zgrat | 01eb96e819b14b458496cde4a8ff5d7da7ea0e57482ff9da5a3882675de92060

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 21:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe
Size

180KB
MD5

14e3b32935d7cc340ad1af8eae56505b
SHA1

215cf39538affa65c8f586f30e5f133cbd950c52
SHA256

1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d
SHA512

0abb031df981e90646a860db99c4895241dd2b18b9963c040c50f2f16e32ed4ed6df8d3bbf9d88de648bc621db869fabe9dbea374c882c57a8ce9391d217404a
SSDEEP

3072:2h8lttZlbxs7vPfZSfvF1LicLRXP4p9fNvU9iPT3FxFzn+9Uc:2I7Vxs7vPfInDWc1PI91U9ir3FxFz+

Score

10^/10

zgrat rat

Malware Config

Signatures

Detect ZGRat V1 34 IoCs

resource	yara_rule
behavioral1/memory/804-3-0x000000001E480000-0x000000001E740000-memory.dmp	family_zgrat_v1
behavioral1/memory/804-4-0x000000001E480000-0x000000001E73A000-memory.dmp	family_zgrat_v1
behavioral1/memory/804-5-0x000000001E480000-0x000000001E73A000-memory.dmp	family_zgrat_v1
behavioral1/memory/804-7-0x000000001E480000-0x000000001E73A000-memory.dmp	family_zgrat_v1
behavioral1/memory/804-9-0x000000001E480000-0x000000001E73A000-memory.dmp	family_zgrat_v1
behavioral1/memory/804-11-0x000000001E480000-0x000000001E73A000-memory.dmp	family_zgrat_v1
behavioral1/memory/804-13-0x000000001E480000-0x000000001E73A000-memory.dmp	family_zgrat_v1
behavioral1/memory/804-15-0x000000001E480000-0x000000001E73A000-memory.dmp	family_zgrat_v1
behavioral1/memory/804-17-0x000000001E480000-0x000000001E73A000-memory.dmp	family_zgrat_v1
behavioral1/memory/804-19-0x000000001E480000-0x000000001E73A000-memory.dmp	family_zgrat_v1
behavioral1/memory/804-21-0x000000001E480000-0x000000001E73A000-memory.dmp	family_zgrat_v1
behavioral1/memory/804-23-0x000000001E480000-0x000000001E73A000-memory.dmp	family_zgrat_v1
behavioral1/memory/804-25-0x000000001E480000-0x000000001E73A000-memory.dmp	family_zgrat_v1
behavioral1/memory/804-27-0x000000001E480000-0x000000001E73A000-memory.dmp	family_zgrat_v1
behavioral1/memory/804-29-0x000000001E480000-0x000000001E73A000-memory.dmp	family_zgrat_v1
behavioral1/memory/804-31-0x000000001E480000-0x000000001E73A000-memory.dmp	family_zgrat_v1
behavioral1/memory/804-33-0x000000001E480000-0x000000001E73A000-memory.dmp	family_zgrat_v1
behavioral1/memory/804-35-0x000000001E480000-0x000000001E73A000-memory.dmp	family_zgrat_v1
behavioral1/memory/804-37-0x000000001E480000-0x000000001E73A000-memory.dmp	family_zgrat_v1
behavioral1/memory/804-39-0x000000001E480000-0x000000001E73A000-memory.dmp	family_zgrat_v1
behavioral1/memory/804-41-0x000000001E480000-0x000000001E73A000-memory.dmp	family_zgrat_v1
behavioral1/memory/804-43-0x000000001E480000-0x000000001E73A000-memory.dmp	family_zgrat_v1
behavioral1/memory/804-45-0x000000001E480000-0x000000001E73A000-memory.dmp	family_zgrat_v1
behavioral1/memory/804-47-0x000000001E480000-0x000000001E73A000-memory.dmp	family_zgrat_v1
behavioral1/memory/804-49-0x000000001E480000-0x000000001E73A000-memory.dmp	family_zgrat_v1
behavioral1/memory/804-51-0x000000001E480000-0x000000001E73A000-memory.dmp	family_zgrat_v1
behavioral1/memory/804-53-0x000000001E480000-0x000000001E73A000-memory.dmp	family_zgrat_v1
behavioral1/memory/804-55-0x000000001E480000-0x000000001E73A000-memory.dmp	family_zgrat_v1
behavioral1/memory/804-57-0x000000001E480000-0x000000001E73A000-memory.dmp	family_zgrat_v1
behavioral1/memory/804-59-0x000000001E480000-0x000000001E73A000-memory.dmp	family_zgrat_v1
behavioral1/memory/804-61-0x000000001E480000-0x000000001E73A000-memory.dmp	family_zgrat_v1
behavioral1/memory/804-63-0x000000001E480000-0x000000001E73A000-memory.dmp	family_zgrat_v1
behavioral1/memory/804-65-0x000000001E480000-0x000000001E73A000-memory.dmp	family_zgrat_v1
behavioral1/memory/804-67-0x000000001E480000-0x000000001E73A000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
804	1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe
804	1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe
804	1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe
804	1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe
804	1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe
804	1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe
804	1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe
804	1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe
804	1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe
804	1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	804	1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe
Token: SeDebugPrivilege	804	1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 804 wrote to memory of 836	804	1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe	30
PID 804 wrote to memory of 836	804	1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe	30
PID 804 wrote to memory of 836	804	1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe	30
PID 804 wrote to memory of 548	804	1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe	31
PID 804 wrote to memory of 548	804	1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe	31
PID 804 wrote to memory of 548	804	1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe	31
PID 804 wrote to memory of 656	804	1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe	32
PID 804 wrote to memory of 656	804	1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe	32
PID 804 wrote to memory of 656	804	1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe	32
PID 804 wrote to memory of 2868	804	1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe	33
PID 804 wrote to memory of 2868	804	1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe	33
PID 804 wrote to memory of 2868	804	1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe	33
PID 804 wrote to memory of 1672	804	1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe	34
PID 804 wrote to memory of 1672	804	1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe	34
PID 804 wrote to memory of 1672	804	1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe	34
PID 804 wrote to memory of 1640	804	1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe	35
PID 804 wrote to memory of 1640	804	1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe	35
PID 804 wrote to memory of 1640	804	1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe	35
PID 804 wrote to memory of 1484	804	1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe	36
PID 804 wrote to memory of 1484	804	1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe	36
PID 804 wrote to memory of 1484	804	1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe	36
PID 804 wrote to memory of 2164	804	1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe	37
PID 804 wrote to memory of 2164	804	1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe	37
PID 804 wrote to memory of 2164	804	1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe	37
PID 804 wrote to memory of 1180	804	1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe	38
PID 804 wrote to memory of 1180	804	1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe	38
PID 804 wrote to memory of 1180	804	1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe	38
PID 804 wrote to memory of 2324	804	1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe	39
PID 804 wrote to memory of 2324	804	1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe	39
PID 804 wrote to memory of 2324	804	1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe	39

C:\Users\Admin\AppData\Local\Temp\1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe
"C:\Users\Admin\AppData\Local\Temp\1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:804
- C:\Users\Admin\AppData\Local\Temp\1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe
  "C:\Users\Admin\AppData\Local\Temp\1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe"
  2⤵
  PID:836
- C:\Users\Admin\AppData\Local\Temp\1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe
  "C:\Users\Admin\AppData\Local\Temp\1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe"
  2⤵
  PID:548
- C:\Users\Admin\AppData\Local\Temp\1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe
  "C:\Users\Admin\AppData\Local\Temp\1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe"
  2⤵
  PID:656
- C:\Users\Admin\AppData\Local\Temp\1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe
  "C:\Users\Admin\AppData\Local\Temp\1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe"
  2⤵
  PID:2868
- C:\Users\Admin\AppData\Local\Temp\1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe
  "C:\Users\Admin\AppData\Local\Temp\1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe"
  2⤵
  PID:1672
- C:\Users\Admin\AppData\Local\Temp\1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe
  "C:\Users\Admin\AppData\Local\Temp\1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe"
  2⤵
  PID:1640
- C:\Users\Admin\AppData\Local\Temp\1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe
  "C:\Users\Admin\AppData\Local\Temp\1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe"
  2⤵
  PID:1484
- C:\Users\Admin\AppData\Local\Temp\1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe
  "C:\Users\Admin\AppData\Local\Temp\1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe"
  2⤵
  PID:2164
- C:\Users\Admin\AppData\Local\Temp\1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe
  "C:\Users\Admin\AppData\Local\Temp\1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe"
  2⤵
  PID:1180
- C:\Users\Admin\AppData\Local\Temp\1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe
  "C:\Users\Admin\AppData\Local\Temp\1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d.exe"
  2⤵
  PID:2324

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/804-0-0x00000000008F0000-0x000000000091E000-memory.dmp

Filesize
184KB

Download
memory/804-1-0x000007FEF5340000-0x000007FEF5D2C000-memory.dmp

Filesize
9.9MB

Download
memory/804-2-0x000000001BB50000-0x000000001BBD0000-memory.dmp

Filesize
512KB

Download
memory/804-3-0x000000001E480000-0x000000001E740000-memory.dmp

Filesize
2.8MB

Download
memory/804-4-0x000000001E480000-0x000000001E73A000-memory.dmp

Filesize
2.7MB

Download
memory/804-5-0x000000001E480000-0x000000001E73A000-memory.dmp

Filesize
2.7MB

Download
memory/804-7-0x000000001E480000-0x000000001E73A000-memory.dmp

Filesize
2.7MB

Download
memory/804-9-0x000000001E480000-0x000000001E73A000-memory.dmp

Filesize
2.7MB

Download
memory/804-11-0x000000001E480000-0x000000001E73A000-memory.dmp

Filesize
2.7MB

Download
memory/804-13-0x000000001E480000-0x000000001E73A000-memory.dmp

Filesize
2.7MB

Download
memory/804-15-0x000000001E480000-0x000000001E73A000-memory.dmp

Filesize
2.7MB

Download
memory/804-17-0x000000001E480000-0x000000001E73A000-memory.dmp

Filesize
2.7MB

Download
memory/804-19-0x000000001E480000-0x000000001E73A000-memory.dmp

Filesize
2.7MB

Download
memory/804-21-0x000000001E480000-0x000000001E73A000-memory.dmp

Filesize
2.7MB

Download
memory/804-23-0x000000001E480000-0x000000001E73A000-memory.dmp

Filesize
2.7MB

Download
memory/804-25-0x000000001E480000-0x000000001E73A000-memory.dmp

Filesize
2.7MB

Download
memory/804-27-0x000000001E480000-0x000000001E73A000-memory.dmp

Filesize
2.7MB

Download
memory/804-29-0x000000001E480000-0x000000001E73A000-memory.dmp

Filesize
2.7MB

Download
memory/804-31-0x000000001E480000-0x000000001E73A000-memory.dmp

Filesize
2.7MB

Download
memory/804-33-0x000000001E480000-0x000000001E73A000-memory.dmp

Filesize
2.7MB

Download
memory/804-35-0x000000001E480000-0x000000001E73A000-memory.dmp

Filesize
2.7MB

Download
memory/804-37-0x000000001E480000-0x000000001E73A000-memory.dmp

Filesize
2.7MB

Download
memory/804-39-0x000000001E480000-0x000000001E73A000-memory.dmp

Filesize
2.7MB

Download
memory/804-41-0x000000001E480000-0x000000001E73A000-memory.dmp

Filesize
2.7MB

Download
memory/804-43-0x000000001E480000-0x000000001E73A000-memory.dmp

Filesize
2.7MB

Download
memory/804-45-0x000000001E480000-0x000000001E73A000-memory.dmp

Filesize
2.7MB

Download
memory/804-47-0x000000001E480000-0x000000001E73A000-memory.dmp

Filesize
2.7MB

Download
memory/804-49-0x000000001E480000-0x000000001E73A000-memory.dmp

Filesize
2.7MB

Download
memory/804-51-0x000000001E480000-0x000000001E73A000-memory.dmp

Filesize
2.7MB

Download
memory/804-53-0x000000001E480000-0x000000001E73A000-memory.dmp

Filesize
2.7MB

Download
memory/804-55-0x000000001E480000-0x000000001E73A000-memory.dmp

Filesize
2.7MB

Download
memory/804-57-0x000000001E480000-0x000000001E73A000-memory.dmp

Filesize
2.7MB

Download
memory/804-59-0x000000001E480000-0x000000001E73A000-memory.dmp

Filesize
2.7MB

Download
memory/804-61-0x000000001E480000-0x000000001E73A000-memory.dmp

Filesize
2.7MB

Download
memory/804-63-0x000000001E480000-0x000000001E73A000-memory.dmp

Filesize
2.7MB

Download
memory/804-65-0x000000001E480000-0x000000001E73A000-memory.dmp

Filesize
2.7MB

Download
memory/804-67-0x000000001E480000-0x000000001E73A000-memory.dmp

Filesize
2.7MB

Download
memory/804-1994-0x000007FEF5340000-0x000007FEF5D2C000-memory.dmp

Filesize
9.9MB

Download
memory/804-2368-0x000000001BB50000-0x000000001BBD0000-memory.dmp

Filesize
512KB

Download
memory/804-4886-0x0000000000770000-0x0000000000771000-memory.dmp

Filesize
4KB

Download
memory/804-4887-0x000000001BEB0000-0x000000001BFAE000-memory.dmp

Filesize
1016KB

Download
memory/804-4888-0x00000000008A0000-0x00000000008EC000-memory.dmp

Filesize
304KB

Download
memory/804-4889-0x0000000002350000-0x00000000023A4000-memory.dmp

Filesize
336KB

Download
memory/804-4890-0x000007FEF5340000-0x000007FEF5D2C000-memory.dmp

Filesize
9.9MB

Download