
memory/3264-20-0x0000000005920000-0x0000000005930000-memory.dmp

Filesize
64KB

Download
memory/3264-21-0x0000000005920000-0x0000000005930000-memory.dmp

Filesize
64KB

Download
memory/3264-22-0x0000000005920000-0x0000000005930000-memory.dmp

Filesize
64KB

Download
memory/3264-23-0x0000000005920000-0x0000000005930000-memory.dmp

Filesize
64KB

Download
memory/3264-24-0x00000000071F0000-0x00000000072F0000-memory.dmp

Filesize
1024KB

Download
memory/3264-25-0x00000000071F0000-0x00000000072F0000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing